Microsoft's October 2026 Patch Tuesday fixes over 1,400 flaws

Microsoft shipped its October 2026 security updates on 13 October, covering Windows, Office, Exchange Server and server products. CrowdStrike counts 1,413 vulnerabilities and SANS ISC 1,417, including 75–76 rated Critical. One flaw, CVE-2026-96951, is already exploited: it bypasses Mark of the Web, and CISA set a 16 October remediation deadline.

• CrowdStrike counts 1,413 flaws, SANS ISC 1,417, with 75–76 rated Critical
• CVE-2026-96951 (CVSS 8.8) bypasses Mark of the Web and is exploited in the wild
• Two critical AD FS spoofing flaws: CVE-2026-108131 and CVE-2026-96222
• 20 critical RCEs in Excel, PowerPoint, Visio and Word, six via Preview Pane