Overview
- Microsoft published 1,413 own-product vulnerabilities for October, of which 1,102 affect Windows, marking a record-large Patch Tuesday and continuing a 2026 trend of rising vulnerability counts.
- One flaw, CVE-2026-96951 in the Windows Shell, is confirmed exploited in the wild and can bypass Mark of the Web, which normally warns users about files from the internet, when a user opens a crafted file or visits an attacker-controlled site.
- Microsoft issued fixes for five Outlook remote code execution bugs that can trigger simply by viewing messages in the preview pane, meaning users could be compromised without clicking links or opening attachments.
- Microsoft noted public disclosure of CVE-2026-108398, a .NET Framework security feature bypass that lets an attacker with an existing foothold register a malicious .NET assembly to evade Windows Defender Application Control (App Control for Business).
- Concurrent lifecycle moves and disclosure gaps are heightening risk: older products lost Extended Security Updates or reached end of servicing and Edge update notes temporarily omit specific CVE listings, which complicates defenders' patch planning and may force migrations for exposed systems.