Microsoft Patch Tuesday fixes a record 1,400-plus flaws, including an exploited Windows Shell zero-day

The October release is the largest in Microsoft's history (counts vary by methodology: BleepingComputer counted 1,411, SecurityWeek 1,413). The actively exploited flaw is CVE-2026-96951 (CVSS 8.8), a Windows Shell security feature bypass that defeats Mark of the Web protections. CISA added it to the KEV catalog the same day with an October 16 federal deadline.

Sources: SecurityWeek; BleepingComputer