---
title: 'Microsoft Patch Tuesday fixes a record 1,400-plus flaws, including an exploited Windows Shell zero-day'
url: 'https://www.securteksecurity.com/news/microsoft-patch-tuesday-1400-flaws-windows-shell-zero-day'
markdown: 'https://www.securteksecurity.com/news/microsoft-patch-tuesday-1400-flaws-windows-shell-zero-day.md'
date: '2026-10-13'
description: "The October release is the largest in Microsoft's history (counts vary by methodology: BleepingComputer counted 1,411, SecurityWeek 1,413). The actively exploited flaw is CVE-2026-96951 (CVSS 8.8), a Windows Shell security feature bypass that defeats Mark of the Web protections. CISA added it to th…"
taxonomy:
  category:
    - Cybersecurity
---

# [Microsoft Patch Tuesday fixes a record 1,400-plus flaws, including an exploited Windows Shell zero-day](https://www.securteksecurity.com/news/microsoft-patch-tuesday-1400-flaws-windows-shell-zero-day)

   13th Oct 2026  

The October release is the largest in Microsoft's history (counts vary by methodology: BleepingComputer counted 1,411, SecurityWeek 1,413). The actively exploited flaw is CVE-2026-96951 (CVSS 8.8), a Windows Shell security feature bypass that defeats Mark of the Web protections. CISA added it to the KEV catalog the same day with an October 16 federal deadline.

Sources: [SecurityWeek](https://www.securityweek.com/microsoft-patches-record-1413-vulnerabilities-including-exploited-windows-zero-day/amp/); [BleepingComputer](https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/)

---

## Navigation

- Parent: [News](https://www.securteksecurity.com/news.md)
- Previous: [Microsoft completes pre-training of MAI-Base-2, a 2.8 trillion parameter model](https://www.securteksecurity.com/news/microsoft-mai-base-2-pre-training-complete.md)
- Next: [Nadella: treat advanced AI as an insider threat, build an emergency brake](https://www.securteksecurity.com/news/nadella-treat-advanced-ai-as-an-insider-threat-build-an-emergency-brake.md)