Microsoft's October 2026 Patch Tuesday is the largest it has issued: 1,413 CVEs fixed. SecurityWeek reports that is more than the company patched in all of 2025, and that its 2026 total now exceeds 4,000.
The one already being used
CVE-2026-96951 is a Windows shell security feature bypass. It lets an attacker get around Mark of the Web protections, so a malicious file can open without the usual warning. An attacker still has to trick someone into opening it, for instance through a crafted file sent by email or chat. Fujitsu, Anthropic and an independent researcher reported it. Details of the attacks were not shared.
The US cyber agency CISA added it to its Known Exploited Vulnerabilities catalogue on 13 October and told federal agencies to fix it by 16 October.
Why so many
SecurityWeek links the record to AI-driven vulnerability discovery, including companies using AI to find bugs in their own code. More bugs found is not the same as a less secure product, but it does mean more to install.
