Microsoft Patches Massive 1,411 Security Vulnerabilities, Including Actively Exploited Windows Zero-Day

Microsoft released security updates on October 13, 2026, addressing a reported 1,413 vulnerabilities across its software portfolio, including an actively exploited Windows Shell zero-day.

The release covers Windows, Office, SharePoint Server, SQL Server, developer tools, and cloud services, creating a substantial patching workload for enterprise security teams.

The most urgent vulnerability is CVE-2026-96951, an Important-rated Windows Shell security feature bypass with a CVSS score of 8.8. Microsoft confirmed exploitation in the wild.

Microsoft Patches 1,413 Security Vulnerabilities

The flaw lets attackers bypass Mark of the Web protections, weakening warnings and security checks for files from untrusted locations. Successful exploitation can therefore help malicious content evade an important defensive boundary before subsequent attack stages.

Windows Shell provides the graphical interaction logic associated with Explorer and related libraries and application programming interfaces.

The exploited vulnerability targets this widely used operating-system layer rather than a standalone enterprise application.

Rapid7’s analysis describes CVE-2026-96951 as the second exploited Windows Shell zero-day disclosed this year, highlighting the continued importance of download-origin protections in preventing malicious file execution.

Microsoft’s release also addresses CVE-2026-108398, a publicly disclosed .NET Framework security feature bypass. Microsoft’s description indicates that exploitation could circumvent Windows Defender Application Control enforcement and permit unauthorized applications to run.

Public disclosure and confirmed exploitation remain distinct statuses: the available reporting identifies the Windows Shell issue as actively exploited, while describing the .NET Framework weakness as publicly known when patches became available.

The supplied MSRC extract lists elevation-of-privilege vulnerabilities across Windows Kernel, Common Log File System Driver, Background Intelligent Transfer Service, Clipboard User Service, and several graphics components.

It also identifies remote code execution vulnerabilities affecting DNS Server, DHCP Server, SQL Server, SharePoint, Internet Connection Sharing, and Message Queuing Queue Manager.

These entries establish affected components and impact classifications but do not provide exploitation prerequisites, affected builds, or individual CVSS scores.

Information disclosure issues appear throughout the extract, including ten separate DNS Server CVEs numbered CVE-2026-97835 through CVE-2026-97844.

Additional disclosure vulnerabilities affect Azure Active Directory, Azure HDInsight, Windows Installer, the Biometric Service, Event Viewer, and Windows Management Instrumentation. Every supplied entry carries an Important severity rating and specifies that customer action is required.

Prioritization should start with the confirmed exploited Windows Shell vulnerability, then exposed services and systems affected by high-impact execution or privilege-escalation flaws.

Administrators should verify applicable product versions and deployment instructions in Microsoft’s advisories rather than infer exploitability from vulnerability titles alone. The broader release includes more than 670 privilege-escalation flaws and over 300 remote code execution vulnerabilities.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team