Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
Summary: Microsoft's latest Patch Tuesday shipped fixes for 1,413 vulnerabilities, its largest release on record, including 1,102 flaws in Windows, 134 in Office, and more than 70 rated Critical. One flaw, CVE-2026-96951, has been exploited in the wild to evade Mark of the Web defenses, and CISA added it to the KEV catalog with a federal remediation deadline of October 16, 2026.
Key Takeaway: CISA has ordered federal agencies to close the exploited Mark of the Web bypass by October 16, 2026, while the release also carries a publicly known WDAC bypass that needs no user interaction and a 9.8-severity RAW image flaw that triggers on thumbnail preview alone. With more than 4,000 CVEs patched by Microsoft this year, teams triaging by CVE count rather than exploitability are spending their cycles on the wrong bugs.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-108398CVE-2026-21413CVE-2026-92707CVE-2026-96951
- Related
- ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Cyber Risks ·CVE-2026-96951: Microsoft Windows Command Injection Vulnerability Known Exploited Vulnerabilities · Oct 13, 2026Foxit, Lib Raw vulnerabilities Cyber Risks ·