Microsoft's Biggest-Ever Patch Tuesday Ships With a Live Zero-Day

Microsoft just shipped the largest batch of security fixes in its history, and one of the bugs in it was already being used against real victims before the update existed. The October 2026 Patch Tuesday release covers more than 1,400 vulnerabilities — BleepingComputer puts the figure at 1,411, with rival trackers landing a few CVEs either side depending on how they count entries published earlier in the month — and buried in that pile is a flaw attackers found before Microsoft did.

A Record Nobody Wanted to Break

Patch Tuesday is the second Tuesday of every month, when Microsoft bundles fixes across Windows, Office, Azure, SQL Server and the rest of its product line into one coordinated release. A typical month brings somewhere between 100 and 150 fixes. This one blew past the previous record — set just last month, when Microsoft patched a then-unprecedented 974 flaws — by several hundred more, as Code24 covered at the time. Two months in a row of record-breaking patch counts is starting to look less like a one-off and more like the new shape of software maintenance.

Windows components make up the bulk of this month's fixes, but the list touches almost everything Microsoft ships. Security researchers tracking the release count three zero-days in total — bugs that were either under active attack or publicly known before a patch was ready, meaning defenders had no head start.

The Bug Already Being Used in Attacks

The one causing the most concern is CVE-2026-96951, a flaw in Windows Shell rated 8.8 out of 10 on the severity scale, which Microsoft confirms is already being exploited. It works by getting around "Mark of the Web" — a hidden tag Windows quietly attaches to any file downloaded from the internet, which is what triggers the orange security warning banner you see before opening a file from an unfamiliar source. This bug lets a malicious file slip past that tag entirely, so the warning never fires.

That matters because Mark of the Web is one of the few checks standing between a user and a booby-trapped attachment. Researchers say the likely attack path is social engineering — tricking someone into opening a file sent over email or chat, now with one less red flag to give it away.

• CVE-2026-96951 — Windows Shell security feature bypass, CVSS 8.8, confirmed exploited in the wild, defeats Mark of the Web file warnings.
• CVE-2026-108398 — a .NET Framework security feature bypass, publicly disclosed with technical details already available, though Microsoft hasn't yet seen it used in attacks.
• A third zero-day rounds out the list, continuing a pattern this year of Patch Tuesdays shipping fixes for bugs attackers reached first.

Patching priority this month is simple: CVE-2026-96951 goes to the top of every list, because "already exploited" beats "critical severity" every time you have to choose what gets fixed first.

Why This Is a Clock, Not a Calendar Item, in India

For Indian organisations, this isn't just another advisory to file away. CERT-In — India's Computer Emergency Response Team, the government body that tracks and responds to cyber threats nationally — introduced a tiered patching mandate this year requiring banks, telecom operators, digital public infrastructure and healthcare and energy providers to fix known-exploited vulnerabilities on internet-facing "crown jewel" systems within 12 hours where feasible, with a one-day window for other critical external flaws. A confirmed zero-day like CVE-2026-96951, actively used against real targets, is exactly the category that mandate was written for.

The harder problem sits with everyone outside that regulated tier. A mid-sized Indian IT services firm, a fintech startup, or a college running its own Windows lab doesn't answer to CERT-In's crown-jewel rule, but its employees open email attachments just as often as a bank's do — and without the same patching discipline or dedicated security team watching for exactly this kind of bypass, they're arguably more exposed, not less.

What Changes Now

Microsoft's monthly release notes include the registry-level and group policy workarounds IT teams can apply if they can't roll out the full update immediately, but security researchers are unanimous that this isn't a patch to defer. Two record-breaking Patch Tuesdays back to back, each carrying live zero-days, suggest attackers are finding and weaponising Windows bugs faster than the old monthly cadence was ever built to handle. The number that matters by November isn't how many CVEs get fixed — it's how many organisations, in India and elsewhere, actually closed this one before someone used it against them.