Microsoft Fixes 1,413 Flaws, Including Exploited Zero-Day

Microsoft released its October security updates on Tuesday, Oct. 13, fixing 1,413 vulnerabilities across Windows, Office, developer tools, SharePoint Server, Exchange Server, Azure, Defender and other products.

The total includes 1,102 Windows vulnerabilities, 134 affecting Office, 61 in developer tools and 36 in SharePoint Server. Microsoft fixed more vulnerabilities in this month’s release than throughout all of 2025. The number of flaws addressed in 2026 has now exceeded 4,000.

The exploited zero-day, tracked as CVE-2026-96951, has a CVSS severity score of 8.8 out of 10. Microsoft classifies it as a security feature bypass in the Windows shell. The flaw allows attackers to evade Mark of the Web, a tag placed on files downloaded from the internet.

Mark of the Web helps security tools identify potentially unsafe files and limit automatic execution. It can support protections such as Microsoft Defender SmartScreen and Office Protected View. Bypassing the tag may allow a malicious file to open without the expected warning or restriction.

“In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability,” Microsoft wrote in its advisory. The company added that attackers could not force users to view content under their control and would need to persuade them to take action.

Researchers at Fujitsu, Anthropic and an independent security expert separately reported the vulnerability to Microsoft. The company has not disclosed details about the attacks that exploited it. The Cybersecurity and Infrastructure Security Agency added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog on Tuesday and ordered U.S. federal agencies to apply the patch by Oct. 16.

Two other vulnerabilities had been publicly disclosed before Microsoft released fixes. CVE-2026-108398 allows attackers to bypass Windows Defender Application Control enforcement. Microsoft assesses exploitation of that flaw as unlikely.

CVE-2026-92707 is a denial-of-service vulnerability in the MessagePack-CSharp component used by Visual Studio and .NET. Microsoft has not assessed whether attackers are likely to exploit it.

Microsoft also introduced “risk cohorts” to help customers prioritize security work. The groups contain vulnerabilities that require a similar customer assessment, even when the flaws have different causes or CVSS scores.

“A risk cohort is a group of CVEs that require a similar customer assessment,” Microsoft wrote in a blog post. The company added that risk cohorts are a starting point and that customers should review each vulnerability for active exploitation, severity, attack method, user interaction and product-specific guidance.