Microsoft has released its biggest security update ever, fixing 1,413 vulnerabilities in Windows and its other products. The total towers over September’s near-1,000 fixes, itself roughly ten times a normal monthly load.
Only one flaw in the batch is known to be exploited. CVE-2026-96951 is a command injection in Windows Shell that lets a crafted file slip past Mark of the Web protections, which normally warn users, open files in Protected View, or block them outright. An attacker has to get the victim to open the file, delivered by email, chat, or a malicious download.
Tenable’s Satnam Narang called it the third Windows Shell flaw exploited this year, after a pair of bugs tied to APT28.
At least 78 fixes are rated critical, and TrendAI’s Zero Day Initiative flagged 55 wormable, zero-click remote code execution bugs spread across DHCP Server, Remote Desktop Gateway, and Network Policy Server. It also singled out CVE-2026-102866, a SharePoint signature verification failure that could let an unauthenticated attacker hijack an account with a tampered proof token.
Microsoft credits large language models for the surging discovery rate. Tenable noted the industry has now passed 4,000 CVEs for the year with two months left.
Security leaders should not chase raw counts. Fortra’s Tyler Reguly said only 26 Microsoft bugs have reached CISA’s Known Exploited Vulnerabilities catalog this year, and those deserve patching first. ZDI’s Dustin Childs put it plainly: patch what is proven and prioritized, and treat the rest as the new normal.
