Microsoft’s October 2026 security release addresses more than 1,400 vulnerabilities and includes CVE-2026-96951, a Windows Shell flaw marked as exploited in the wild.[1][4] CISA added it to the Known Exploited Vulnerabilities catalogue on 13 October.[2][3] The exact total varies across the release note and independent analyses, with the checked pages giving no single reconciliation.[1][4][5]
The headline number needs context
The MSRC page displays “Released: Oct 15, 2026” and says 1,413 Microsoft CVEs. Its product-family table totals 1,414 and lists one republished non-Microsoft CVE separately.[1] Tenable and Ivanti count 1,407.[4][5] Malwarebytes and Kaspersky report 1,413 and 1,414; ZDI reports 1,415.[6][9][8]
Microsoft explains the difference between its headline and table.[1] The independent analyses still offer no single reconciled total.[4][5][6] Exploitation status offers the sharper deployment signal.[1][2]
CVE-2026-96951 is the urgent item
Microsoft describes CVE-2026-96951 as a Windows Shell security feature bypass and records “Exploitation Detected”.[1] CISA describes a command-injection flaw that bypasses a security feature over a network.[3] The catalogue records 13 October as the date added, 16 October as the due date and forensic triage as required; ransomware use is unknown.[3]
Malwarebytes says successful exploitation requires user interaction, such as opening a malicious link or attachment.[6]
What defenders can do
Identify affected Windows assets and apply the October update.[1] For FCEB agencies, BOD 26-04 requires rapid remediation of high-risk KEV entries on publicly exposed assets that grant total control after exploitation and sets expectations for checking whether threat actors compromised a system before patching.[2] CISA encourages all organisations to prioritise KEV entries through risk-based vulnerability management.[2]
CVE-2026-108398 needs separate tracking. Microsoft labels it publicly disclosed, and Malwarebytes describes an untrusted search-path flaw in .NET Framework that can bypass WDAC locally.[1][6] The checked sources do not mark it as exploited.[1][5][8]
Sources
[1] Microsoft October 2026 Security Updates release notes
[2] CISA adds two known exploited vulnerabilities to the KEV catalog
[3] CISA Known Exploited Vulnerabilities Catalog
[4] Tenable October 2026 Patch Tuesday analysis
[5] Ivanti October 2026 Patch Tuesday analysis
[6] Malwarebytes October 2026 Patch Tuesday analysis
