- Microsoft patched 1,417 vulnerabilities on October 13, 2026, with 76 rated critical, according to the SANS Internet Storm Center.
- One flaw, CVE-2026-96951, is already exploited. It bypasses Mark of the Web, but the victim must still open the file.
- Ask your team to sort the release: DHCP servers, Exchange, .NET application control, Office updates, and mail and chat handling.
A very large patch release does not tell you where the danger is. The useful work is sorting. In Microsoft's October 13 release, one flaw among 1,417 is reported as already exploited.
Johannes Ullrich, Dean of Research at SANS.edu, summarised the release for the SANS Internet Storm Center. He reports that 76 of the 1,417 vulnerabilities are rated critical. Seven of the critical ones need no action from customers.
The idea: a long list hides a short one
No team patches 1,417 items with equal urgency. The lesson here is that the headline count says little about your exposure. A few entries matter far more than the rest, and the skill is finding them quickly.
The SANS summary names four. Only one is reported as exploited already.
The exploited flaw still needs a person
CVE-2026-96951 is a Windows Shell security feature bypass, and it is already exploited. It defeats "Mark of the Web", the label Windows attaches to files that arrive from outside. That label exists so the system can treat such files with suspicion.
SANS says the bypass makes code easier to run when an attacker sends a malicious message by email or instant messaging. The victim must still open the file.
That last step is a human one. A patch closes the technical gap. It does not change what an employee does with an attachment. Training and mail filtering remain part of the defence here.
Three more worth a look
CVE-2026-108398 is a .NET framework security feature bypass. It could let an attacker get around application control and run unauthorised programs. Application control is the rule set that decides which software may run. Its details were public before the release. Microsoft did not detect it being used in the wild.
The Windows DHCP Server received fixes for 10 remote code execution flaws. Five are critical. DHCP is the service that hands network addresses to devices. Remote code execution means an attacker can run commands on the server from elsewhere.
CVE-2026-70571 affects Microsoft Exchange Server. An attacker sends a specific email, and the flaw triggers while the server converts the message content. Microsoft rates the attack complexity as high. That makes it harder to pull off, but the trigger is an email the server must process.
What the volume says about Office
Ullrich flags the number of Office vulnerabilities as a separate point. He suggests the Office updates should likely be handled quickly. The summary does not give an Office count, so ask your team to pull one from Microsoft's own listing.
Questions for your security team
Ask who owns the sorting each month, and how long it takes from release to a decision. Ask whether any server in your estate runs the DHCP role, and whether Exchange Server is still run on-premises.
Ask whether your controls assume the Mark of the Web prompt will stop risky files. This month's release includes a control that is already being exploited. Ask the same about application control and .NET.
The exploited Shell bug is delivered by email or instant messaging. So ask how mail and chat handling treat inbound files. Separately, ask how Office updates are tested and rolled out, given the volume Ullrich noted.
A patch count is a measure of Microsoft's workload. Your exposure depends on the few items that match how your people and servers actually work.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: SANS Internet Storm Center.
