Microsoft fixes a record 1,400+ flaws, and one is already under attack

“We’ve now crossed the 4,000 CVE mark with two months left to go,” Satnam Narang of Tenable told Brian Krebs.

Microsoft has fixed more than 1,400 security flaws in one month, the largest Microsoft Patch Tuesday on record. The updates came out on 13 October, Krebs reported on Krebs on Security . They beat September’s record of nearly 1,000, which was already about ten times Microsoft’s normal monthly load.

October alone beats the 1,261 flaws Microsoft fixed in all of 2020, the previous record year, Narang said. At least 78 of this month’s flaws are rated critical. Most of those let an attacker run code of their choice on the target system.

Only one of the flaws was already in use by attackers. CVE-2026-96951 sits in the Windows Shell. It lets an attacker get around Mark of the Web. That is the Windows label that adds extra checks to files from the internet. Microsoft rates the flaw Important, with a CVSS score of 8.8.

The attack needs the victim to act, Microsoft said in its advisory. An attacker would send a crafted file by email or instant message, or a link to a malicious site. The user then has to open it. The fix covers Windows 10, Windows 11, Windows Server and Outlook.com.

Microsoft credited Riku Bamba and Yuya Chudo of Fujitsu and a researcher named yhw. It also credited Benoit Sevens, listed as “using Claude with Anthropic”. Microsoft has not said who is exploiting the flaw or who the targets are.

A second flaw, in the .NET Framework, was public before the fix. That could give attackers extra time to work out how to exploit it, Krebs wrote. Microsoft said it has seen no signs of attacks on it yet.

Microsoft credits large language models for the jump in bugs found, Krebs reported. In July, the company said AI found the bugs behind that month’s record.

This week, Bank of America’s chief executive said 1,000 contractors are fixing flaws that AI exposed.

Batches this large put extra strain on corporate security teams, security experts warn. Those teams often test each update before rolling it out, Krebs wrote.

Tyler Reguly of Fortra told Krebs that only 26 Microsoft flaws have entered the US government’s catalogue of exploited bugs so far this year. Teams should patch those 26 first, he said.

“Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act,” Reguly said.