Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug

Microsoft’s Patch Tuesday update fixed 1,413 vulnerabilities, breaking the company’s previous record. More than 70 were rated Critical, and one Windows Shell flaw was already being exploited. The release matters because attackers may target known weaknesses before organizations can apply patches.

The fixes covered 1,102 Windows flaws, 134 Office flaws, 61 Developer Tools flaws, 36 SharePoint Server flaws, and 22 SQL Server flaws. The update also addressed CVE-2026-21413, a critical Raw Image Extension vulnerability that could enable remote code execution when Windows generated a thumbnail or preview.

The release reflects a growing volume of vulnerability discoveries. Dustin Childs of ZDI said AI is helping researchers and vendors find flaws faster, but it is not creating them. Microsoft’s guidance and the exploitation of CVE-2026-96951 make prioritizing proven, public, exploitable issues especially important.

The update was unusually large, covering 1,413 vulnerabilities in one Patch Tuesday release. That volume shattered Microsoft’s own record and shows why vulnerability count alone can overwhelm security teams. More than 670 flaws involved privilege escalation, while over 300 involved remote code execution.

Windows accounted for 1,102 vulnerabilities, making it by far the largest group. Office contributed 134 flaws. Developer Tools contributed 61, SharePoint Server contributed 36, and SQL Server contributed 22. More than 70 vulnerabilities were rated Critical, adding urgency to the patching effort.

The scale does not mean every flaw presents the same immediate danger. Dustin Childs said teams should focus on exploitability rather than simply counting CVEs. The release included an actively exploited Windows Shell flaw, a publicly known .NET Framework flaw, and a critical Raw Image Extension flaw.

CVE stands for Common Vulnerabilities and Exposures. It is a public naming system for software security flaws. Each vulnerability receives a unique identifier, such as CVE-2026-96951, so people can refer to the same issue consistently across security tools, advisories, patches, and databases.

The identifier combines the CVE label, the year assigned, and a distinct number. In the article, CVE-2026-96951 identifies a Windows Shell command injection flaw. CVE-2026-108398 identifies a .NET Framework search path flaw, while CVE-2026-92707 identifies a MessagePack-CSharp memory allocation flaw.

A CVE number does not by itself describe how dangerous a vulnerability is. The article gives different CVSS scores for the named flaws and explains their effects, including security-feature bypass and denial of service. Teams therefore need the identifier plus details about exploitation, access, impact, and required user interaction.

When Microsoft says a vulnerability is being exploited in the wild, it means the flaw has moved beyond testing or theoretical research. Attackers are using it in real-world activity. That makes the issue more urgent because defenders must assume exploitation may already be occurring.

The vulnerability, CVE-2026-96951, affects Windows Shell and can let an unauthorized attacker bypass a security feature over a network. Microsoft said successful exploitation could evade Mark of the Web defenses. An attacker could send a specially crafted file or link, but would need to persuade the user to take action.

The article does not explain how the attacks were conducted in practice, who carried them out, or who was targeted. CISA nevertheless added the flaw to its KEV catalog. Its known exploitation means organizations should prioritize the patch instead of treating it like an ordinary item in a large update.

Mark of the Web, or MOTW, is a Windows defense associated with content obtained from untrusted locations. Bypassing it can prevent the system from applying expected protections to a downloaded or externally sourced file. The article identifies this evasion as the main consequence of CVE-2026-96951.

An attacker could send a specially crafted attachment or direct a user to a malicious website. The flaw is a command injection vulnerability in Windows Shell. Microsoft said the attacker could not force the user to view attacker-controlled content. The user had to click a link or handle a malicious attachment.

The article does not state what payloads attackers used after bypassing MOTW. It does confirm active exploitation and a CVSS score of 8.8. Because the flaw can weaken a security boundary through a familiar email or messaging scenario, Microsoft’s patch and CISA’s KEV listing make it a high-priority issue.

CISA’s Known Exploited Vulnerabilities catalog highlights vulnerabilities confirmed to be used in attacks. CVE-2026-96951 qualified because Microsoft said it had been exploited in the wild. The listing signals that the Windows Shell issue deserves immediate attention rather than routine treatment among 1,413 patched vulnerabilities.

The flaw can help an unauthorized attacker bypass Mark of the Web defenses. A crafted file or link could trigger the attack if a user clicks or opens the content. Microsoft said attackers cannot force a user to view their content, so persuasion remains part of the described scenario.

For federal agencies, the catalog creates a firm deadline. The article states that agencies must apply the fixes by October 16, 2026. It does not describe penalties or the agencies’ individual systems. The requirement turns Microsoft’s exploitation warning into a concrete federal patching obligation.

Patching every vulnerability in numerical order can waste time when a release contains 1,413 flaws. The important question is not simply how many CVEs exist, but which ones attackers can exploit, how they can reach systems, and what access or user action they need. Those details help teams spend limited effort wisely.

For example, CVE-2026-96951 was exploited in the wild and could bypass Mark of the Web through a malicious file or link. CVE-2026-108398 was publicly known and could bypass WDAC after an authenticated attacker placed a crafted .NET assembly locally. These facts make both flaws especially important despite different attack conditions.

Dustin Childs said discovery is scaling faster than exploitation. He advised teams to patch what is proven, prioritized, and public, rather than burning cycles on CVE totals. The update’s size may become normal, so risk-based triage will matter even more as researchers and vendors find flaws faster.