Microsoft's October update patches 1415 vulnerabilities, one exploited in the wild

Microsoft's October security update fixed 1,415 vulnerabilities, 85 of them critical, including a Windows Shell bypass of Mark of the Web defenses that attackers have exploited. Early reports also flag two updates that broke enterprise Wi-Fi and VPN connections.

Microsoft shipped 1,415 vulnerability fixes in its October security update, the largest monthly release in a string of oversized patch bundles. The update covers Windows, Office, Exchange, .NET, Edge, and components of Hyper-V and Azure. Eighty-five flaws carry a critical rating, and one Windows Shell vulnerability has seen exploitation in the wild.

CVE-2026-96951 lets an unauthorized attacker inject special elements into Windows Shell and bypass a security feature over a network. That feature is Mark of the Web, the mark Windows stamps on files that arrive from the internet or from email, which triggers SmartScreen warnings and blocks macro execution in Office documents. Defeating it puts downloaded files on the same trust footing as local ones.

Microsoft names email or instant message as a potential delivery route, with a crafted file attached. The company also points out that an attacker cannot force a user to open attacker-controlled content, so the attack needs the user to act: click a link to a hostile site or open an attachment. Patching the shell component removes that opening.

A queue 1,415 entries long

The volume itself became the first concern practitioners raised. A moderator of the r/SecOpsDaily community posting as falconupkid warned that releases at this scale tend to hide a batch of "wormable" or pre-authentication remote code execution bugs behind the routine fixes, and that the critical few are easy to overlook. The same poster argued that the gap between disclosure and exploitation now sits at "effectively zero," and recommended prioritizing every CVE rated above 9.0 while planning remediation with regression testing in mind.

That ranking advice matters more than usual here. Eighty-five critical fixes across Windows Server, client Windows, and .NET means patch precedence differs by role: an internet-facing Exchange or IIS server consumes attention before an administrative workstation, and domain controllers follow their own change window.

A .NET bypass disclosed before the patch

Security researcher Brian Krebs highlighted CVE-2026-108398, a .NET Framework security feature bypass that Microsoft acknowledges was publicly disclosed before the update shipped. Public disclosure hands attackers a head start on building an exploit. Microsoft reported no evidence of exploitation to date.

The .NET fix lands alongside the servicing stack and cumulative updates that administrators apply together, so the bypass gets covered in the same maintenance window rather than requiring a separate deployment.

Two updates that broke connections

Reports of collateral damage surfaced within hours of installation. user Odd_Round9576 reported that KB5127648 broke WPA-Enterprise Wi-Fi: after installing and rebooting, clients could no longer join the network, and uninstalling the update restored access. Appropriate-Pipeline6575 reported that the same update cycle stopped IPSec VPN connections on some laptops and left coworkers unable to connect.

Both reports point to a deployment sequence: install the October patches on a pilot ring, exercise Wi-Fi and VPN authentication against your own RADIUS and VPN infrastructure, then roll out in stages while watching for regressions.

Why the counts keep climbing

Krebs notes that the rising number of vulnerabilities identified each month, driven in part by AI agents used in discovery, may broaden coverage of bugs that earlier reviews missed. The same trend adds work for security teams, which must test individual updates before pushing them across a network to confirm the fixes do not break other software. Enterprise shops that once rolled out one monthly bundle now maintain test rigs for the specific combinations of VPN clients, Wi-Fi authentication, and line-of-business software they run.

Administrators can review every fix in the Microsoft Security Update Guide and pull individual packages from the Microsoft Update Catalog . The SANS Internet Storm Center diary tracks reader-confirmed regressions and exploitation activity as the patch cycle unfolds. Windows administrators who have not already done so should confirm that Windows Update or WSUS delivered the October cumulative update, since CVE-2026-96951 has no workaround.