Cybersecurity
Microsoft patches 1,413 vulnerabilities including active exploit
Microsoft said it released fixes for 1,413 vulnerabilities across Windows, Office and server products, including one it said was already being exploited and two other flaws it highlighted.
- Microsoft said on Tuesday that it had released fixes for 1,413 vulnerabilities, including one it said was under active exploitation.
- The release included 1,102 Windows flaws, 134 Office flaws, 61 Developer Tools flaws, 36 SharePoint Server flaws and 22 SQL Server flaws.
- Microsoft said CVE-2026-96951 in Windows Shell could let an unauthorised attacker bypass a security feature over the network, and CISA added it to its Known Exploited Vulnerabilities catalogue.
- Microsoft said CVE-2026-108398 in .NET Framework could let an authenticated attacker bypass Windows Defender Application Control and run unauthorised code in a protected process.
- Microsoft also patched CVE-2026-21413 in Raw Image Extension, which it said could lead to remote code execution when Windows generated a thumbnail or preview for a crafted RAW image file.
Microsoft said on Tuesday that it had fixed 1,413 vulnerabilities, and said one of them was already being exploited. It said more than 70 of the issues were rated Critical.
The company said CVE-2026-96951 affected Windows Shell and could let an unauthorised attacker bypass a security feature over a network. It credited Fujitsu's Riku Bamba and Yuya Chudo, Anthropic's Benoit Sevens and the researcher yhw for reporting it, and CISA added it to its Known Exploited Vulnerabilities catalogue with a 16 October 2026 deadline for federal agencies.
Microsoft said CVE-2026-108398 affected .NET Framework and could let an authenticated attacker bypass Windows Defender Application Control and execute code in a protected process. It said the flaw was publicly known when the patches were released, and it credited James Forshaw of Google Project Zero with finding it.
The company also patched CVE-2026-92707 in MessagePack-CSharp and CVE-2026-21413 in Raw Image Extension. For the latter, Microsoft said a specially crafted RAW image file could trigger code execution when Windows created a thumbnail or preview.
Named in this story
People
- Dustin Childs
- commented as head of Threat Awareness at ZDI
- Riku Bamba
- was credited by Microsoft with reporting CVE-2026-96951
- Yuya Chudo
- was credited by Microsoft with reporting CVE-2026-96951
- Benoit Sevens
- was credited by Microsoft with reporting CVE-2026-96951
- yhw
- was credited by Microsoft with reporting CVE-2026-96951
- James Forshaw
- was credited with discovering CVE-2026-108398
- Mike Walters
- said CVE-2026-108398 could be used after compromise without user interaction
Companies
- Microsoft
- released the patches and said one flaw was being exploited
- Fujitsu
- was credited by Microsoft with reporting CVE-2026-96951
- Anthropic
- was credited by Microsoft with reporting CVE-2026-96951
- Action1
- employed Mike Walters, who commented on the .NET flaw
Organisations
- Zero Day Initiative (ZDI)
- employed Dustin Childs and was cited for comment on the release size
- Google Project Zero
- was the affiliation of James Forshaw
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency (CISA)
- added CVE-2026-96951 to its Known Exploited Vulnerabilities catalogue
Products and systems
- Windows
- had 1,102 vulnerabilities fixed
- Office
- had 134 vulnerabilities fixed
- Developer Tools
- had 61 vulnerabilities fixed
- SharePoint Server
- had 36 vulnerabilities fixed
- SQL Server
- had 22 vulnerabilities fixed
- Windows Shell
- contained CVE-2026-96951
- .NET Framework
- contained CVE-2026-108398
- Windows Defender Application Control (WDAC)
- was the enforcement Microsoft said CVE-2026-108398 could bypass
- MessagePack-CSharp
- contained CVE-2026-92707
- Raw Image Extension
- was patched for CVE-2026-21413
How the source tells it
The article was mostly a straight patch roundup, but it used record-setting language and repeated emphasis on active exploitation to add urgency.
- record-setting hype superlative wording around the patch total and the claim that a company record had been broken
- urgency and alarm repeated focus on exploitation in the wild, public disclosure, and a near-term federal deadline