The update covers 1,102 Windows flaws, 134 in Office, 61 in developer tools, 36 in SharePoint Server, and 22 in SQL Server, with over 70 rated Critical.

SecurityWeek reports Microsoft has patched more vulnerabilities this month alone than in all of 2025, pushing the 2026 total past 4,000, and shattered.io notes this is the second consecutive month to reset the yearly record.

One flaw is already under active exploitation: CVE-2026-96951 (CVSS 8.8), a command injection bug in Windows Shell that lets attackers bypass Mark of the Web (MotW) defenses.

MotW flags internet-downloaded files so SmartScreen and Office Protected View can warn users; bypassing it lets a malicious file launch without any warning dialog. Attackers must still convince a user to open a crafted file or click a link.

CISA added the bug to its Known Exploited Vulnerabilities catalog, giving federal agencies until October 16 to patch. Tenable's Satnam Narang says it is the third Windows Shell flaw exploited this year.

Two other patched flaws were publicly known before fixes existed.

CVE-2026-108398 (CVSS 8.8) is an untrusted search path bug in .NET Framework that lets an attacker register a malicious assembly loaded by a protected process, bypassing Windows Defender Application Control entirely — a post-compromise technique with no user interaction, discovered by Google Project Zero's James Forshaw.

CVE-2026-92707 is a denial-of-service flaw in MessagePack-CSharp affecting Visual Studio and .NET. shattered.io reports both zero-days left a window in which attackers could study the bugs while defenders had nothing to deploy.

ZDI's Dustin Childs puts part of the surge on AI: it "isn't creating these bugs out of thin air; it's just shortening the time between a vulnerability existing and someone noticing it."

But exploitation isn't scaling equally — CyberScoop counts 15 Microsoft zero-days exploited so far in 2026 versus 17 over the same stretch of 2023, and Tenable's Narang calculates fewer than 1% of Microsoft's 2026 patches have landed in CISA's KEV catalog, with 26 entries so far versus 32 in 2024.

His advice: triage by exploitability, not CVE count, or "burn cycles on the wrong bugs."

To help overloaded admins, Microsoft introduced "risk cohorts" this month — groups of CVEs that don't share a root cause or severity score but require a similar customer assessment for prioritization.

Microsoft stresses they are "a starting point, not a final decision," and customers should still weigh exploitation, severity, and attack vector per CVE.

The change matters because CVSS alone misleads: as shattered.io observes, the Exchange spoofing bug scored 9.3 outranks the actively exploited 8.8 Windows Shell flaw on severity, yet only the latter is confirmed under attack.

Prioritization guidance from CrowdStrike, Tenable, and CSO Online's reporting, as summarized by shattered.io, puts CVE-2026-96951 first since it is confirmed exploited and needs only a user opening a file.

Beyond that, Tenable flagged critical RCE flaws in Active Directory Domain Services (CVE-2026-70229, CVSS 8.1) and Exchange Server (CVE-2026-70571, CVSS 8.1), plus the Raw Image Extension bug CVE-2026-21413 (CVSS 9.8), which can trigger from a thumbnail preview without the file ever being opened.

Lifecycle deadlines compound the pressure: Windows Server 2012 support is ending and Windows Server 2022 is losing mainstream support.