Record Number of Microsoft Vulnerabilities Exposed in October Patch Tuesday
On October Patch Tuesday, Microsoft disclosed a staggering 1,407 Common Vulnerabilities and Exposures (CVEs) to address, setting a new record that surpasses the previous high of 1,261 from 2020. The sheer volume of these entries delayed their release, frustrating system administrators who rely on timely updates.
Among the vulnerabilities, three are classified as zero-day flaws, with one being actively exploited. The most pressing zero-day is CVE-2026-96951, which bypasses the Mark of the Web protections in Windows Shell, posing a significant risk that necessitates immediate remediation.
This vulnerability is part of a troubling trend, with three Windows Shell flaws exploited this year. Industry expert Satnam Narang from Tenable highlights that the year-to-date count of patched Windows Shell vulnerabilities has soared to 26, a striking increase compared to the mere seven patched from 2022 to 2025 cumulatively.
Another notable zero-day vulnerability was found in SharePoint, identified as CVE-2026-102866. This flaw allows unauthenticated users to exploit cryptographic token validation issues, potentially hijacking user accounts. The third zero-day, CVE-2026-108398, relates to a vulnerability in .Net framework that can circumvent Windows Defender Application Control controls, inviting unauthorized applications to run.
Significant Implications for GitLab Users
Additionally, organizations utilizing self-managed instances of GitLab are advised to address a critical vulnerability that could let unauthenticated users execute arbitrary code via a crafted regular expression in a CI/CD configuration file. GitLab has confirmed that its hosted instances have already been secured. Gene Moody, Action1's Field CTO, emphasized the urgency, characterizing this flaw as a potential risk to the software supply chain that requires immediate attention.
Severe Vulnerabilities Across Multiple Platforms
IBM also issued a warning regarding a critical vulnerability, CVE-2026-96119, affecting its IBM i operating systems, which could allow remote attackers to execute arbitrary code due to improper data sanitization in its administration GUI. With a CVSS score of 9.9, IBM strongly advises immediate patching.
Atlassian, facing its own security concerns, reported exploitation attempts targeting eight self-hosted products including Jira and Confluence via CVE-2026-21589. An unauthenticated attacker could read sensitive internal files using knowledge of specific file paths, warranting immediate updates and log reviews for organizations that use these products.
Microsoft's Updates and Risk Cohorts
Within Microsoft's updates, four critical fixes for on-premises Exchange Server were highlighted, each tied to vulnerabilities carrying a high CVSS score of 8.8. Nicholas Carroll, from Nightwing, suggests that Exchange admins prioritize these updates, as history shows these vulnerabilities are often quickly targeted by attackers.
Another point of interest is Microsoft's introduction of new risk cohort classifications to help IT and security teams better prioritize vulnerabilities, focusing efforts where they are most needed.
Understanding the Volume of Vulnerabilities
Of the vulnerabilities released, 55 are categorized as wormable. These vulnerabilities affect critical infrastructure components such as DHCP Server and Remote Desktop Gateway, which presents an "unprecedented risk of autonomous, network-wide propagation," indicates Dustin Childs from TrendAI’s Zero Day initiative.
Childs remarks that with hundreds of CVEs released in a single patch cycle now becoming commonplace, organizations might need to rethink how they approach vulnerability management. Instead of focusing solely on the volume of vulnerabilities, there should be a shift toward prioritizing based on actual exploitability.
Several critical vulnerabilities still stand out and warrant urgent attention. Notably, the Windows Message Queuing code execution flaw and others within the Microsoft ecosystem, all rated with high CVSS scores of 9.8, allow remote attackers to execute code without requiring user interaction.
As security professionals sift through this long list of vulnerabilities, it’s imperative they focus on the most critical threats that exhibit known exploit capabilities while not overlooking emerging threats within the growing volume of disclosures.
Additional Security Notes from SAP and Adobe
SAP released 16 security notes in October, highlighting a particularly dangerous OAuth2 server-side request forgery vulnerability, rated a 10 in severity, that affects multi-tenant applications. Additionally, multiple critical vulnerabilities were disclosed by Adobe across its products, including ColdFusion and Commerce, prompting immediate action due to their high severity ratings.
As the frequency of vulnerabilities persists, it remains essential for organizations to stay vigilant. Prioritizing security patching and fostering a proactive understanding of the vulnerabilities affecting their systems are critical steps to maintain a secure operational environment.
