Enterprise IT

Microsoft Patches Record 1,407 CVEs

By Nattapong Sukkasem · Published 2026-10-14 · Updated 2026-10-21.

The headline figure in this week’s enterprise IT news is 1,407 — the CVEs Microsoft closed on 13 October 2026, breaking the previous high of 1,261 set in 2020. Only one is confirmed under active exploitation. The more awkward number is 55: flaws the Zero Day Initiative classes as wormable, sitting almost entirely in the address-assignment, authentication-proxy and gateway services that hold a Windows estate together. For anyone running server infrastructure, that distribution matters more than the record.

What Microsoft actually shipped

Start with the caveat the trade press skipped: the vendors disagree on the total. Tenable counts 1,407, CrowdStrike 1,413, Talos 1,415 — a spread created by how each handles Mariner, Edge and re-published third-party CVEs, and worth knowing before you quote one enterprise IT news roundup into a change record. Fortra’s Tyler Reguly put it bluntly: “I’ve argued that numbers are meaningless. This month’s number, 1,413, is no different.” He is right about the headline and wrong about the workload — whichever count you take, this is four to five times a normal month.

The one flaw already being used

CVE-2026-96951 is a Windows Shell security feature bypass rated CVSS 8.8, confirmed exploited in the wild. It defeats Mark of the Web — the tag Windows applies to files from the internet, which is what triggers Protected View in Office and the SmartScreen prompt elsewhere. Strip it and a downloaded document opens as though a colleague had handed it over on a USB stick.

It needs user interaction, which is exactly why it works. Tenable’s Satnam Narang notes this is the third Windows Shell flaw exploited this year, after CVE-2026-21510 (linked to APT28) and CVE-2026-32202, which repaired an incomplete fix for the first. Twenty-six Windows Shell CVEs have been patched in 2026 — “a staggering figure compared to previous years.” Risk-led prioritisation puts it above the other 1,406.

Wormable flaws in the network plumbing

Dustin Childs of the Zero Day Initiative counted 55 wormable CVEs and warned of “an unprecedented risk of autonomous, network-wide propagation.” The clustering is the story: six in DHCP Server, four in Network Policy Server, three in Remote Desktop Gateway — unauthenticated, pre-interaction services that answer anything on the segment by design.

The worst, CVE-2026-96934, is a use-after-free in Windows DHCP Server at CVSS 9.8. Four more DHCP Server bugs sit at 8.1 (CVE-2026-88117, -88119, -88120 and the double-free -88171), plus a client-side race condition at 8.8 in CVE-2026-70250. A DHCP server answers broadcast from every unauthenticated port in its domain: no gateway in front of it, no MFA, and in most estates no segmentation between the office VLAN and the server that answers it.

Alongside them: two QUIC remote code execution bugs at 9.8 (CVE-2026-100219, CVE-2026-105016) in the transport now carrying much of your HTTP/3 and DNS over HTTPS traffic; Remote Desktop Gateway at 8.1 (CVE-2026-70187); Network Device Enrollment Service at 8.1 (CVE-2026-69802); and AD DS remote code execution at 8.1 (CVE-2026-70229), flagged “exploitation more likely”. Treat the cluster as one change, not nine.

Where DNS security fits

Tenable’s affected-product breakdown files 52 of this month’s CVEs under the DNS Server role. That is not 52 resolver bugs; it reflects shared Windows Server components tagged against every installed role. The practical reading is narrower: a domain controller running AD DS, DHCP and the DNS Server role carries three of this month’s worst clusters — usually on one box.

That shapes the maintenance window. Reboot that host and name resolution stops for everything behind it, so have a tested secondary in the resolver list. As with the root KSK rollover, resolution failures surface as application failures, and nobody blames DNS first. A DNS record lookup against each delegated name before and after the window is the cheapest regression test available.

Windows Server 2012 is now permanently unpatched

Extended security updates for Windows Server 2012 and 2012 R2 ended on 13 October 2026. Any 2012-era host still answering DHCP, RADIUS or RDP carries this month’s wormable set permanently. Windows Server 2022 moved into extended support in the same release, with updates to 14 October 2031 — the one piece of enterprise IT news here that helps a refresh business case.

A workable order of operations

1. CVE-2026-96951 first, everywhere. The only flaw under active attack, and it reaches every workstation. Endpoint rings before server rings.
2. Then the wormable cluster. DHCP Server, Network Policy Server, Remote Desktop Gateway, AD DS and NDES as one coordinated change — patching four of five leaves the path open.
3. Exchange and SharePoint next. CVE-2026-70571 and CVE-2026-102866 are internet-reachable by design.
4. Audit what still runs on 2012. Isolate anything that cannot move, and firewall it off from the user VLAN this week, not next quarter.
5. Baseline resolver health first. Capture DNS server performance and network latency figures before the window, so a post-patch complaint is measured rather than argued about.
6. Re-check egress paths after. QUIC fixes can change how DoH behaves through inspection proxies — verify, don’t assume.

Industry impact

A 1,400-CVE release is not a sign that Windows got worse in thirty days. It reflects variant hunting at scale: fuzzing harnesses and code-analysis tooling finding families of near-identical bugs, each assigned its own CVE. Five use-after-frees in one DHCP code path is one defect wearing five identifiers.

The consequence for IT security teams is that severity counts no longer sort the queue. A release this size defeats CVE-by-CVE triage; sort by service exposure instead — what answers unauthenticated traffic, what sits in the authentication path, what cannot be rebooted without taking name resolution with it. The same applies to cloud security baselines, where image rebuilds quietly carry unpatched roles forward.

Two cautions. The exploited flaw needs a user to open a file, so attachment handling still matters. And “wormable” is ZDI’s assessment of theoretical propagation, not evidence of a worm: no exploitation of the DHCP or NPS flaws has been reported. Treat the 55 as a window to close, not a fire already burning — that is the difference between a controlled change and an unplanned outage that looks, from the help desk, exactly like a DDoS attack on your own network.

The durable lesson in this piece of enterprise IT news is familiar and unflattering: the services most likely to be exploited are the ones nobody owns. DHCP, NPS and the DNS Server role rarely have a named engineer, a test plan or a rollback procedure. They answer first, they answer everyone, and this month they carry 13 wormable flaws between them.

Sources

• Tenable — Microsoft’s October 2026 Patch Tuesday addresses 1,407 CVEs (CVE-2026-96951)
• Cisco Talos — Microsoft Patch Tuesday for October 2026: Snort rules and prominent vulnerabilities
• CrowdStrike — October 2026 Patch Tuesday: updates and analysis
• CSO Online — October Patch Tuesday roundup: over 1,400 Microsoft holes, including three zero-days
• Help Net Security — Microsoft fixes exploited Mark of the Web bypass (CVE-2026-96951)

Related articles

• FortiMail Zero-Day Exploited, No Patch
• PeopleSoft WAF Bypass Exploited
• Chrome V8 Zero-Day CVE-2026-85046 Exploited: Update Now

Independent editorial analysis published by DNS Benchmark Pro / Genext Information Systems. The Microsoft Building 92 photograph is by Coolcaesar, via Wikimedia Commons, licensed CC BY-SA 4.0; the Redmond campus aerial photograph is by Atomic Taco, via Wikimedia Commons, licensed CC BY-SA 2.0; the network cabling photograph is by Wonderlane, via Wikimedia Commons, released under CC0; the Microsoft logo is a public-domain file via Wikimedia Commons. The benchmark screenshots are original captures of the DNS Benchmark Pro engine. No images on this page are AI-generated. DNS Benchmark Pro is not affiliated with Microsoft, Tenable, CrowdStrike, Cisco Talos or the Zero Day Initiative.

DNS angle

Review resolver logs for the systems discussed above and compare unexpected names with your approved services. A successful lookup does not establish that a destination is safe. Use the DNS lookup tool to inspect current answers, then compare them with your own resolver and incident records.

Source: Tenable — Microsoft’s October 2026 Patch Tuesday addresses 1,407 CVEs (CVE-2026-96951) (2026-10-13).