October Patch Tuesday: 1,408 CVEs, 1 exploited flaw and a SharePoint surprise

Microsoft’s October 2026 Patch Tuesday is the year’s largest release, with 1,408 CVEs requiring customer action, 72 of them rated critical. September, the previous high, carried 963. One CVE is already exploited: CVE-2026-96951 , a Windows Shell flaw that bypasses Mark of the Web.