Cut-paper illustration of a sysadmin kneeling beside a tall stack of blue software-update panels, a few flagged with red warning tags, next to a server rack

Three days ago I wrote that October had shipped exactly one CVE. The quiet month was supposed to be the dangerous one, and the takeaway was to watch it.

The quiet month lasted one day.

On October 13, Microsoft dropped a Patch Tuesday that fixed 1,413 CVEs. That is a record, and it is more than the company patched in all of 2025. The year's total is now past 4,000. One of those flaws was already being exploited in the wild before the patch existed.

You cannot patch 1,400 things at once, and nobody should try. Triage is the skill. Here is the five-move playbook I would hand any ops tech facing a month like this, in the order it matters.

Move 1: Patch the one that is already being used against you

CVE-2026-96951 is a Windows Shell security feature bypass, CVSS 8.8. The underlying bug is command injection, and what it buys an attacker is a bypass of Mark of the Web. MOTW is the invisible Zone.Identifier tag Windows stamps on files from the internet. SmartScreen, Office Protected View, the macro block, and Smart App Control all read that tag before deciding how to handle a file. This bug delivers a file that never gets the tag, so Windows treats it as though the user created it locally. No warning dialog. No read-only view. No macro block. One flaw switches off several controls at once, which is why a single MOTW bypass is worth more than its CVSS score suggests.

Microsoft confirmed exploitation in the wild before the patch shipped. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a federal remediation deadline of October 16. It is also the third Windows Shell MOTW-bypass zero-day this year, after February's CVE-2026-21510 and April's CVE-2026-32202. These keep working because they do.

The move: emergency ring for workstations and any server that touches downloaded files. Do not wait for the normal patch window on this one.

Move 2: Patch the machines that are the keys to everything

Two more flaws in this batch carry Microsoft's "Exploitation More Likely" rating, and both sit on internet-reachable infrastructure.

CVE-2026-70229 is a remote code execution flaw in Active Directory Domain Services, CVSS 8.1. An unauthenticated attacker can send a crafted packet to the AD DS service and execute code on a domain controller, with no user interaction. Microsoft rates the attack complexity as high, so it will not work in every environment. But code execution on a domain controller is the whole game in one packet: credential material, directory objects, a pivot to anything domain-joined.

CVE-2026-70571 is a remote code execution flaw in Exchange Server, CVSS 8.1. A malicious email can trigger code execution during content conversion, with no recipient interaction beyond the message landing in the inbox.

The move: domain controllers and internet-facing Exchange go in the second ring, right behind the exploited zero-day. Patch the DCs on their normal aggressive schedule and do not let Exchange sit because "it is working fine."

Move 3: Close the ones the attackers already knew about

This month brought two more zero-days in Microsoft's sense of the word: publicly disclosed before a fix existed, though not yet confirmed exploited.

CVE-2026-108398 is a .NET Framework security feature bypass, CVSS 8.8, reported by Google Project Zero's James Forshaw. Successful exploitation bypasses Windows Defender Application Control restrictions and runs code inside a protected process. There is no workaround. The patch is the mitigation.

CVE-2026-92707 is a denial-of-service flaw in MessagePack-CSharp, exploitable remotely against .NET apps through uncontrolled memory allocation.

The move: publicly disclosed bugs go above the general pile even without confirmed exploitation, because the disclosure is a head start you do not get back.

Move 4: Then deal with the other 1,396

The remaining bulk, around 670 elevation-of-privilege flaws, about 300 more RCEs, and a pile of information disclosure issues, gets the standard treatment: staged rollout rings, test on the non-critical boxes, watch for bad patches. Exact totals vary a little by who counts what, but the order above barely changes. The 1,413 number is Microsoft's own published total; Tenable counts 1,407 and Talos 1,415 depending on methodology. Do not get lost in the arithmetic. The shape is the same: a handful of urgent flaws inside a mountain of routine ones.

Ring What goes in it Timeline
1 Exploited zero-day: CVE-2026-96951 This week, ahead of the Oct 16 KEV deadline
2 "Exploitation More Likely": CVE-2026-70229 (DCs), CVE-2026-70571 (Exchange) Next maintenance window
3 Publicly disclosed: CVE-2026-108398, CVE-2026-92707 Same window as ring 2
4 The remaining bulk Normal staged rollout

Move 5: Ask whether you were already hit

Patching CVE-2026-96951 closes the hole. It does not tell you whether anyone walked through it during the zero-day window. That was the lesson of the FortiMail follow-up last week, and it applies here too: for the exploited flaw, forensic triage comes before treating the upgrade as done.

Pull the advisory's IOCs, check EDR alerts tied to Windows Shell oddities on machines that handle downloads, and look at SmartScreen and Office Protected View logs for anything that should have warned but did not. You do not need a full incident response on every box. You need a quick hunt on the ones most likely to have seen a crafted file, and then you can sleep.

The point under the playbook

The record number is the headline, but it is not the workload. One flaw was already being exploited. Two more sat on the identity and mail infrastructure that every other system trusts. Two were public before the patch. The other 1,396 can wait their turn.

Three days ago I called October the quiet month. The correction took exactly one Patch Tuesday. The triage habit I described then is what carries you when the month stops being quiet.

Sources