Microsoft's October Patch Tuesday: Over 1,400 CVEs Addressed

Microsoft has announced its largest Patch Tuesday for 2023, releasing crucial updates for 1,408 common vulnerabilities and exposures (CVEs), 72 of which are categorized as critical. This exceeds the previous record of 963 CVEs released in September.

Exploited Vulnerabilities and Pre-Releases

Among the vulnerabilities, CVE-2026-96951, a flaw in Windows Shell that bypasses the Mark of the Web protection, has already been exploited. Additionally, two CVEs were publicly disclosed prior to the update, affecting the .NET Framework and the MessagePack-CSharp library. Notably, Microsoft also reported ongoing attacks targeting a SharePoint Server vulnerability, CVE-2026-65660, which was patched in August.

Recommended Actions for Users

Microsoft’s Readiness team urges users to schedule immediate patches for Windows, Office, Exchange, and developer tools. As for SQL Server, a standard release schedule is recommended. An infographic outlining the risk of deployment by product family has been made available for better clarity.

Known Issues Affecting Windows 11

As part of the October updates, a known issue has emerged regarding Windows 11 updates, specifically KB5127648 for versions 24H2, 25H2, and 26H2, and KB5127646 for version 26H1. Non-administrative users may experience difficulties opening Remote Desktop connections to devices with Administrator protection enabled, resulting in error code 0xC000000D. This problem began following a non-security preview update in September. Microsoft suggests temporarily disabling Administrator protection as a workaround while a fix is developed.

Security Update Insights

From September 9 to October 12, Microsoft documented 111 notifications for its products in the Security Update Guide, with 90 classified as revisions rather than completely new entries. This contrasts with only one revision noted during September’s updates.

Lifecycle Updates and Enforcement Changes

On October 13, several important lifecycle milestones were reached, including the end of support for .NET 8 and .NET 9, as well as PowerShell versions 7.4 and 7.5. Microsoft also indicated that November’s updates will conclude support for Windows 11 Enterprise and Education 23H2, and IoT Enterprise 23H2 editions.

Microsoft is tightening enforcement on some updates, marking 496 entries as part of this release, with 41 deemed high risk. Notably, the areas of printing, scanning, and font rendering comprise a significant portion of these flagged entries.

Product Families Affected by the Update

• Browsers: There were no new CVEs for Microsoft Edge this month, although 414 CVEs related to Edge were documented from September to October, only five of which were unique to Edge.
• Windows: A staggering 1,122 CVEs were addressed for Windows, including 42 critical entries. The majority of these critical entries are linked to remote code execution.
• Microsoft Office: This month, 180 CVEs were identified for Office applications, with 26 critical vulnerabilities, primarily affecting Excel, Outlook, and Word.
• Exchange and SQL Server: A single critical CVE was identified for Exchange, thus it should be prioritized for immediate patching. SQL Server contained 22 entries but none were rated critical.
• Developer Tools: A total of 66 CVEs were released in this category, including two that are critical.

Third-Party Updates

On October 13, Adobe released updates addressing 175 CVEs across various products, including ColdFusion and Photoshop. However, none of these updates are considered a high priority, and there have been no reports of related exploits.

As we look back to previous years when any release exceeding 1,000 CVEs seemed distant, the trend now leans towards more extensive patches. While we may not have reached a 'patch maximum' yet, the hope remains for a smoother patching process in the future.