The First Four-Digit Patch Tuesday. Only One Flaw is Under Attack.

Microsoft crossed 1,400 CVEs in a single release and credits AI-assisted discovery for the volume, and only one of them is being exploited. Meanwhile, every edge appliance vendor in your rack shipped an emergency fix, and an actor breaking Ivanti gateways appears to be using AI to write the exploits.

1. Summary counts - 1,418 Microsoft CVEs, 77 critical, one exploited zero-day, 36 confirmed exploited across all vendors.
2. Vulnerability type distribution - Elevation of privilege is 48% of the release; 317 remote code execution flaws.
3. What actually matters - Five findings, starting with the one Microsoft flaw that has working exploit code.
4. Mitigation guidance - Five Microsoft fixes that need a patch and a remediation plan, with hunting steps.
5. Third-party releases - Ivanti, Citrix, Check Point, F5, Adobe, SAP, Chrome, Firefox and Apple.
6. Priority matrix - Every CVE needs a decision, banded P1 to P4 by exposure rather than CVSS.
7. The 72-hour plan - Includes hunting, inventory, release health, and privilege review.
8. What's next - Oracle's quarterly CPU on the 20th; November Patch Tuesday on the 10th.

1,418 CVEs Microsoft authored

1. Of 1,418 CVEs, exploit code exists for three of them, and Microsoft tells you which. The CVRF temporal vector rates CVE-2026-96951 (Windows Shell, Mark-of-the-Web bypass, CVSS 8.8) as Functional: working exploit code, actively used. Two more sit at Proof-of-Concept: CVE-2026-70049 (Configuration Manager) and CVE-2026-96204 (Azure Arc). The other 1,415 are rated Unproven. Almost nobody reports this field. CISA deadline for the Shell flaw: 16 October.
2. The real fire is at the edge, and none of it is in a Patch Tuesday feed. Ivanti Connect Secure CVE-2026-104935 entered KEV the same day Microsoft shipped, with a 16 October deadline. Citrix NetScaler contributed three exploited CVEs in eight days across two separate waves. Check Point and F5 BIG-IP APM each shipped exploited pre-auth flaws. If you read only the Microsoft release this month, you missed all of it.
3. The Ivanti chain is only half-closed. Volexity documented a three-flaw chain: an auth bypass and a file-write race, both covered by the CVE, plus a privilege-escalation bug in the dsinvoked broker that has no CVE and no patch, with Ivanti saying a fix is coming "in the coming weeks." The targeted appliance was fully patched at the time of compromise.
4. AI is now on both sides of the same cycle. Microsoft credits large language models for the discovery volume behind its record release. In the same week, Volexity assessed with medium confidence that UTA0576 is using LLMs for exploit development and post-exploitation against Ivanti. Firefox 158 shipped 77 CVEs the same day, which is far above Mozilla's norm.
5. Volume is not risk, and the ratio is now absurd. Fortra's Tyler Reguly notes only 26 Microsoft CVEs have entered CISA KEV all year. Against 4,000+ Microsoft CVEs published in 2026 to date, that is well under one percent. Pick the exploited ones and the reachable ones; the rest is a backlog, not an emergency.

For each: what an attacker actually does with it, what to look for in your own estate, and what to do beyond deploying the update.

CVE-2026-96951 - EXPLOITED

Windows Shell | Security Feature Bypass

A MOTW (Mark-of-the-Web) bypass. MOTW is the tag Windows attaches to files that arrived from the internet, and it is what makes Office open them in Protected View and SmartScreen warn before they run. This flaw strips that signal, so a downloaded file behaves like one the user created locally. It is the third Windows Shell flaw exploited in the wild in 2026, and the only Microsoft CVE this month under active attack.

How attackers exploit this

• Deliver a crafted file by email or chat. The vector requires user interaction, so this arrives through social engineering, not a listening service.
• The file opens without Protected View or a SmartScreen prompt, because the MOTW tag never applies.
• Whatever the payload is (macro, script, loader) runs with the warning that normally stops it removed.

What to look out for

• Office documents and archives opening without Protected View when they came from outside, and the absence of a prompt is the signal.
• Files written by browsers or mail clients that lack the Zone. Identifier alternate data stream.
• Windows 10, Windows 11 and some Server builds are all affected; this is not a server-tier-only patch.

Mitigation guidance

• This one goes to user endpoints first, not the server estate, which is the opposite of the usual order, because delivery is by email and the target is a person.
• Do not rely on MOTW-dependent controls until it is deployed. Protected View, SmartScreen and macro-blocking-from-the-internet all key off the same tag this bug defeats.
• Attachment filtering and user warnings reduce delivery; only the patch restores the tag.
• Ignore the EPSS of 0.015. The model has no history for a week-old CVE and systematically under-scores confirmed zero-days.

CVE-2026-83869 - CRITICAL

Windows DNS Server | Remote Code Execution

Unauthenticated remote code execution with no user interaction. The reason this outranks most of the 86-strong unauthenticated RCE set: in most Windows estates DNS Server runs on domain controllers, so code execution in the DNS service is code execution on a DC.

How attackers exploit this

• Send a crafted packet to any reachable Windows DNS server — no credentials, nothing clicked.
• Execute in the DNS service context, which on a co-resident DC is a direct path to domain compromise.

What to look out for

• DNS servers sharing a host with Active Directory — inventory this before you schedule the window, not during it.
• Any Windows DNS reachable from user VLANs, remote-access ranges or the internet.
• DNS service crashes or restarts with no corresponding change.

Mitigation guidance

• Patch DNS servers that also run Active Directory first, and move the window up if your normal cadence is slower than a week.
• Restrict which networks can reach DNS during the rollout. Network controls reduce exposure; only the patch removes the bug.
• Include internal DNS in the same verification pass as public-facing. Internal-only is not a mitigation when the foothold is a phished laptop.

Internet Information Services | Remote Code Execution

Unauthenticated RCE in IIS. Of the 86 CVEs matching the unauthenticated-network-RCE shape this month, this is the one most likely to be directly internet-reachable by design. IIS exists to serve traffic from outside.

How attackers exploit this

• Send crafted requests to an IIS endpoint; no authentication step is involved.
• Execute in the worker process context, then pivot using whatever that application pool identity can reach.

What to look out for

• IIS instances outside your normal server patch rings. Appliance-embedded and vendor-installed IIS are routinely missed.
• Application pool identities running as anything more privileged than they need.
• Unexpected child processes from w3wp.exe.

Mitigation guidance

• Patch internet-facing IIS alongside the P1 band, ahead of the rest of the server estate.
• Enumerate by external scan rather than by asset inventory. Inventory tells you what you think you run; a scan tells you what answers.
• Review application pool identities while you are in there. It caps the damage of the next one of these, which there will be.

CVE-2026-70571 - CRITICAL

Microsoft Exchange Server | Remote Code Execution

Remote code execution triggered through Exchange's internal content conversion when it processes a malicious message. No one has to open or preview anything - the server handling the mail is enough. Exchange also shipped CVE-2026-70279, a CVSS 9.3 spoofing flaw, in the same cycle.

How attackers exploit this

• Send a crafted message to any mailbox on the server.
• Code executes during content conversion, before a human is involved.

What to look out for

• On-premises and hybrid Exchange — hybrid deployments are routinely left out of patch scope because they feel like cloud.
• Unexpected child processes from Exchange transport components.
• Transport queue anomalies around unusual attachment types.

Mitigation guidance

• Patch on-premises Exchange in the same window as the P1 items. Exchange has the worst track record of any Microsoft product for rapid weaponisation.
• Confirm the update applied to every server in the DAG — a partially patched DAG is an unpatched DAG.
• Apply the spoofing fix at the same time; splitting Exchange patching across two windows doubles the exposure for no operational gain.

CVE-2026-108398 - DISCLOSED

.NET Framework | Security Feature Bypass

A Windows Defender Application Control bypass. An authenticated attacker loads a malicious .NET assembly into a protected process and WDAC does not stop it. Disclosed publicly before the patch by James Forshaw of Google Project Zero, which means the technique is documented and in circulation even though no exploitation is confirmed.

How attackers exploit this

• From an authenticated context, load a crafted .NET assembly into a process WDAC is supposed to protect.
• Execute code that your application-control policy was specifically deployed to prevent.

What to look out for

• Where WDAC is doing real work in your environment — this is only as serious as your reliance on it.
• .NET assembly loads into protected processes that do not match your allow-list expectations.

Mitigation guidance

• Prioritise by how much you lean on WDAC, not by the CVSS. For an estate where application control is the primary execution defence, this is a high-priority patch; where it is not deployed, it is noise.
• Publicly disclosed before patch means the clock started before you did — treat it ahead of equally scored undisclosed flaws.
• Do not treat application control as compensating for unpatched code while this is outstanding; the two defences overlap here.

Thirty-five of the thirty-six CVEs confirmed exploited in this window came from outside Microsoft. Four separate edge-appliance vendors shipped fixes for flaws already under attack.

Four bands, hardest first. The band is set by exposure and exploitation, not by CVSS, which is why an 8.6 leads and a 10.0 sits at the bottom.

Scoped to software most organizations actually run. The full dataset covers all 36 exploited CVEs and every vendor in the cycle.

Within 24 hours · 15 of 36 exploited

Confirmed exploited in the wild — observed, not predicted. Sorted newest first: the top rows are what your last cycle did not cover.

Six rows carry no CVSS: CISA does not publish scores and NVD had not enriched them at the time of this snapshot. EPSS and the KEV deadline are the ranking signals for those. The remaining 21 exploited CVEs from this window sit in niche appliances, developer tooling and the 8 October legacy batch — all 36 are searchable in the OPSWAT CVE Dashboard.

Within 72 hours · 12 of 86

Windows, unauthenticated, network-reachable, no user interaction, CVSS 9.8. Nothing has to be clicked for these to change your exposure. Server-role components first.

Within 7 days · 8 CVEs

Critical and reachable, but each needs a precondition — a credential, a delivered message, an authenticated session. The two Proof-of-Concept rows belong here on exploit maturity alone.