Record-scale Microsoft release (reporting outlets cite ~1,411–1,419 Microsoft CVEs depending on counting). Actively exploited: Windows Shell MotW bypass CVE-2026-96951 (CVSS 8.8, CISA KEV due Oct 16). Publicly disclosed before patch (not known exploited per Microsoft/SANS): .NET Framework WDAC bypass CVE-2026-108398 and MessagePack-CSharp DoS CVE-2026-92707. High-value not-known-exploited: Exchange RCE CVE-2026-70571 (8.1) and AD Domain Services RCE CVE-2026-70229 (8.1), both 'Exploitation More Likely'; Outlook RCEs (e.g. CVE-2026-70242); Message Queuing RCE CVE-2026-100202 (9.8). Severity and exploitability labels are Microsoft's.