微软单月修复1413个漏洞创纪录：含一个已被利用的Windows零日漏洞，CISA要求联邦机构10月16日前处置
据SecurityWeek报道，微软在10月14日的「补丁星期二」更新中修复了1413个安全漏洞，创单月纪录。其中1102个涉及Windows、134个涉及Office、61个涉及开发工具、36个涉及SharePoint Server，70多个被评为「关键」等级。微软表示，今年以来修复的漏洞总数已超过4000个。
最受关注的是编号CVE-2026-96951的Windows Shell安全功能绕过漏洞，CVSS评分8.8分，已被确认在真实攻击中利用。该漏洞可绕过「网络标记」（Mark of the Web）防护：这一机制会给从互联网下载的文件打上标记，触发系统警告与Office受保护视图；绕过之后，恶意文件可能在不触发警告的情况下运行。微软称，攻击者须诱使用户打开特制文件，无法强迫用户查看其控制的内容。该漏洞由富士通、Anthropic研究人员及一名独立专家分别报告。美国CISA已将其列入「已知被利用漏洞」目录，要求联邦机构在10月16日前完成处置。
本月另有两个漏洞在修复前已被公开披露：CVE-2026-108398可绕过Windows Defender应用程序控制、让未授权代码在受保护进程中运行，由谷歌Project Zero研究员詹姆斯·福肖发现；CVE-2026-92707是MessagePack-CSharp中的拒绝服务漏洞。不同机构统计口径略有差异，本文采用微软公布的1413个。
资料来源：SecurityWeek、TechRepublic 2026年10月14日报道；微软安全公告与CISA目录。
Microsoft Fixes a Record 1,413 Flaws in One Month, Including an Exploited Windows Zero-Day; CISA Gives Federal Agencies an October 16 Deadline
Microsoft's October Patch Tuesday release on October 14 fixed 1,413 security vulnerabilities, a single-month record, according to SecurityWeek. Of those, 1,102 affect Windows, 134 affect Office, 61 affect developer tools and 36 affect SharePoint Server, with more than 70 rated Critical. Microsoft says it has now patched more than 4,000 flaws so far in 2026, a surge it attributes in large part to SI-assisted vulnerability discovery.
The most urgent item is CVE-2026-96951, a Windows Shell security-feature bypass with a CVSS score of 8.8 that Microsoft confirms has been exploited in the wild. The flaw evades Mark of the Web protections — the mechanism that tags files downloaded from the internet so that Defender SmartScreen warnings and Office Protected View apply; once bypassed, a malicious file may run without triggering those warnings. Microsoft says an attacker must persuade a user to open a specially crafted file or otherwise interact, and cannot force a user to view attacker-controlled content. The flaw was reported independently by researchers at Fujitsu and Anthropic and by an independent expert. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities catalog and directed federal agencies to address it by October 16.
Two other flaws were publicly disclosed before fixes shipped: CVE-2026-108398, which can bypass Windows Defender Application Control and let unauthorized code run inside a protected process, discovered by James Forshaw of Google Project Zero; and CVE-2026-92707, a denial-of-service flaw in MessagePack-CSharp. Tallies vary slightly by counting method — some researchers counted 1,411 flaws — and this report uses Microsoft's figure of 1,413.
Sources: SecurityWeek reporting, October 14, 2026; TechRepublic reporting, October 14, 2026; Microsoft security advisories and the CISA Known Exploited Vulnerabilities catalog.
发布：GSM·美国（发布链接）
图片来源：微软位于华盛顿州雷德蒙德市总部的92号楼（资料图）。图片来源：Wikimedia Commons，Coolcaesar 摄，CC BY-SA 4.0 授权
GSM Global · 本篇英文版 English edition of this story
