Microsoft fixed a record 1,413 vulnerabilities in its October security update, the first Patch Tuesday to cover more than 1,000 flaws, including one Windows zero-day that attackers are already exploiting.
Microsoft fixed 1,413 vulnerabilities in its October 2026 Patch Tuesday update, a record for a single month, according to The Hacker News. Search summaries of other reports say that it is the first monthly release to cover more than 1,000 vulnerabilities, and that the total is greater than the number that Microsoft fixed in any previous full year, with one headline saying it is more than all of 2025 combined.
The Hacker News gives a breakdown by product: 1,102 flaws in Windows, 134 in Office, 61 in developer tools, 36 in SharePoint Server and 22 in SQL Server. More than 70 are rated critical, according to the report, while a search summary counts 75 critical flaws and 176 updates. By type, more than 670 are privilege escalation flaws, more than 300 are remote code execution and more than 250 are information disclosure.
One of the flaws is being exploited. CVE-2026-96951 is a command injection vulnerability in Windows Shell with a severity score of 8.8 out of 10. It lets an attacker bypass security features, specifically the protection called Mark of the Web, through specially crafted files in email or messaging scenarios, according to the report. The flaw was credited to researchers at Fujitsu, to Benoit Sevens of Anthropic and to a researcher called yhw.
Mark of the Web is the label that Windows adds to files that come from the internet, which triggers warnings before they are opened, so a bypass allows malicious files to avoid that warning. The US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalogue and ordered federal agencies to apply the patch by 16 October, according to the report.
Two other flaws were publicly disclosed before the patch. CVE-2026-108398, also rated 8.8, is a .NET Framework untrusted search path flaw that bypasses Windows Defender Application Control, credited to James Forshaw of Google Project Zero, and CVE-2026-92707, rated 5.3, is a denial-of-service flaw in a library called MessagePack-CSharp, credited to an anonymous researcher. Microsoft counts these as zero-days because the details were public before a fix was available.
The volume is the notable part. Dustin Childs of the Zero Day Initiative is quoted as saying that hundreds of CVEs in a single release used to be the exception and are now the baseline. Satnam Narang of Tenable is quoted as saying that Microsoft has patched over 4,000 CVEs so far in 2026. The sources reviewed do not explain why the numbers have risen so sharply, and do not say whether tools that find bugs automatically have contributed.
For organisations, the practical effect is the work of applying the updates. A record number of patches means more testing and more risk of problems, but the exploited flaw is the priority, since attackers are already using it. The agency’s deadline applies to federal agencies, and the report does not describe any direct advice to the public beyond applying the updates.
The scale is also a reminder that software of this size has many flaws, and that the number fixed is not the same as the number of attacks. Most of the 1,413 flaws have not been reported as exploited, according to the report, which counts one exploited zero-day.
Delima News will report if further exploitation of the Windows Shell flaw is observed.
Image: Microsoft’s Redmond campus (file photo, 2021). Photo: Atomic Taco / Wikimedia Commons (CC BY-SA 2.0)
