Microsoft's October 2026 Patch Tuesday Sets a Record With 1,407 Fixes

Microsoft's October 2026 security updates landed on October 13 with the largest batch of fixes the company has ever shipped in a single month. Tenable counted 1,407 CVEs: 69 rated critical, 1,337 important and one low. CrowdStrike put the total at 1,413, with 75 critical. It is the second consecutive month to set the record, and the second in a row to hand defenders more work than a monthly cycle was built to carry.

Related reading: Microsoft's Record Patch Tuesday: 974 Flaws, Two Already Exploited · Microsoft's August Patch Tuesday Fixed About 400 Flaws, and One Real Fire.

The number that matters most is much smaller. One flaw in this release was exploited in the wild before a patch existed: CVE-2026-96951, a Windows Shell security feature bypass that carries a CVSSv3 score of 8.8. A second, CVE-2026-108398, a .NET Framework security feature bypass, was publicly disclosed before a fix was ready. Settle those two, and the rest of the list becomes a sorting exercise rather than an emergency.

What a security feature bypass does

Windows tags files that arrive from the internet with a piece of metadata called the Mark of the Web. That tag is why Outlook opens a downloaded attachment in Protected View instead of running it, and why Windows asks before executing an installer pulled from the web. The tag is a security feature, and it works by attaching a label to the file.

A bypass does not break down a wall. It strips the label that would have made Windows cautious about the file. For CVE-2026-96951, Microsoft says an attacker uses social engineering, by email or message, to convince a target to open a malicious file. Opening it slips past the Mark of the Web check, so Windows treats the file as local and trusted. The victim's click is the exploit; the bypass only matters if someone opens the file.

That is why flaws of this kind can be more dangerous than their scores suggest. A remote code execution bug can be reached by a scanner that never asks permission. A bypass waits for a person. CVE-2026-96951 is the third Windows Shell flaw exploited in the wild in 2026, after CVE-2026-21510, patched in February, and CVE-2026-32202, patched in April. Three in ten months is a rate worth tracking.

The second zero-day attacks a similar idea in a different layer. CVE-2026-108398 is a .NET Framework security feature bypass, also scored 8.8. An attacker registers a malicious .NET assembly so that a protected process will load it, which defeats Windows Defender Application Control, the mechanism that restricts which code may run. It was disclosed publicly before a patch was available, so its status differs from the shell flaw: disclosure is not the same as confirmed exploitation.

Why the count keeps climbing

The gap between Tenable's 1,407 and CrowdStrike's 1,413 is a classification gap, not a dispute about scale. Firms draw the boundary of a monthly release in different places and group related CVEs differently. Rapid7 put the Windows-only share at 1,102. The updates touched 301 products and components, which is its own measure of how wide the release runs.

The composition says more than the total. By impact, elevation-of-privilege flaws accounted for 47.9% of the patched CVEs and remote code execution for 22.3%. The products with the most CVEs were Microsoft Office Excel at 69, the DNS Server role at 52, and the Windows Kernel at 46.

Elevation-of-privilege bugs usually need an attacker to be inside the network before they can be used, which is why they usually function as a second stage once someone already has a foothold. The remote code execution flaws are the ones that open the door, and October has several that deserve attention. The Belgian CCB's advisory leads its summary with the 69 critical fixes across the release. Among them: CVE-2026-70229, a Windows Active Directory Domain Services remote code execution flaw with a CVSS score of 8.1 that Microsoft marks "Exploitation More Likely"; CVE-2026-70571, an Exchange Server remote code execution flaw at CVSS 8.1; and CVE-2026-70279, an Exchange Server spoofing flaw that scores 9.3.

The practical consequence is that a single ranked list stops being useful. A team that works top to bottom by severity will spend its week on symbolic fixes while the flawed component that is actually reachable sits untouched. Exposure-based triage asks a narrower set of questions: is the affected service internet-facing, does the organisation run the product at all, and has anyone seen the bug used in an attack. For most of the 1,407, the honest answer is that they are not reachable in a given environment. That is why the count and the workload are not the same number.

"triage by sheer CVE count instead of exploitability are burning cycles on the wrong bugs. Patch what's proven, prioritized, and public, and treat everything else as this month's new normal." — Zero Day Initiative, The October 2026 Security Update Review, October 13, 2026

Microsoft's "risk cohorts" experiment

Faced with the volume, Microsoft introduced a new label in October: risk cohorts. The company's release notes describe them as an exploratory way to help customers organize their own analysis. Microsoft also says they are not official vulnerability categories, do not change Microsoft update guidance, and do not replace the assessment of individual CVEs.

Take that framing literally. A cohort is a starting point for a defender's own triage, not a severity rating to patch against. Calling it exploratory is Microsoft's way of saying the idea is under test and the guidance underneath it has not moved. Teams that adopt the feature should treat it as one input among several, and they should not assume it has replaced the exploitability ratings Microsoft has assigned for years.

A lifecycle deadline on the same day

Not everything that happened on October 13 was about vulnerabilities. The same date marked the end of the final year of Extended Security Updates for Windows Server 2012 and 2012 R2, the end of mainstream support for Windows Server 2022, and the end of support for Office 2021 and several other products.

For anyone still running Windows Server 2012 or 2012 R2, the consequence is direct. Those systems have been kept alive on extended security updates, and the last of those years has now closed. Future Patch Tuesdays will not include fixes for them, so each month adds exposure without adding a remedy. Windows Server 2022 and Office 2021 sit at a different point: mainstream support ending changes the kind of support they get, and their security servicing continues on its own schedule. The overlap is easy to miss on a day dominated by a four-digit CVE count, and it has the longer tail.

The operational reality

Microsoft's release notes remain the starting point, but a release this size pushes the real sorting onto independent analysis. Tenable, CrowdStrike, the Zero Day Initiative and national bodies such as Belgium's CCB all publish their own takes within a day, and each highlights a slightly different shortlist. For a small security team, the overlap is where the useful signal sits: when several trackers name the same handful of flaws, those are the ones to schedule first.

The scale also carries a cost that never shows up in a CVE total. Every product with a fix is another component to test and another chance that a change breaks something unrelated. Enterprises generally cannot install and move on; they test and stage updates before rollout. A month that touches 301 products and components strains that pipeline, however well it is run.

Caveats

Quote any figure for October with its counting method attached. Tenable counts 1,407, CrowdStrike 1,413, and Rapid7 reports the Windows-only share at 1,102. The spread reflects different classification choices, not disagreement about whether the release is large. All three worked from Microsoft's own notes.

Two more limits apply. Not every flaw in the batch can be reached remotely, and the elevation-of-privilege group, close to half the release, generally needs an existing foothold first. And the two zero-days are not interchangeable risks. One was exploited in the wild; the other was public before a patch existed. Assigning both the same urgency overstates one of them.

What to watch

Three things will decide whether October is remembered as an outlier or as the new floor.

Whether exploitation follows the count. Only one flaw this month is a confirmed in-the-wild case, and a second is publicly known. If more of the 1,407 turn up in attacks, the argument for patching faster gets much harder to answer.

Whether risk cohorts survive contact with defenders. Microsoft has been clear that the feature is exploratory and changes nothing in its guidance. Adoption over the next few releases will show whether the idea helps teams sort a monthly flood or just adds another label to interpret.

Whether the record holds. This is the second consecutive month at a new high. If November tops it again, the pressure on patch windows, testing pipelines, and lifecycle planning will keep building, and the question of what a sane monthly cadence looks like will get louder.

For most people the instruction is still simple: let Windows Update run, and restart when it asks. For the teams that cannot do that, October's real work is a short list. Patch the shell bypass first, weigh the Exchange and Active Directory flaws against your exposure, and put the rest on a schedule you can defend.

Cover image: "Building92microsoft.jpg" by Coolcaesar, CC BY-SA 4.0, via Wikimedia Commons.