Photo credits
Microsoft Patches Record Number of Flaws in October Update
Microsoft released a record-breaking security update for October Patch Tuesday that fixes over 1,400 vulnerabilities.
14 Oct 2026 0 reads Compiled with AI
#Microsoft #Windows #Patch Tuesday
Microsoft released security updates for October Patch Tuesday that fix a record number of flaws. SecurityWeek reported 1,413 vulnerabilities, while CSO Online listed 1,407 CVEs to be plugged. This volume surpasses the previous record set in 2020, which had 1,261 fixes.
One flaw is already being used by attackers in the wild and must be dealt with immediately. It is tracked as CVE-2026-96951 and bypasses a Windows security feature called Mark of the Web. This allows malicious files to run without triggering standard warnings about internet downloads.
Reports disagree on how many zero-day vulnerabilities were included in this update. SecurityWeek and Krebs on Security identified one exploited zero-day, while CSO Online stated that three zero-days were patched. Experts note that at least 26 Microsoft vulnerabilities have appeared in the CISA Known Exploited Vulnerabilities catalog so far this year.
Photo credits
Security experts believe artificial intelligence contributed to the high number of discoveries. Microsoft credits large language models with driving bug discovery and some patch fixes. AI is said to shorten the time between a vulnerability existing and someone noticing it.
Several high-severity flaws affect core Windows components like the Shell and Application Control. CVE-2026-108398 allows attackers to bypass Windows Defender Application Control enforcement. Other critical bugs include remote code execution risks in Message Queuing and Printer Drivers with scores near the maximum of 9.8.
Microsoft introduced a new feature called risk cohorts to help users prioritize updates. This groups vulnerabilities that require similar assessment steps for organizations. Experts advise teams to focus on exploiting risks first rather than just the total number of flaws.
Other software vendors also released security notes alongside Microsoft this week. IBM warned of a critical bug in its Power Systems operating systems rated 9.9 in severity. Adobe updated ColdFusion and Commerce with several critical fixes that have not yet been confirmed as exploited.