Microsoft Releases Record-Breaking Patch Tuesday With 1,413 Vulnerabilities, Only One Actively Exploited Zero‑Day

Microsoft released its monthly Patch Tuesday update on October 14, 2026, addressing a record‑setting 1,413 common vulnerabilities and exposures (CVEs). The number of patches in this batch surpassed the company’s previous annual record of 1,261 CVEs set in 2020, making it the largest single‑day release in the company’s history.

Only one of the newly fixed defects was an actively exploited zero‑day vulnerability. CVE‑2026‑96951, a high‑severity flaw in the Windows Shell, allows attackers to bypass a security feature and was the third Windows Shell vulnerability used in attacks this year.

The update highlighted a sharp rise in Windows Shell vulnerabilities, with 26 patched this year through October—far more than the three in 2025 and just one in each of 2024 and 2022. This trend underscores the increasing attention attackers give to that component of the operating system.

The majority of the 1,413 CVEs hit Windows, which accounted for 1,102 defects, but the patch also covered 134 Office bugs, 61 in various developer tools and 36 affecting SharePoint Server, reflecting Microsoft’s broad product footprint.

To help customers manage the deluge of patches, Microsoft introduced ‘risk cohorts’, groups of vulnerabilities that share similar assessment needs. The company says these cohorts can guide prioritization and prevent teams from spending time on low‑impact bugs.