Microsoft's October Patch Load Hits 1,400 Flaws, Smashing Its Own Record

Microsoft released fixes today for more than 1,400 security vulnerabilities across Windows and its broader software lineup, according to Krebs on Security. That's not a typo, and it's not even close to a typical month. September's patch batch set a record at nearly 1,000 fixes, itself roughly ten times Microsoft's usual monthly volume. October blew past that.

Only one of the flaws fixed this time around is a confirmed zero-day, meaning it's already being exploited before a patch existed. CVE-2026-96951 is a security feature bypass in the Windows Shell, hitting Windows 10, Windows 11, and some Server versions. Given how central the Shell is to how Windows presents files, apps, and the desktop itself, a bypass there is the kind of thing attackers can build real mischief around.

Windows 10 users following along might be wondering whether they're even supposed to be getting these updates anymore. Microsoft had originally planned to cut off Windows 10 security support in October 2025, then reversed course after pushback from users and IT departments who weren't ready to move on. A few months ago, Microsoft quietly tacked on another year, pushing the cutoff to October 2027. So for now, Windows 10 machines remain part of the patch cycle.

A pile of critical bugs

At least 78 of this month's vulnerabilities are rated "critical," Microsoft's top severity tier. Critical generally means an attacker needs little or no interaction from the victim to pull off an attack, and most of these specific bugs let an attacker run arbitrary code on the affected machine, essentially handing over control.

There's also a wrinkle worth flagging separately: CVE-2026-108398, a security feature bypass in the .NET Framework, was publicly disclosed before today's patch came out. Microsoft says it hasn't seen evidence of active exploitation, but public disclosure ahead of a fix gives attackers a head start on reverse-engineering how to abuse it, assuming they haven't already figured it out.

Satnam Narang, a researcher at security firm Tenable, put this month's total in historical context: it blows past the previous high-water mark from 2020, when Microsoft patched 1,261 CVEs for the entire year. This single month tops that. "We've now crossed the 4,000 CVE mark with two months left to go," Narang said, referring to Microsoft's cumulative vulnerability count for 2026 so far.

Why the numbers keep climbing

Microsoft attributes the explosion in reported bugs to large language models, which the company credits with discovering far more vulnerabilities than human researchers typically catch on their own. It's a reasonable bet that AI tools are also involved on the fix side, helping generate some of the patches needed to close all these holes, though Krebs notes that's an inference rather than something Microsoft stated outright.

Whatever the cause, the effect on the people who actually have to deploy these patches is real. Security teams inside companies don't just click "install." They test updates before rolling them out network-wide, because a bad patch can break other software just as easily as a missing one can let in an attacker. When the patch count triples or quadruples in a given month, that testing burden triples or quadruples right along with it, and security experts have been sounding the alarm about the strain this is putting on already-stretched IT departments.

That's where the question of triage comes in. Not every one of the 1,400-plus flaws fixed this month carries the same real-world risk, and treating them all as equally urgent is a losing strategy for teams with limited time and staff.

Tyler Reguly, associate director of security research and development at Fortra, offers a sharper filter: of all the Microsoft vulnerabilities disclosed this year, only 26 have shown up on the Known Exploited Vulnerabilities catalog that the Cybersecurity and Infrastructure Security Agency maintains. That list tracks bugs attackers are actually using in the wild, as opposed to ones that are merely theoretically dangerous. Reguly's advice is to start there.

"Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act," he said.

For organizations trying to figure out which of this month's fixes actually deserve immediate attention, Krebs points to two resources: Cisco Talos has published a breakdown of the more notable vulnerabilities in this release, and the SANS Internet Storm Center maintains an index that sorts the full list by severity, CVE number, and which software each flaw affects.

The broader pattern is clear even if the exact cause isn't fully settled. Microsoft's patch releases have gone from a predictable monthly rhythm to something closer to a flood, and whether that's a temporary spike tied to new AI-assisted bug hunting or the new normal, security teams are going to need better ways to decide what to fix first. The raw count of vulnerabilities patched is no longer the number that matters most. Which of them attackers are actually using is.