Microsoft's October 2026 Patch Tuesday set a new record, with sources reporting between 1,411 and 1,417 vulnerabilities fixed. That dwarfs September's roughly 1,000 patches, which was already about ten times a normal monthly load. The bulk of the fixes target Windows, and more than 70 flaws are rated Critical.

The most urgent issue is CVE-2026-96951, an actively exploited Windows Shell command injection that lets attackers bypass Mark of the Web defenses. CISA has added it to its Known Exploited Vulnerabilities catalog, giving federal agencies until October 16 to patch. A separate .NET Framework flaw (CVE-2026-108398) was publicly disclosed before the release and can bypass Windows Defender Application Control. Sources differ on the zero-day count: BleepingComputer reports three zero-days, while The Hacker News and Krebs on Security describe one actively exploited and one publicly disclosed.

Security researchers caution against triaging by sheer CVE count. Dustin Childs of ZDI says AI is accelerating bug discovery on both sides, but teams should "patch what's proven, prioritized, and public." Tyler Reguly of Fortra notes only 26 Microsoft CVEs have appeared in CISA's KEV catalog this year and recommends focusing on those first. Microsoft also introduced "risk cohorts" to group related flaws and help organizations prioritize updates.