Microsoft's October update fixes more than 1,400 security flaws

Microsoft has released its October security updates, fixing well over 1,400 vulnerabilities across Windows and other products — reportedly the largest single batch the company has ever shipped. The update includes at least one flaw that has already been exploited in the wild.

What's happening

Krebs on Security reports that Microsoft issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. That dwarfs September's record of nearly 1,000 fixes, which was itself roughly ten times the normal monthly load. The Hacker News puts the figure at a record 1,413 flaws, and the actual count varies slightly depending on what is included.

According to Krebs on Security, just one of the flaws patched this month is considered a "zero day" already exploited in the wild: CVE-2026-96951, a security-feature bypass in the Windows Shell that affects Windows 10 and Windows 11 systems as well as some Server versions. ZDNet, citing patch-management provider Action1, describes the same flaw and separately notes a publicly disclosed (but not yet exploited) .NET Framework issue, CVE-2026-108398.

Several outlets highlight how unusual the volume is. Krebs on Security cites Tenable's Satnam Narang saying the total surpasses the previous record set in 2020 (1,261 CVEs), and that "we've now crossed the 4,000 CVE mark with two months left to go". Microsoft credits large language models for the high volume of bug discovery, Krebs notes, while security experts warn the huge patch volumes place extra strain on corporate teams that must test updates before rolling them out.

For prioritisation, Krebs on Security quotes Fortra's Tyler Reguly noting that only 26 Microsoft vulnerabilities have appeared in CISA's Known Exploited Vulnerabilities catalog so far this year, and that security teams would do well to patch those 26 first. ZDNet adds that the October update is also the first official one for Windows 11 version 26H2 and the last for Windows 11 24H2 Home and Pro editions, and that it resolves issues in File Explorer and Bluetooth and lets users remap the Copilot keyboard key.

Who's affected

Windows 10 and Windows 11 users and administrators, plus some Windows Server versions, given the zero-day in the Windows Shell.
Organisations with managed fleets, which must test and deploy an unusually large batch of updates.
Windows 11 24H2 Home and Pro users in particular, for whom this is described as the final supported update, and Windows 11 23H2 Enterprise/Education, which reaches end of support in November.
Windows 10 users on the Extended Security Updates programme, who reportedly still receive these patches.

What to do

Install the update. In Windows, open Settings → Windows Update and check for updates; the update may already be downloaded and waiting for a restart.
Prioritise what is actually exploited. Patch the known-exploited list first rather than trying to triage all 1,400 at once.
On Windows 11 24H2 Home/Pro, plan an upgrade to the latest feature version, since support for 24H2 is ending.
Watch vendor roundups for the most notable flaws, and treat the situation as evolving as more analysis appears.

Sources

Krebs on Security — reports the 1,400+ total, the Windows Shell zero-day, the critical-count and the advice to prioritise CISA's known-exploited list.
ZDNet — covers the affected Windows versions, the File Explorer and Bluetooth fixes, and the end-of-support milestones.
The Hacker News — puts the record batch at 1,413 flaws.