Microsoft patches a record 1,400+ security flaws in October 2026

Microsoft's October 2026 Patch Tuesday release fixes more than 1,400 security vulnerabilities, according to Krebs on Security. The Hacker News puts the count at 1,413, including 1,102 flaws in Windows, and reports that the batch contains one vulnerability already under active exploitation. The release dwarfs Microsoft's previous monthly records and is far above its usual patch load.

What's happening

Krebs on Security reports that Microsoft issued updates fixing more than 1,400 vulnerabilities in Windows and other software, and notes that this "epic patch batch" dwarfs September's record of nearly 1,000 fixes, which was itself about ten times the normal monthly load. The Hacker News reports a total of 1,413 flaws, of which 1,102 are in Windows.

Just one of the patched weaknesses is considered a zero-day, meaning it is already exploited in the wild. That is CVE-2026-96951, a security feature bypass in the Windows Shell that affects Windows 10 and Windows 11 systems as well as some Server versions, according to Krebs. At least 78 of the flaws fixed this month are rated "critical," meaning they could be exploited with little or no action by the user, and most allow an attacker to run code of their choice. A separate security feature bypass in the .NET Framework, CVE-2026-108398, was publicly disclosed before the release, which Krebs says could give attackers advance time to work out an exploit, although Microsoft says it has no signs of exploitation yet.

Microsoft credits large language models for the high volume of bug discovery, and experts quoted by Krebs warn that these unusually large patch volleys are placing extra strain on corporate security teams, which often have to test updates before deploying them broadly.

Who's affected

The updates cover Windows 10, Windows 11, and some Windows Server versions, along with other Microsoft software patched this month, so the affected population is broad: organisations and individuals running current and recent Windows releases. Administrators responsible for testing and rolling out patches are the group most directly affected by the sheer volume.

Windows 10 users may wonder whether they still get updates. Krebs notes that Microsoft had been set to stop shipping them in October 2025 but, after pushback, quietly extended its free extra-security-updates programme for another year, so free users can now stay on Windows 10 until October 2027. Tenable's Satnam Narang told Krebs the monthly total far surpasses the previous record year, 2020, when Microsoft patched 1,261 CVEs, and that the industry has "now crossed the 4,000 CVE mark with two months left."

What to do

Install Microsoft's October 2026 updates through Windows Update (or your usual enterprise deployment channel) as soon as your testing allows.
Prioritise the actively exploited zero-day, CVE-2026-96951, and the vulnerabilities on CISA's Known Exploited Vulnerabilities catalog; Fortra's Tyler Reguly told Krebs that only 26 Microsoft vulnerabilities have appeared in that catalog so far this year and that these should be patched first.
Test before wide deployment, since experts warn that this volume can overwhelm security teams and that a faulty patch could disrupt other software.
Use vendor roundups to find the flaws that matter most; Krebs points to a Cisco Talos roundup and the SANS Internet Storm Center's severity-indexed list.
If you are still on Windows 10, note that free security updates have been extended to October 2027, so those systems remain covered for now.

Sources

Krebs on Security — reports the more than 1,400 fixes, the CVE-2026-96951 zero-day, the number of critical flaws, and expert commentary.
The Hacker News — reports Microsoft's record 1,413 flaws, including 1,102 in Windows.
Microsoft Security Response Center — the advisory for CVE-2026-96951, the actively exploited Windows Shell security feature bypass.