Microsoft's biggest-ever Patch Tuesday reportedly fixes around 1,413 flaws

Microsoft's October security release fixes a record number of vulnerabilities — more than 1,400 across Windows and its other products — according to reports. One flaw, a security bypass in the Windows Shell, has reportedly already been exploited in the wild, making it the one to patch first.

What's happening

The Hacker News describes the release as a record batch of 1,413 flaws, while Krebs on Security reports "more than 1,400 security vulnerabilities". Either way, this month's total dwarfs September's record of nearly 1,000 fixes, which was already around ten times the normal monthly haul.

According to Krebs on Security, only one of the patched flaws is a "zero day" — that is, already being exploited. It is CVE-2026-96951, a security-feature bypass in the Windows Shell affecting Windows 10 and Windows 11 systems as well as some Server versions. Krebs notes that at least 78 of the flaws fixed this month are rated "critical", and that a .NET Framework issue (CVE-2026-108398) was publicly disclosed before today, potentially giving attackers advance time to work out an exploit, though Microsoft reportedly said it has no signs of exploitation.

The scale reflects an unusual pattern the industry is still adjusting to. Krebs on Security cites Tenable's Satnam Narang saying the total beats the previous record from 2020 (1,261 CVEs) and that "we've now crossed the 4,000 CVE mark with two months left to go". Microsoft attributes the surge in bug discovery to large language models; security experts warn the volume strains corporate teams that must test updates before deployment.

For triage, Krebs on Security quotes Fortra's Tyler Reguly, who points out that just 26 Microsoft vulnerabilities have appeared in CISA's Known Exploited Vulnerabilities catalog this year, and advises teams to patch those 26 first. Details may shift as independent analyses are published, and Microsoft's own advisory is the authoritative source for each CVE.

Who's affected

Windows 10 and Windows 11 users, plus some Windows Server deployments, for the Windows Shell zero-day and the critical flaws.
IT and security teams that now have to plan, test and roll out an exceptionally large update.
Organisations on older Windows 11 feature versions, several of which are at or near the end of support and should plan upgrades.
Anyone who delays updates, since the known-exploited flaw is the most likely to be used against unpatched systems.

What to do

Update Windows via Settings → Windows Update, and restart if prompted.
Put the zero-day first. If you can only prioritise a handful of fixes, start with the exploits that appear in the CISA Known Exploited Vulnerabilities catalog.
Check your Windows version's support status and upgrade if you are on a version that has ended or is about to end support.
Read the vendor advisories for the specific CVEs that matter to your environment; this is an evolving situation as more analysis lands.

Sources

Krebs on Security — reports the 1,400+ total, the Windows Shell zero-day, the critical count and the prioritisation advice.
The Hacker News — reports the record 1,413 figure for the October batch.