October 2026 Patch Tuesday Sets a New Microsoft Record With 1,411 Fixes
The October 2026 Patch Tuesday has become a new record for Microsoft. BleepingComputer counted 1,411 fixed vulnerabilities. Of these, 70 received a critical rating. The previous record, 966 issues in September, lasted only a month.
The Numbers Behind the Record
Most of the flaws fall into three groups: elevation of privilege, remote code execution, and information disclosure. The release includes 677 elevation of privilege bugs, 317 remote code execution bugs, and 254 information disclosure bugs. It also covers 73 denial of service flaws, 40 security bypasses, and 28 spoofing issues.
Microsoft fixed another 348 vulnerabilities earlier in October. The company left those out of the Patch Tuesday total.
The Biggest Risk: CVE-2026-96951
The main danger is CVE-2026-96951, which scores 8.8 on CVSS 3.1. This Windows Shell flaw lets attackers bypass Mark of the Web. That feature warns the system about files from untrusted sources. Microsoft confirmed attacks in the wild. In response, CISA added the bug to its Known Exploited Vulnerabilities (KEV) catalog.
Other Notable Vulnerabilities
CVE-2026-108398 in .NET Framework
Another publicly disclosed flaw, CVE-2026-108398, also scores 8.8 on CVSS 3.1. It affects .NET Framework. An authorized local user can plant a specially crafted .NET assembly. A protected process then loads it. A successful attack bypasses Windows Defender Application Control and runs code without any user action.
CVE-2026-92707 in MessagePack-CSharp
CVE-2026-92707 scores 5.3 on CVSS 3.1 and affects MessagePack-CSharp. A remote, unauthenticated attacker can cause a denial of service through uncontrolled memory allocation. BleepingComputer treats it as a publicly disclosed zero-day. However, different counts of the October release disagree on the number of CVEs and critical flaws.
A Prioritization Problem for Administrators
Microsoft faced more than a record volume of patches. It also faced the challenge of ranking them. The company sorted the October CVEs into 15 experimental risk groups. The largest cover file systems and storage, Office, graphics and media components, the Windows kernel, and installation and update services.
This approach does not replace reviewing each CVE. Still, it cuts repetitive work for administrators.
Why the Numbers Differ
Microsoft earlier linked the growth in fixes partly to more active bug hunting with artificial intelligence. The size of this release supports that trend, although counting methods vary. For example, Tenable counted 1,407 CVEs and 69 critical issues. That gap does not change the release’s status as the largest Patch Tuesday in history.
End of Support for Two Windows Editions
October 13 was also the last day of regular support for Windows 11 24H2 Home and Pro. The same goes for Windows 10 Enterprise LTSB 2016. The October packages are their final monthly security updates.
For supported systems, Microsoft advises installing the latest fixes as quickly as possible. Administrators should patch the already exploited and most dangerous vulnerabilities first.
