Microsoft October 2026 Patch Tuesday Fixes Record 1,411 Flaws and Three Zero-Days
According to a recent report by BleepingComputer, Microsoft addressed a staggering 1,411 security vulnerabilities during its October Patch Tuesday rollout on October 13. This massive deployment targets Windows 10, Windows 11, and various other system products. Consequently, the release shatters the company’s all-time record for a single Patch Tuesday event. Furthermore, this figure excludes an additional 348 flaws that engineers resolved earlier this month.
Year-Over-Year Vulnerability Trends
Historical patch data reveals a dramatic surge in resolved vulnerabilities throughout 2026 compared to the previous year. Specifically, the monthly breakdown of Microsoft CVE counts illustrates this upward trajectory:
- January: 159 in 2025 vs. 112 in 2026 (-29.6%)
- February: 63 in 2025 vs. 59 in 2026 (-6.3%)
- March: 57 in 2025 vs. 83 in 2026 (+45.6%)
- April: 126 in 2025 vs. 165 in 2026 (+31.0%)
- May: 78 in 2025 vs. 137 in 2026 (+75.6%)
- June: 66 in 2025 vs. 206 in 2026 (+212.1%)
- July: 130 in 2025 vs. 622 in 2026 (+378.5%)
- August: 111 in 2025 vs. 421 in 2026 (+279.3%)
- September: 86 in 2025 vs. 974 in 2026 (+1,032.6%)
- October: 172 in 2025 vs. 1,141 in 2026 (+563.37%)
- January to September Total: 1,048 in 2025 vs. 3,920 in 2026 (+274.05%)
Breakdown of Vulnerability Categories
The October 2026 Patch Tuesday rollout addresses a diverse array of security weaknesses across the ecosystem. Specifically, the resolved flaws fall into the following primary categories:
- Elevation of Privilege: 677 vulnerabilities
- Remote Code Execution: 317 vulnerabilities
- Information Disclosure: 254 vulnerabilities
- Denial of Service: 73 vulnerabilities
- Security Feature Bypass: 40 vulnerabilities
- Spoofing: 28 vulnerabilities
Notably, this monthly update remedies 70 flaws rated as “Critical.” Among these critical bugs, 57 enable remote code execution, 11 allow privilege escalation, and 2 involve spoofing. Meanwhile, the remaining patches address various elevation of privilege, information disclosure, denial of service, and security feature bypass issues.
Three Zero-Day Flaws Addressed
Crucially, Microsoft patched three zero-day vulnerabilities in this release. The most urgent flaw is CVE-2026-96951, a Windows Shell security feature bypass vulnerability that threat actors are actively exploiting in the wild. Attackers can leverage this weakness to bypass the Mark of the Web (MotW) security mechanism. However, Microsoft has not yet disclosed the specific exploitation details or the identity of the reporting researchers.
Additionally, two other zero-day flaws were publicly disclosed prior to the patch release. First, CVE-2026-108398 impacts the .NET Framework, allowing attackers to bypass Windows Defender Application Control and execute unauthorized applications. Second, CVE-2026-92707 affects MessagePack-CSharp and enables malicious actors to launch denial-of-service attacks.
Introducing Experimental Risk Groups
Alongside the security patches, Microsoft introduced a new “Risk Groups” mechanism. This system clusters related vulnerabilities into unified risk categories to help enterprise administrators prioritize remediation efforts. For October, the company published 15 distinct risk groups. Notably, the cluster covering Windows file systems, storage, and backup encompasses 136 individual vulnerabilities.
Nevertheless, Microsoft emphasized that risk groups serve strictly as a prioritization reference rather than a direct measure of flaw severity. Actual organizational risk still depends on active exploitation, severity ratings, and specific software deployments. Currently, this classification mechanism remains an experimental feature.
