Microsoft Patch Tuesday October 2026: Record 1,400+ CVEs

On October 13, 2026, Microsoft released the largest Patch Tuesday on record: more than 1,400 vulnerabilities fixed across Windows and other products, according to Krebs on Security. It beat September's record release by a wide margin. Krebs reports that Microsoft credits large language models for the high volume of bug discovery.

1,407CVEs, per Tenable's October count

78+Rated critical, per Krebs

1Zero-day exploited in the wild

4,000+Microsoft CVEs so far in 2026, per Tenable

Microsoft

Microsoft published the October 2026 security updates.

What was patched in October 2026

The exact total depends on who is counting. Tenable reports 1,407 CVEs, Rapid7 counts 1,413 own-product vulnerabilities, and BleepingComputer reports 1,411 released on the day itself, excluding 348 more fixed earlier in the month. Critical counts also differ: Krebs says at least 78, Tenable lists 69 critical, and BleepingComputer lists 70. Differences like these usually come from whether a tracker counts third-party CVEs, flaws patched before Patch Tuesday, or only a given severity label.

Tenable's breakdown across 301 products puts elevation of privilege at 47.9% of the fixes and remote code execution at 22.3%. BleepingComputer's approximate category tally shows 677 elevation of privilege and 317 remote code execution flaws.

Building 92 at Microsoft's Redmond headquarters with the Microsoft sign in the foreground — Building 92 at Microsoft's headquarters in Redmond, Washington, photographed in 2016. A file photo, not an image of the October 2026 release. Image: Coolcaesar, Wikimedia Commons, CC BY-SA 4.0.

Zero-days and notable flaws

Krebs identifies one actively exploited zero-day, CVE-2026-96951, a security feature bypass in Windows Shell affecting Windows 10 and 11 and some Server versions. BleepingComputer says it bypasses Mark of the Web, and Tenable notes it is the third Windows Shell flaw exploited in the wild in 2026. A second flaw, CVE-2026-108398, a .NET Framework security feature bypass, was publicly disclosed but not yet seen exploited, and BleepingComputer credits its discovery to James Forshaw of Google Project Zero. BleepingComputer counts a third publicly disclosed flaw, CVE-2026-92707, a denial-of-service bug in MessagePack-CSharp.

Krebs also notes that Microsoft extended Windows 10 security updates for another year, through October 2027.

Patch Tuesday volume, month by month

The October total follows a steep climb. The chart uses The Hacker News tallies for May through September and Tenable's figure for October. Other trackers differ: Rapid7 gave 421 for August against 457 above, so read the shape of the trend rather than any single bar.

Microsoft Patch Tuesday CVEs per month, May to October 2026

Counts rose from 161 in May to 1,407 in October. The last two bars are the two largest releases on record.

Sources: The Hacker News (May to Sept), Tenable (Oct). Trackers count differently, so totals vary by a few percent between sources.

Some arithmetic on those figures:

October's 1,407 is about 44% above September's 974 (1,407 divided by 974 is roughly 1.44).
It is about 3.1 times August's 457 and almost nine times May's 161.
Krebs describes September's release as about ten times Microsoft's normal monthly load.
Microsoft's previous annual high was 1,261 CVEs in 2020, per Tenable's Satnam Narang as quoted by Krebs. With more than 4,000 CVEs so far in 2026 and two months left, the year is already more than three times that.

We've now crossed the 4,000 CVE mark with two months left to go.
Satnam Narang, Tenable, via Krebs on Security

Why AI-assisted discovery is cited

Krebs reports that Microsoft credits large language models for the surge. BleepingComputer similarly says Microsoft continues to use AI platforms to find and fix vulnerabilities in its products. The Hacker News, covering September, quotes TrendAI's Zero Day Initiative saying AI-assisted vulnerability discoveries are unlikely to slow down any time soon. Rapid7's August write-up adds that there is no reason to suppose Patch Tuesday will return to the lower volumes seen before 2026.

A few points help interpret this:

More found does not mean more broken. A higher count can reflect more latent bugs being surfaced and fixed, not a sudden drop in code quality. The sources do not say how many of these flaws are new versus long-standing.
Severity still matters more than volume. Only one flaw was confirmed exploited. Fortra's Tyler Reguly told Krebs that 26 Microsoft vulnerabilities have appeared in CISA's Known Exploited Vulnerabilities catalog this year, a small share of the 4,000-plus total.
Triage is the bottleneck. Microsoft published 15 risk cohorts to help group the flaws, per BleepingComputer, with the largest being filesystems, storage and backup (136), Office and mail clients (135), and graphics, media and content processing (131). Microsoft says the groups do not indicate which flaws are most dangerous.

What this means for patching teams

Defenders face the same constraint every month: the number of fixes grows, while testing and rollout capacity does not. Prioritising by exploitation status, exposure and the KEV catalog is more tractable than patching to a count. The same AI tooling that finds bugs is also available to automate triage and summarisation, and teams that keep that work model-agnostic, as platforms like Metir allow, can swap in newer models as they appear.

Sources:

Image credits

Header image: aerial view of Microsoft's West Campus in Redmond, Washington, taken in August 2009, by Jelson25, Wikimedia Commons, public domain (source); a file photo, not an image of the October 2026 release. In-body image: Building 92 at Microsoft's Redmond headquarters by Coolcaesar, Wikimedia Commons, CC BY-SA 4.0 (source).