Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities , including one that it said has come under active exploitation.
Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.
Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities , including one that it said has come under active exploitation.
Patch what's proven, prioritized, and public, and treat everything else as this month's new normal." Microsoft, which credited Fujitsu's Riku Bamba and Yuya Chudo, as well as Anthropic's Benoit Sevens and a researcher named yhw for reporting CVE-2026-96951, said the vulnerability has been exploited in the wild.
The actively exploited zero-day vulnerabilities addressed during this October 2026 Patch Tuesday are: Microsoft patched an actively exploited zero-day security bypass flaw that allowed attackers to bypass the Mark of the Web security feature.
Microsoft is publishing 1,413 own-product vulnerabilities on October 2026 Patch Tuesday , including 1,102 vulnerabilities in Windows.
CVE-2026-108398 has been acknowledged as publicly known at the time of the release of the patches, with Microsoft stating the security flaw could be exploited to bypass Windows Defender Application Control (WDAC) enforcement and run unauthorized applications on target systems.
Other vendors who released updates or advisories in October 2026 include: With this month's record-breaking number of vulnerabilities, Microsoft has also introduced a new method for organizations to prioritize security updates by grouping related flaws into what it calls "risk cohorts." The new approach groups similar vulnerabilities together to help organizations better understand which security flaws pose the greatest risk to their systems and should be prioritized for patching.
Patches have also been released for a non-Microsoft CVE ( CVE-2026-21413 , CVSS score: 9.8), a heap-based buffer overflow impacting Raw Image Extension that could result in remote code execution.
Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring federal agencies to apply the fixes by October 16, 2026.
This is a record-breaking Microsoft Patch Tuesday as Microsoft continues to use artificial intelligence platforms to find and remediate security vulnerabilities in its products.
What happened
Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.
Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities , including one that it said has come under active exploitation.
What changed
Patch what's proven, prioritized, and public, and treat everything else as this month's new normal." Microsoft, which credited Fujitsu's Riku Bamba and Yuya Chudo, as well as Anthropic's Benoit Sevens and a researcher named yhw for reporting CVE-2026-96951, said the vulnerability has been exploited in the wild.
The actively exploited zero-day vulnerabilities addressed during this October 2026 Patch Tuesday are: Microsoft patched an actively exploited zero-day security bypass flaw that allowed attackers to bypass the Mark of the Web security feature.
Who is affected
Microsoft is publishing 1,413 own-product vulnerabilities on October 2026 Patch Tuesday , including 1,102 vulnerabilities in Windows.
CVE-2026-108398 has been acknowledged as publicly known at the time of the release of the patches, with Microsoft stating the security flaw could be exploited to bypass Windows Defender Application Control (WDAC) enforcement and run unauthorized applications on target systems.
Why it matters
Other vendors who released updates or advisories in October 2026 include: With this month's record-breaking number of vulnerabilities, Microsoft has also introduced a new method for organizations to prioritize security updates by grouping related flaws into what it calls "risk cohorts." The new approach groups similar vulnerabilities together to help organizations better understand which security flaws pose the greatest risk to their systems and should be prioritized for patching.
Patches have also been released for a non-Microsoft CVE ( CVE-2026-21413 , CVSS score: 9.8), a heap-based buffer overflow impacting Raw Image Extension that could result in remote code execution.
Technical details
Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring federal agencies to apply the fixes by October 16, 2026.
This is a record-breaking Microsoft Patch Tuesday as Microsoft continues to use artificial intelligence platforms to find and remediate security vulnerabilities in its products.
It's accelerating bug-hunting on both sides of the fence, so vendors are finding (and fixing) more flaws, and researchers are finding them faster too." "But AI isn't creating these bugs out of thin air; it's just shortening the time between a vulnerability existing and someone noticing it.
Response
In September 2026, Microsoft did not appear to publish any desktop browser security advisories between the start of the month and Patch Tuesday.
Microsoft credits large language models for the high volume of bug discovery, and presumably AI gets credit for many of the patches used to fix these flaw.
What security teams should do
Meanwhile, security experts have been warning that these unusually large patch volleys from Microsoft are placing extra strain on corporate security teams, which often have to test individual updates before deploying them across a network to ensure the fixes don’t cause problems for other software.
Anyone who enjoyed last month’s record-setting Patch Tuesday will love the October 2026 edition, because it’s much bigger still.
Attribution
The Hacker News: Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities , including one that it said has come under active exploitation.
KrebsOnSecurity: Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software.
Rapid7: Rapid7 Intelligence tracks adversaries, shares proprietary, curated intelligence and research, and builds trusted open-source communities—all to help you improve your security program.
BleepingComputer: Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.