Record Patch Tuesday: Microsoft fixes 1,413 security flaws in one release
October's updates fix about 45% more vulnerabilities than the previous record. One of them is already being exploited by attackers.
Symbolic image · Photo: KK IN HK / Wikimedia Commons, Public domain (cropped and resized)
Microsoft fixed 1,413 security vulnerabilities in its monthly Patch Tuesday release on Oct. 13, a new record. The previous high was September, with 974 flaws, making the new total about 45% larger. Windows accounted for 1,102 fixes, Office for 134 and developer tools for 61. For comparison, Microsoft fixed 914 vulnerabilities in all of 2023. More than 70 of the new flaws are rated critical.
According to the Zero Day Initiative, only one flaw is currently being actively exploited: CVE-2026-96951 in Windows Shell. It lets attackers bypass Mark of the Web, a protection that warns users about files downloaded from the internet. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its catalog of known exploited vulnerabilities and ordered federal agencies to patch it by Oct. 16.
Microsoft attributes the high count to modern AI tools it uses to find bugs and develop fixes. Dustin Childs of the Zero Day Initiative said AI is speeding up discovery for attackers and defenders alike. “Hundreds of CVEs in a single release used to be the exception; now it's the baseline,” he said. To help administrators, Microsoft is introducing so-called risk cohorts, groups of flaws that require a similar assessment.