Microsoft fixes a record of more than 1,400 flaws in October, including an exploited Windows zero-day
Microsoft fixed more vulnerabilities this month than in all of 2025. The actively exploited bug lets malicious files get past Mark of the Web warnings.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
Microsoft's October 2026 Patch Tuesday is its largest ever. SecurityWeek, citing Microsoft, counts 1,413 CVEs: 1,102 in Windows, 134 in Office, 61 in developer tools and 36 in SharePoint Server. BleepingComputer counts 1,411 because it includes only flaws released on Patch Tuesday itself, leaving out 348 fixed earlier in the month. Both outlets say Microsoft patched more vulnerabilities this month than in all of 2025. SecurityWeek says the surge is largely driven by AI and that Microsoft's fixes so far in 2026 now number more than 4,000. BleepingComputer counts 70 critical flaws, 57 of them allowing remote code execution. The most urgent fix is for CVE-2026-96951 (CVSS 8.8), a Windows shell flaw that is being exploited in the wild. It lets attackers get around Mark of the Web, which normally makes Defender SmartScreen and Office Protected View warn about or limit files downloaded from the internet. In practice, a specially crafted file sent by email or chat could run without any warning. BleepingComputer also reports two zero-days that were publicly disclosed but not exploited. For administrators, the sheer size of the release adds to the work of testing and rolling out patches.