As we progress further into the AI-driven "vulnpocalypse era," Microsoft’s October 2026 Patch Tuesday security update blows past last month’s record for the number of vulnerabilities addressed, disclosing 1,413 Microsoft CVEs.
Among these are 80 critical flaws and two zero-day bugs, one under active exploitation. In comparison, September's update included 974 CVEs, which seemed staggering enough.
And yet, security experts are urging teams to ignore the size of the update, and instead focus in on exploitable risk, and getting processes, tools, and people into place to be able to reduce that risk.
"Recently, I've argued that numbers are meaningless," said Tyler Reguly, associate director for security R&D at Fortra, in public emailed comments. "This month's number, 1,413, is no different. There are, however, numbers that hold meaning. Twenty-six, for example, is how many 2026 Microsoft CVEs have shown up in the CISA Known Exploited Vulnerabilities catalog. Last year, that number was 30, and the year before was 32. That means less than 1% of vulnerabilities patched by Microsoft this year are known to be exploited."
Inside October's Bountiful Patch Tuesday Update
In terms of what's lurking inside this month's bumper crop of bugs, Windows harvested the lion's share of the security flaws listed — accounting for 1,102 of them, to be exact. That's followed by 134 for Office, 61 in Developer Tools (Dev Div), 36 for SharePoint Server, 22 for SQL Server, seven for Exchange Server, 15 in Azure, and four in Defender. Thirty-two are found in various "other" categories.
Microsoft also republished a Cisco Talos bug, CVE-2026-21413, which is listed as a raw image extension remote code execution (RCE) vulnerability.
Both of the zero-days are potentially scary security bypasses. CVE-2026-96951 (CVSS 8.8) is the one under active exploit, found in Windows Shell. The other is CVE-2026-108398, found in .NET Framework Security.