Microsoft patches more than 1,400 security flaws in record October update

One zero-day already exploited in the wild among the fixes; Windows 10 support extended to 2027

By LineZotpaper

Published14 October 2026

Read Time3 min

Microsoft has issued security updates fixing more than 1,400 vulnerabilities across Windows and other software, the largest patch batch on record and roughly ten times the company's normal monthly load. The October release includes one zero-day already exploited in the wild and at least 78 flaws rated critical.

Microsoft today released updates addressing more than 1,400 security vulnerabilities in Windows and other software, according to security news service Krebs on Security. The October batch dwarfs September's record of nearly 1,000 fixes, which was already about ten times the usual monthly patch load from the company.

Only one of the weaknesses patched this week is considered a zero-day, meaning it was already exploited in the wild. CVE-2026-96951 is a security feature bypass in the Windows Shell that affects Windows 10 and 11 systems, as well as some Server versions. A second flaw, a security feature bypass in the .NET Framework (CVE-2026-108398), was publicly disclosed before Tuesday, which could give attackers advance time to develop exploits, though Microsoft said there are no signs it is being used yet.

At least 78 of the fixes are rated critical, meaning they could be exploited with little or no action by the user, and most of those critical bugs allow an attacker to execute code of their choice on the affected system.

Windows 10 users will continue receiving updates for longer than originally planned. Microsoft had been scheduled to stop shipping updates for Windows 10 in October 2025, but added another year of free updates after considerable pushback, and later quietly extended that support to October 2027.

Satnam Narang at Tenable said the volume far surpasses the previous record year of 2020, when Microsoft patched 1,261 CVEs. "We've now crossed the 4,000 CVE mark with two months left to go," he said.

Microsoft credits large language models for the high volume of bug discovery. Security experts warn that the unusually large patch volleys are placing extra strain on corporate security teams, which often must test individual updates before deploying them across a network to ensure they do not break other software.

Tyler Reguly, associate director of security research and development at Fortra, noted that just 26 Microsoft vulnerabilities have appeared in CISA's Known Exploited Vulnerabilities catalog so far this year, and said teams should prioritise those first. "Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act," he said.

Analysis

Why This Matters

Record patch volumes mean corporate security teams face a growing backlog of fixes that must be tested before deployment, stretching already limited capacity.
One vulnerability is already being exploited in the wild, and another was publicly disclosed early, giving attackers a head start.
The surge reflects a shift in how bugs are found, with Microsoft crediting AI for higher detection rates, changing the threat landscape for defenders.

Background

Microsoft ships a set of security updates each month, known as Patch Tuesday. The normal monthly load is roughly one hundred fixes, so the recent jump to nearly a thousand in September and now more than 1,400 in October is an order-of-magnitude increase. Microsoft has attributed the higher rate of discovery to large language models. Windows 10, which was due to lose free support in October 2025, has had updates extended to October 2027 after user pushback.

Key Perspectives

Corporate security teams: Experts such as Fortra's Tyler Reguly say the sheer volume of patches is straining teams, and organisations should prioritise the 26 Microsoft flaws listed in CISA's Known Exploited Vulnerabilities catalog rather than trying to patch everything at once.

Microsoft: The company credits large language models for the high volume of bug discovery, presenting the record numbers as evidence of improved detection.

Security researchers: Vendors including Tenable and Cisco Talos are documenting the record volumes and highlighting the most noteworthy flaws, with Tenable noting Microsoft has now crossed 4,000 CVEs patched for the year with two months remaining.

What to Watch

Whether patch volumes stay at record levels in November and December, and how high the 2026 CVE total climbs.
Whether the zero-day CVE-2026-96951 and the publicly disclosed .NET flaw see wider exploitation in coming weeks.
The status of Windows 10 after October 2027, when the extended free update period is currently set to end.

Sources

Microsoft Patches More Than 1,400 Security Flaws — Krebs on Security