Microsoft’s October Patch Tuesday release addresses a record-breaking 1,413 vulnerabilities, including an actively exploited Windows Shell zero-day and two other publicly disclosed flaws.

Just when you thought a previous record would stand for a while, Microsoft comes out again with the largest monthly Patch Tuesday release. Microsoft has said its growing use of AI to find and fix security vulnerabilities means users should expect more fixes in its monthly updates.

How to apply patches and check if you’re protected

These updates fix security problems and help keep your Windows PC protected. Here’s how to make sure you’re up to date:

• Click the Start button, then open Settings.
• Select Windows Update (usually at the bottom of the menu on the left).
• Click Check for updates. Windows will search for the latest security updates. If you’ve enabled Get the latest updates as soon as they’re available under More options, you may be prompted to restart immediately to complete the update.
  
• Otherwise, continue to the next step.
• If updates are available, they’ll start downloading automatically. When they’re ready, click Install or Restart now if prompted. Your computer may need a restart to finish the update.
• After restarting, go back to Windows Update and check again. If it says You’re up to date, you’re all set.

Technical details

As usual, we’ve selected a few vulnerabilities to highlight for readers interested in the technical details.

We’ll start with the actively exploited vulnerability tracked as CVE-2026-96951 (CVSS score 8.8 out of 10), a Windows Shell security feature bypass vulnerability.

The security feature it can bypass is the Mark of the Web (MOTW) defense, which can warn users about potentially unsafe downloaded files.

Successful exploitation requires user interaction. For example, in an email or instant message attack, the attacker could send the targeted user a specially crafted file designed to exploit the vulnerability, but the user would have to click a link or open an attachment.

Another one to keep an eye on is CVE-2026-108398 (CVSS score 8.8 out of 10), where an untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally. The bypassed feature is Windows Defender Application Control (WDAC), which could lead to the ability to run unauthorized applications on target systems. This vulnerability was publicly disclosed before the patch.

Another publicly disclosed vulnerability is CVE-2026-92707 (CVSS score 5.3 out of 10). The flaw can let an unauthenticated remote attacker exhaust memory in affected applications that process specially crafted MessagePack data. MessagePack-CSharp is a software component that helps applications pack and unpack data in a compact format, making it efficient to store or exchange information. Exposure depends on how a service uses the library to pack and unpack the information.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch batch dwarfs September’s record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond.

Just one of the weaknesses patched this week is considered a “zero day,” or already exploited in the wild. CVE-2026-96951 is a security feature bypass in the Windows Shell that affects Windows 10 and 11 systems, as well as some Server versions.

Windows 10 users might be wondering if they can still expect security updates after this month. Microsoft had been slated to stop shipping updates for Windows 10 systems in October 2025, but ended up adding another year of free updates after considerable pushback. A few months ago, Microsoft quietly extended that support for another year (until October 2027).

At least 78 of the flaws fixed this month are rated “critical,” meaning they could be exploited with little or no action by the user, and most of those critical bugs allow an attacker to execute code of their choice on the vulnerable system.

While Microsoft said there are no signs anyone is exploiting it yet, a security feature bypass in the .NET Framework (CVE-2026-108398) was publicly disclosed prior to today, potentially giving attackers advance time to work out how to exploit the bug.

Satnam Narang at Tenable said the number of flaws fixed this month far surpasses the previous record-setting year 2020, when Microsoft patched 1,261 CVEs.

“We’ve now crossed the 4,000 CVE mark with two months left to go,” he said.

Microsoft credits large language models for the high volume of bug discovery, and presumably AI gets credit for many of the patches used to fix these flaw. Meanwhile, security experts have been warning that these unusually large patch volleys from Microsoft are placing extra strain on corporate security teams, which often have to test individual updates before deploying them across a network to ensure the fixes don’t cause problems for other software.

Tyler Reguly, associate director of security research and development at Fortra, notes that just 26 Microsoft vulnerabilities appeared in the “Known Exploited Vulnerabilities” (KEV) catalog maintained by the U.S. Cybersecurity & Infrastructure Security Agency (CISA) so far this year, and security teams would do well to prioritize patching those 26 vulnerabilities first.

“Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act,” Reguly said.

Which vulnerabilities deserve the most scrutiny in your organization? The folks at Cisco Talos have a useful roundup of the more noteworthy flaws that Microsoft fixed today, and of course the SANS Internet Storm Center has a reliable roundup that indexes vulnerabilities by severity, CVE number and affected software.