Microsoft's October Patch Tuesday fixes a record 1,400+ flaws

Microsoft released its October 2026 security updates on October 13, fixing more than 1,400 vulnerabilities. That is a record for a single Patch Tuesday, the monthly day Microsoft ships its fixes. One Windows Shell flaw, tracked as CVE-2026-96951, is already being used in attacks. For developers, the list also includes critical bugs in PowerShell, OpenSSH for Windows and Visual Studio Code.

How many flaws, exactly

The trackers that count each release do not agree on the total. The gap comes from how each one draws the line around the release.

Source	Count	Note
BleepingComputer	1,411	Leaves out 348 flaws fixed earlier in October
CrowdStrike	1,413	75 rated Critical
Tenable	1,413	Counts Microsoft's own products; 1,102 in Windows
Zero Day Initiative	1,415	Calls it the first four-digit month

BleepingComputer counts 70 Critical flaws. By type, both it and CrowdStrike list 677 elevation of privilege bugs, which let an attacker gain more rights on a machine. They also list 317 remote code execution bugs, which let an attacker run their own code.

Why so many? BleepingComputer says Microsoft keeps using AI platforms to find and fix vulnerabilities. Dustin Childs of the Zero Day Initiative says AI is speeding up bug discovery for defenders and attackers alike. "Another month of patches equals another new record for Microsoft patches," he wrote.

Microsoft also sorted the flaws into 15 "risk cohorts." It says the groups do not show which flaws are most dangerous.

The flaw attackers are already using

CVE-2026-96951 is a security feature bypass in Windows Shell. It defeats Mark of the Web, the tag Windows adds to files downloaded from the internet. That tag is what triggers warnings before a downloaded file opens.

Microsoft describes the bug as command injection, and it confirms the flaw is being exploited. The Zero Day Initiative and CrowdStrike rate it 8.8 out of 10. None of the reports says who is using it.

Tenable notes that Windows Server 2012 R2 gets a fix, but Windows Server 2012 does not.

Two flaws made public before the fix

Two other bugs were publicly disclosed before Microsoft shipped a patch:

• CVE-2026-108398, .NET Framework, rated 8.8. It lets an attacker who is already logged in get around App Control for Windows, which limits what code may run. Microsoft says the attacker plants a crafted .NET assembly and registers it to load in a protected process.
• CVE-2026-92707, MessagePack-CSharp, rated 5.3. This is a denial-of-service bug in a third-party library that packs data into a compact binary format. A third party released it, and Microsoft included it in its update.

Critical bugs developers should note

Several critical flaws sit in tools developers run every day:

Flaw	Component	Severity score
CVE-2026-83578	PowerShell, remote code execution	9.8
CVE-2026-97816	OpenSSH for Windows, remote code execution	9.8
CVE-2026-102238	Visual Studio Code, remote code execution	9.6
CVE-2026-100219, CVE-2026-105016	QUIC network protocol, remote code execution	9.8
CVE-2026-70571	Exchange Server, remote code execution	8.1

The Zero Day Initiative calls the Exchange bug wormable, meaning it could spread from machine to machine without help. Microsoft's own rating, cited by Tenable, is "Exploitation More Likely." Tenable also flags five Outlook bugs that can be triggered through the preview pane.

Versions that stop getting updates

This release is the last one for some older software, according to BleepingComputer and Tenable:

• Windows 11 24H2 Home and Pro reach the end of servicing. We covered the move to 26H2 earlier this month.
• Windows 10 Enterprise LTSB 2016 gets its final update.
• Windows Server 2012 and 2012 R2 end year three of paid Extended Security Updates on October 14, per Tenable.
• Office 2021 retires on October 14, and Exchange Server 2016 and 2019 move to "no ESU" status from October 15.

What this means for developers

• Patch developer machines first. PowerShell, OpenSSH and VS Code all have critical fixes. Build servers and laptops that run them are high-value targets.
• Update MessagePack-CSharp. Check your NuGet dependencies for MessagePack, and move to the fixed release named in the advisory.
• Be careful with downloaded files until patched. The exploited flaw switches off the warning that normally protects you from them.
• Move off Windows 11 24H2 Home and Pro. Those editions get no more fixes after this month.
• Plan for bigger patch months. Tenable's Adam Barnett expects volumes to keep rising. Automate how you sort and test updates rather than reviewing each one by hand.