Microsoft Patches Record 1,413 Vulnerabilities in October Update

Microsoft released a record-breaking October Patch Tuesday update addressing 1,413 vulnerabilities, the highest number of fixes in a single release in the company's history. The update covers Windows, Office, .NET, and other products, surpassing the total number of vulnerabilities the company patched in any previous full year.

Among the fixes are three zero-day flaws, most notably CVE-2026-96951. This Windows Shell vulnerability, which carries a CVSS score of 8.8, allows attackers to bypass Mark of the Web protections and is already being actively exploited in the wild. The Cybersecurity and Infrastructure Security Agency has added this flaw to its Known Exploited Vulnerabilities catalog. Other critical risks include remote code execution flaws in Microsoft Outlook and Microsoft QUIC, both of which carry CVSS scores of 9.8.

To accelerate bug-hunting, Microsoft is utilizing AI-assisted tools like the MDASH scanning harness, though the company noted that validation and remediation remain significant constraints. The release coincided with the end of servicing for Windows 11 24H2 Home and Pro and the expiration of the Extended Security Update program for Windows Server 2012 and 2012 R2.

Other major vendors issued critical updates simultaneously. IBM patched its Power Systems OS to prevent remote code execution, while Atlassian reported exploitation attempts against self-hosted products including Jira and Confluence. SAP also released 16 security notes to fix high-criticality vulnerabilities in S/4HANA and NetWeaver.