Microsoft's October Patch Tuesday, released on October 13, 2026, is the largest in the company's history. Cisco Talos counted 1,415 vulnerabilities addressed across Microsoft products, including 85 rated critical, 67 of them remote code execution flaws. Computer Weekly noted that the total exceeds the number Microsoft fixed in all of 2023, and that it shatters the previous record of roughly 1,000 flaws set just last month, which itself had passed a mark of a little over 600 set in July. By comparison, the October 2025 release addressed about 175 flaws. Exact totals vary between trackers, depending on how third-party vulnerabilities are counted.
The most urgent fix is CVE-2026-96951, a Windows Shell security feature bypass with a CVSS score of 8.8. The flaw involves command injection and lets an attacker slip past Mark of the Web protections, the checks Windows applies to files that arrive from the internet. Microsoft says the vulnerability has been exploited in the wild, and it has landed in CISA's Known Exploited Vulnerabilities catalogue. Computer Weekly reported the flaw was discovered in part with help from Anthropic's Claude model. Two other zero-days were publicly disclosed but not reported exploited: CVE-2026-108398, a .NET Framework flaw that could let an authenticated attacker bypass Windows Defender Application Control, and CVE-2026-92707, a denial-of-service issue in MessagePack-CSharp tied to improperly controlled memory allocation.
Beyond the zero-days, the critical list is deep. CVE-2026-100202, a use-after-free flaw in Windows Message Queuing, carries a CVSS score of 9.8, as do two remote code execution flaws in Microsoft QUIC. Microsoft flagged exploitation as more likely for CVE-2026-70229, a remote code execution flaw in Active Directory Domain Services, and CVE-2026-70571, a stack-based buffer overflow in Exchange Server, both scored 8.1. Hyper-V drew three notable flaws, and SharePoint drew an elevation-of-privilege flaw, CVE-2026-102866. Dustin Childs of the Zero Day Initiative also pointed to 55 unauthenticated, zero-click vulnerabilities across DHCP, Remote Desktop Gateway, and Network Policy Server, calling out the lateral-movement risk they create.
To help teams cope, Microsoft grouped this month's flaws into 15 provisional "risk cohorts" built around shared assessment questions, rather than root cause or severity alone. The largest cohort covers Windows filesystems, storage, and backup, with 136 vulnerabilities, followed by Office document and mail clients and Windows graphics, media, and content processing. Microsoft describes the cohorts as exploratory, not a replacement for assessing each vulnerability individually.
The scale reflects AI-assisted vulnerability discovery on both sides. As Childs put it, AI is accelerating bug-hunting for vendors and researchers alike, shortening the time between a flaw existing and someone noticing it. For enterprise IT teams, the practical order is clear: patch the exploited and publicly disclosed flaws first, ring-fence exposed perimeter services, then work by exploitability and the role each system plays in the network, not by raw CVE count.