Microsoft’s monthly Patch Tuesday bug count has been trending higher since the beginning of the summer, and October is no different. The company just issued fixes for a record 1,411 vulnerabilities, including three zero-days, which are flaws that have been actively exploited or publicly disclosed before an official patch is available, making them especially risky.
For comparison, in October 2025, Microsoft issued patches for fewer than 180 flaws—six of which were zero-days—which was considered a large update at the time. Fixes typically numbered in the double digits until the middle of this year, when the totals jumped to 206 (June), 570 (July), 400 (August), and 966 (last month). That steep increase is largely attributable to AI models, which are making it easier for bad actors to develop hacking tools to exploit vulnerabilities, and for companies to find and patch these flaws more quickly. This means that update cycles are being shortened and/or include a significantly higher number of fixes. Companies like Microsoft are using AI to discover and address bugs, though AI isn’t as good at the latter, and may, in some cases, introduce additional vulnerabilities in the process.
October’s Patch Tuesday fixes 1,411 flaws, including three zero-days
As BleepingComputer reports, the October 2026 security update addresses flaws across the following categories: 677 elevation-of-privilege vulnerabilities, 40 security feature bypass vulnerabilities, 317 remote-code-execution vulnerabilities, 254 information disclosure vulnerabilities, 28 spoofing vulnerabilities, and 73 denial-of-service vulnerabilities. 70 of the bugs are rated “critical” and include remote code execution, elevation of privilege, and spoofing flaws. Microsoft patched an additional 348 bugs earlier this month for various Azure, Mariner, and Microsoft products.
One of the zero-days patched this month has been actively exploited in the wild. CVE-2026-96951 is a security feature bypass vulnerability in Windows Shell that allows attackers unauthorized access over a network. Microsoft has not provided details on who disclosed this flaw or how it was exploited.
The other two zero-days were publicly disclosed. CVE-2026-108398 is a security feature bypass vulnerability in the .NET framework that would allow attackers to bypass Windows Defender Application Control restrictions and run unauthorized applications without user interaction. This flaw has been attributed to James Forshaw of Google Project Zero. Finally, CVE-2026-92707 is a denial-of-service vulnerability in MessagePack-CSharp credited to an anonymous source.
You should update your PC ASAP
PC users should ensure that they download and install all security updates as soon as they’re available. Patch Tuesday typically releases on the second Tuesday of every month around 10 a.m. PT and should be applied automatically. However, given the increasing risk, it’s a good idea to confirm your machine’s update status via Start > Settings > Windows Update > Check for Windows updates.