October 2026 Patch Tuesday Sets a Record at 1,413 CVEs

Microsoft shipped its monthly Patch Tuesday security updates on October 13, 2026 with 1,413 CVEs, the largest batch on record according to SecurityWeek. One Windows flaw is already being exploited. For government agencies and offices, the main task now is deciding the order of installation, because not every update can go onto every computer on the same day.

A new record in a single month

Patch Tuesday is Microsoft’s monthly release of security updates, issued on the second Tuesday of the month. A CVE is the identifier for a single publicly known security flaw. According to SecurityWeek, this month’s count exceeds everything Microsoft fixed in all of 2025, and total fixes in 2026 have passed 4,000.

The breakdown: 1,102 CVEs in Windows, 134 in Office, 61 in developer tools, and 36 in SharePoint Server. Exchange Server, Azure, and Defender also received fixes. BleepingComputer counted 70 rated Critical: 57 remote code execution, 11 elevation of privilege, and 2 spoofing.

The totals differ slightly between outlets. SecurityWeek reports 1,413 CVEs, BleepingComputer 1,411, and Lansweeper 1,410 fixes. BleepingComputer explains that its figure covers only flaws released on Patch Tuesday itself and leaves out 348 fixes published earlier in the month. This article uses SecurityWeek’s 1,413.

On the reason for the surge, SecurityWeek attributes it largely to AI-assisted vulnerability discovery. BleepingComputer writes that Microsoft continues to use AI platforms to find and fix flaws in its products. Neither outlet says how much of the total came from AI.

One flaw is already being exploited

The most urgent fix is CVE-2026-96951, a security feature bypass in Windows Shell with a CVSS score of 8.8. It lets an attacker evade Mark of the Web, the tag Windows attaches to files downloaded from the internet. That tag triggers warnings from Defender SmartScreen and protections such as Office Protected View. When it is bypassed, a malicious file can open without any warning.

According to SecurityWeek, Microsoft says an attacker must convince a user to take action, for example through a file sent by email or instant message. Microsoft has not shared details of the attacks, BleepingComputer reports. SecurityWeek adds that the US cybersecurity agency CISA added the flaw to its exploited-vulnerabilities catalog on October 13, with a remediation deadline of October 16 for federal agencies.

Two other flaws were publicly disclosed before fixes were available. CVE-2026-108398 allows a bypass of Windows Defender Application Control (WDAC) in the .NET Framework, and was found by James Forshaw of Google Project Zero, per BleepingComputer. CVE-2026-92707 is a denial-of-service flaw in MessagePack-CSharp, a component used by Visual Studio and .NET. Microsoft rates exploitation of the WDAC flaw as unlikely.

Risk cohorts for sorting the updates

With a volume this large, Microsoft introduced the idea of “risk cohorts” in an MSRC blog post on October 13. A risk cohort is a group of CVEs that need a similar customer assessment. Members do not have to share a root cause or a CVSS score. What they share is a question about your environment, such as whether untrusted content can reach the affected component.

Microsoft published 15 example cohorts for the October release. The largest covers 136 CVEs in Windows filesystems, storage, and backup, followed by 131 in graphics, media, and content processing. Another example is the remote-access and RDP cohort. Its shared question: which client, gateway, and server roles are deployed, and which are exposed to the internet? If an RD Gateway or RD Session Host is reachable from the internet, server-side CVEs rank higher. Devices reachable only through a VPN or a Zero Trust path may be able to wait for some CVEs.

Microsoft states that the cohorts are provisional and not official vulnerability categories. In its words: “Risk cohorts are a starting point, not a final decision.” A cohort does not mean one update addresses every CVE inside it, and cohorts do not replace a close review of exploited or high-severity flaws. Microsoft is also asking for feedback on the approach.

What this means for agencies and offices

Government agencies, schools, and branch offices typically manage dozens to hundreds of computers with a small IT team. In that situation, order matters more than installing everything at once.

Check Windows versions first. The October update is the last for Windows 11 version 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016, according to BleepingComputer. Windows 11 23H2 Enterprise, Education, and IoT Enterprise stop receiving security updates starting next month. Computers still on those versions should be scheduled to move to a supported release.

Install the fix for the exploited flaw on every user computer. This comes first because attacks are already happening. Caution with attachments and links still applies, since this flaw weakens the download warning itself.

Prioritize internet-facing servers. Lansweeper advises putting CVE-2026-70571 and CVE-2026-70279 first on Exchange servers exposed to the internet (Exchange 2016 CU23, 2019 CU14 and CU15, and Subscription Edition). Devices at the network edge are frequent targets, as we covered in the Ivanti VPN zero-day case.

Move on to domain controllers. Lansweeper also highlights CVE-2026-70229, an unauthenticated code execution flaw in Active Directory Domain Services. The servers that hold every user’s account belong early in the queue.

Test on a small group, then record a decision per risk cohort. CyberInsider notes an issue Microsoft is still working on: some USB Audio Class 1.0 devices may have no sound or show Code 10 errors. That matters for headsets and meeting-room gear. Answer each cohort’s environment question once, document it, and use it as the starting point for reviewing each CVE.

For agencies building out IT governance, this routine fits the needs of digital government: an asset list, named owners, and written deadlines for updates. Organizations without a dedicated security team can start with help from cybersecurity services.

Frequently asked questions

Do all 1,413 CVEs need to be installed today?

Monthly Windows updates normally arrive as a single package, so the CVE count does not translate into the same amount of work. Today’s priority is the exploited flaw, followed by internet-facing servers and domain controllers. Microsoft itself cautions that risk cohorts are only a starting point for assessing each CVE.

Why do the numbers differ between outlets?

Three counts are in circulation: 1,413 CVEs per SecurityWeek, 1,411 per BleepingComputer, and 1,410 fixes per Lansweeper. BleepingComputer says its figure covers only flaws released on Patch Tuesday itself. For operational decisions, a gap of a few flaws does not change the steps to take.

Are Windows 11 24H2 Home and Pro computers no longer safe?

They stop receiving monthly security updates after the October release, so any flaw found later will not be patched on that version. CyberInsider advises users to move to a version that is still supported so that they keep receiving fixes.

Closing

This record release shows that the number of discovered flaws keeps rising while IT teams’ time and staff stay roughly constant. A clear asset list, a written installation order, and a small pilot group make the next round easier to manage. If you would like help assessing your update management and cloud infrastructure, our team is glad to talk through the contact page.

Sources

• Microsoft Security Response Center: Using risk cohorts to prioritize security updates, October 13, 2026
• BleepingComputer: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days, October 13, 2026
• SecurityWeek: Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day, October 14, 2026
• Lansweeper: Microsoft Patch Tuesday, October 2026, October 13, 2026
• CyberInsider: Windows 11 October 2026 updates, October 13, 2026