Microsoft rolled out an unprecedented batch of security patches on Tuesday, fixing more than 1,400 vulnerabilities across its software lineup. The massive update addresses one flaw that has already faced active exploitation in the wild, alongside at least two other publicly known zero-day bugs.
The sheer scale of the release establishes a new record for the company\’s monthly updates. Security outlets reported slightly varying overall totals depending on how patches were counted: The Hacker News reported 1,413 flaws resolved, BleepingComputer counted 1,411 bugs issued on Tuesday, and Krebs on Security noted the volume comfortably exceeded 1,400. In addition, CyberSecurityNews reported that 1,118 of the vulnerabilities were distributed across Microsoft\’s new assessment groups. The release comes just one month after September\’s update resolved nearly 1,000 security flaws.
Actively exploited Windows vulnerability
Among the fixes is CVE-2026-96951, a security feature bypass in the Windows Shell that attackers have already leveraged in real-world attacks. Microsoft warned that the flaw permits malicious actors to evade the Mark of the Web safety protections that flag untrusted files arriving from the internet.
According to reporting from The Hacker News, an attacker attempting to leverage the bug would need to trick a target into opening a malicious attachment or clicking a link, as the vulnerability cannot force interaction on its own. While Microsoft has not publicly identified the victims or the specific threat actors involved, the U.S. Cybersecurity and Infrastructure Security Agency placed the vulnerability on its Known Exploited Vulnerabilities catalog, ordering federal civilian agencies to patch affected systems by Friday, Oct. 16.
Two other zero-day issues were publicly known prior to Tuesday\’s rollout, though Microsoft indicated neither showed signs of active exploitation. One of those flaws, designated CVE-2026-108398, is a .NET Framework bypass reported by James Forshaw of Google Project Zero. Microsoft explained that an authenticated attacker could bypass Windows Defender Application Control enforcement to run unauthorized code inside protected processes without needing user interaction. The second publicly known flaw involved a denial-of-service weakness in MessagePack-CSharp.
Artificial intelligence accelerates bug counts
Security researchers attribute the soaring number of patches to automated discovery methods. Microsoft has credited artificial intelligence models with helping identify and remediate weaknesses at scale. Dustin Childs, head of threat awareness at the Zero Day Initiative, told The Hacker News that machine learning tools are speeding up discovery on both offensive and defensive fronts, warning that discovery is outpacing exploitation.
Industry analysts point out that the volume places unprecedented burdens on enterprise IT administrators. Satnam Narang, a senior staff research engineer at cybersecurity firm Tenable, told Krebs on Security that Microsoft has resolved more than 4,000 Common Vulnerabilities and Exposures this year alone, easily eclipsing the previous annual record set in 2020.
To help defensive teams handle the massive update packages, Microsoft introduced an experimental framework called \”risk cohorts.\” The framework groups related vulnerabilities based on shared operational questions rather than technical severity scores alone. The 15 cohorts published for October focus on common attack surfaces, including:
- Windows filesystems, storage, and backup systems, covering 136 vulnerabilities
- Office documents and email clients, accounting for 135 flaws
- Windows graphics, media, and content rendering, spanning 131 bugs
- Core Windows kernel and privilege boundaries, containing 109 issues
- Deployment, installation, and update mechanisms, grouping 103 flaws
Microsoft emphasized that these groupings are designed to streamline exposure assessments rather than replace traditional vulnerability prioritization or active threat warnings.
Tuesday also marked the formal retirement of Windows 11 version 24H2 Home and Pro editions, as well as Windows 10 Enterprise LTSB 2016, with Microsoft confirming that this week\’s release represents the final update for those platforms.
