Massive Microsoft Patch Tuesday updates have become the norm and October may actually have broken records, fixing over 1,400 vulnerabilities in Windows. This comes just a month after the company released patches for more than 1,000 flaws, and then had to send out an emergency patch to fix what those updates broke.
This week, Microsoft shipped patches that covered a mind-boggling 1,413 flaws, including one that the company said was actively being exploited by hackers in the wild before the patch.
Those patches cover 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server and 22 in SQL Server. 670 of the patches are related to privilege escalation vulnerabilities. And 70 are rated as "Critical" in severity.
Microsoft's update guide specifically highlighted three notable flaws:
- CVE-2026-96951: - Windows Shell had a command injection vulnerability that would allow a bad actor to bypass security over a network. This one was apparently actively exploited.
- CVE-2026-108398:- An untrusted search path in .NET Framework would allow an attacker to bypass a "security feature" locally. This one is listed as publicly disclosed but not exploited.
- CVE-2026-21413: This one apparently wasn't found by Microsoft but would allow a buffer overflow of Windows Raw Image Extension to allow attacks to execute code over a network.
Microsoft credited Riku Bamba and Yuya Chudo of Fujitsu Limited and Benoit Sevens, who used Anthropic's Claude, with discovering the 96951 flaw which was exploited in the wild.
"In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability," the company explained. "In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker's site or send a malicious attachment."
It's not clear how this flaw is being exploited or by whom in the real world.
What's with these massive patches?
When Microsoft patched over 1,000 flaws in September, it set a record that the October patch just smashed. This might be the new normal for Patch Tuesdays moving forward.
Microsoft has said that AI has been behind the uptick in discovered vulnerabilities. The company uses its own internal "multi-model agentic scanning harness", dubbed MDASH, that identifies Windows flaws, reduces false positives, and then sends the results to Microsoft engineers faster than previous processes.
"Submits code repositories to a multi-model agentic pipeline that identifies vulnerabilities with greater depth than traditional, pattern-matching static analysis," the company explains in a post.
What that means in practice is that more flaws are being actively discovered than ever before and also being patched quicker.
Some extra fixes
The latest massive patch doesn't just fix over 1,400 vulnerabilities. It also fixes some glitches in File Explorer. You should be able to more easily preview downloaded files in the Preview window.
Additionally, Bluetooth connections got improved accuracy and stability.
Finally, the update adds a new setting that lets you remap the Copilot Key to whatever you want like making it a right Ctrl button again.
What you need to do
If you're on Windows 11, you'll want to update your system especially to get block the known exploited flaw.
You can go to Settings and select Windows Update. The patch may be installed already and waiting for your to reboot your computer.
This patch does end support for Windows 11 version 24H2, so you'll want to make sure you're on version 26H2 now. Microsoft ends support for each version after 24 months.
Windows 11 23H2 Enterprise and Education editions are also losing support starting November 10. You'll want to encourage your organization to update to the latest version before then.
More from Tom's Guide
- 'They are new to the laptop market': AMD issues a reality check to Nvidia’s RTX Spark and fires a warning shot at Arm
- Microsoft Surface Laptop Ultra vs. MacBook Pro M5 Pro: The biggest differences explained
- Forget RTX Spark: The Surface Laptop Ultra’s magnetic USB-C charger is a game-changer that makes Apple’s MagSafe look obsolete