Yesterday was October Patch Tuesday, and Microsoft’s security updates addressed 1,416 new vulnerabilities. Not only is that another record broken, but it’s also the first time over 1,000 flaws were fixed in a single month. Indeed, October 2026 saw more security vulnerabilities fixed in the month than were fixed in any previous year.
Alongside flaws fixed in Windows and Office, we also saw a bunch of fixes in Exchange Server, SQL Server, Hyper-V, Skype for Business, Microsft Defender, .NET Framework, Visual Studio, and Microsoft’s cloud services.
Microsoft classifies 85 of the 1,416 vulnerabilities as “critical,” including 67 remote code execution (RCE) vulnerabilities. The other vulnerabilities are classified as “high risk,” with one vulnerability already being exploited in the wild while two were publicly known in advance.
The next Patch Tuesday is scheduled for November 10th, 2026.
Windows security vulnerabilities
A large number of the vulnerabilities—over 1,000 this time—are spread across the various Windows versions (10, 11, Server) for which Microsoft still provides security updates, including Windows 10 via the Extended Security Updates program, which was extended until October 12th, 2027.
Note: If you’re still on Windows 11 24H2, this is your last Patch Tuesday. Computers running 24H2 will no longer receive security updates going forward. When prompted by Windows Update, you should upgrade to Windows 11 25H2 or 26H2. That’ll keep you secure and up to date.
Windows under attack
One Windows security vulnerability is already being exploited in the wild this month. CVE-2026-96951 in the Windows Shell allows attackers to bypass the system’s defenses by disguising the origin of an executable file from the internet (Mark of the Web, or MotW).
Critical Windows vulnerabilities
Microsoft has classified 42 Windows vulnerabilities as critical, including 30 RCE vulnerabilities. Via these flaws, an attacker could remotely execute injected code without authentication or user interaction. The malicious code could then spread further across the network.
Microsoft Edge security vulnerabilities
The latest security update to Microsoft Edge 155.0.4283.45 is dated October 8th and based on Chromium 155.0.8059.40. It addresses 247 Chromium vulnerabilities, which are not included in the sum of flaws fixed in Microsoft Edge this month.
Microsoft Office security vulnerabilities
Microsoft has fixed 194 vulnerabilities in its various Office products, including 25 RCE vulnerabilities classified as critical. With “critical” RCE vulnerabilities in Office, the preview pane is usually an attack vector—a user doesn’t need to open an infected file for an attack to succeed, but rather only needs to preview it in the preview pane. Meanwhile, “high risk” RCE vulnerabilities usually require a user to open an infected Office file in a vulnerable Office product (open-and-own).
Among the numerous vulnerabilities in SharePoint, CVE-2026-102866 is an elevation of privilege (EoP) vulnerability that Microsoft classifies as critical. It is also the only SharePoint vulnerability that an attacker could exploit without a user login. They would need to obtain a valid user token, modify it, and impersonate that user on the server.
Exchange Server security vulnerabilities
Microsoft has fixed 7 vulnerabilities in Exchange Server this month. Six of these are classified as high risk, including five EoP vulnerabilities. CVE-2026-70571 is also included, an RCE vulnerability classified as critical.