Microsoft Breaks Patch Tuesday Record Again with 1400+ CVEs
Microsoft's October 2026 Patch Tuesday fixes 1,411 CVEs, including one actively exploited Windows Shell bypass.
Microsoft's October 13, 2026 Patch Tuesday fixed 1,411 CVEs, more than the just over 1,100 updates released in all of 2025, which the company has tied to AI-assisted discovery including its MDASH scanning harness. One flaw, CVE-2026-96951, a Windows Shell security-feature bypass scored CVSS 8.8, is actively exploited and can be triggered by a user opening a crafted file from email, chat, or a website. Two publicly disclosed but not yet exploited issues are CVE-2026-108398, a .NET bypass of Windows Defender Application Control, and CVE-2026-92707, a network denial of service in MessagePack-CSharp. Of 70 critical bugs, 57 are remote code execution, including Outlook Reading Pane flaw CVE-2026-70242 at CVSS 9.8, which can trigger from preview alone.