Microsoft fixes 1,400+ vulnerabilities in October, exceeding 2025’s annual total
Microsoft, with the help of AI, identified more vulnerabilities in a single month than were reported throughout the entire previous year.
Image by Shutterstock.
Follow us
- Microsoft fixed a record 1,413 vulnerabilities in its October Patch Tuesday update.
- CISA ordered federal agencies to patch an actively exploited Windows Shell flaw by October 16th.
- Attackers can exploit the zero-day by tricking users into opening a malicious file or link.
- Microsoft is testing “risk cohorts” to help administrators prioritize large groups of security fixes.
Microsoft's monthly security update, known as Patch Tuesday, has addressed a record 1,413 vulnerabilities. One zero-day bug is being actively exploited in the wild, and the US Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch it by Friday.
The largest ever Patch Tuesday release fixes 1,102 bugs in Windows, 134 vulnerabilities in Office, and dozens of other weaknesses in SharePoint, SQL, Exchange servers, developer tools, and other products.
The release contains fixes for 78 critical vulnerabilities, most of which enable remote code execution (65), followed by 11 elevation-of-privilege flaws and 2 spoofing bugs. Additionally, 1,329 bugs are marked as “important.”
Microsoft says AI-assisted vulnerability discovery now requires a new approach to make patching less overwhelming. The tech giant suggests grouping of vulnerabilities, dubbed “risk cohorts.”
October marks a sharp increase over last month's record, when Microsoft fixed 999 CVEs (Common Vulnerabilities and Exposures). A year ago, the October security updates delivered nearly 8 times fewer bug fixes – 180.
The number of Microsoft bugs reported in October alone exceeded the 1,273 reported vulnerabilities for the entire year of 2025.
The bug fixes still cover Windows 10, the support for which through the Extended Security Updates (ESU) program was initially set to expire on Octber 12th, 2026. Microsoft extended the ESU program by an additional year in June, as many users remained reluctant to switch to a newer OS version.
CISA warns about a zero-day exploited in the wild
CISA has followed up by adding one Microsoft Windows Shell command-injection vulnerability to its Known Exploited Vulnerabilities Catalog. The agency has set October 16th as the deadline for federal agencies to apply mitigations.
Unauthorized attackers are exploiting this bug to bypass the “Mark of the Web” (MOTW) security feature, which warns users or blocks them from opening files downloaded from the internet.
Attackers can send an email or an instant message to targeted users, attaching a specially crafted file designed to exploit the bug, according to Microsoft’s advisory.
The attack is relatively easy to pull off and requires no special conditions or privileges. Attackers would still need to convince users to take action – enticing them to click a link or open a malicious attachment.
The bug, tracked as CVE-2026-96951, has a severity rating of 8.8 out of 10, making it “important” rather than “critical.”
“Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network,” the bug description reads.
Check if your data was exposed
Find out if your email and related personal information have appeared in known data breaches.
Microsoft introduces “risk cohorts”
To help administrators assess threats more efficiently, Microsoft started grouping the large number of vulnerabilities into risk cohorts based on the environments they affect.
“For many customers, the priority is to install the appropriate security updates as soon as possible,” the tech giant explains in a blog post.
“As security update packages address more CVEs, these customers face a familiar challenge: determining which vulnerabilities require immediate attention in their environment and which may be lower priority.”
The cohorts are unofficial categories – additional assistance that does not change update guidance, nor do they replace assessments for individual CVEs.
The October release’s breakdown groups CVES to the following categories:
- Windows filesystems, storage, and backup – 136 CVEs
- Windows graphics, media, and content processing – 131 CVEs
- Office document and mail clients – 135 CVEs
- Windows core and kernel privilege boundaries – 109 CVEs
- Windows installation, deployment, and update services – 103 CVEs
- Windows device, peripheral, and print surfaces – 76 CVEs
- Remote-access and RDP deployments – 65 CVEs
- Windows authentication, credentials, and cryptography – 61 CVEs
- Windows networking and protocol stack – 53 CVEs
- DNS, DHCP, and network-address infrastructure – 76 CVEs
- Virtualization, container, and isolation hosts – 45 CVEs
- Directory, federation, and certificate infrastructure – 24 CVEs
- Network file and resource sharing – 39 CVEs
- Endpoint management and security controls – 38 CVEs
- Windows web, RPC, and messaging services – 27 CVEs
Microsoft explains that vulnerabilities within each cohort vary in severity and exploitability, and that each CVE still requires appropriate patching.
The company is exploring this experimental approach “to support a broader customer and industry discussion about making vulnerability analysis more manageable,” and hopes to receive customer feedback to shape future development.
