Microsoft released the October security update for Windows on Tuesday, which contains a record 1,411 patches for security vulnerabilities. This is the highest number of fixes in a single cycle, with the October package for this year marking the second consecutive month to set a record for the number of patched vulnerabilities.
Among the fixes are three zero-day vulnerabilities. One of these was already being actively exploited in attacks, while the other two were publicly disclosed prior to the patch release. Some sources categorise all three as zero-day vulnerabilities, while others distinguish only between actively exploited or publicly disclosed vulnerabilities.
The most critical vulnerability is CVE-2026-96951, which affects the Windows shell. Microsoft confirmed that the vulnerability was exploited prior to the patch release, but did not disclose further details about the attacks. The flaw could allow an attacker to bypass the Mark of the Web (MotW) feature, which marks files downloaded from the internet and helps the system display a warning before opening a potentially dangerous file. If an attacker bypasses this check, the user may not see the expected security warning.
In addition to CVE-2026-96951, two other vulnerabilities were patched that had been publicly disclosed before the update. The vulnerability CVE-2026-108398 affects the .NET framework and allows bypassing security restrictions — in certain circumstances, an attacker could execute unauthorised code within a protected process, bypassing the rules enforced by Windows Defender Application Control. The vulnerability CVE-2026-92707 is located in the MessagePack-C# library and can allow a denial of service, causing a crash in the affected application or service.
Of the total number of patched vulnerabilities, 70 were rated as 'critical'. Within this highest-risk group, 57 vulnerabilities relate to remote code execution, 11 to privilege escalation, and two are classified as spoofing. In total, 677 vulnerabilities related to privilege escalation were identified, 317 vulnerabilities allowing remote code execution were identified, and 254 vulnerabilities leading to information disclosure were addressed.
Microsoft published the details in a 45-page document. The record number of patches is directly linked to the increasing use of artificial intelligence for detecting and remediating security vulnerabilities — Microsoft has been using AI tools to identify vulnerabilities since July. Security firms count between 1,407 and 1,413 fixed vulnerabilities in the package, depending on the methodology, with the figure covering vulnerabilities in Windows and other Microsoft products and components.
The patch package includes Windows 11, supported editions of Windows 10, Windows Server, Microsoft Office, Exchange, .NET, Visual Studio, and other products. Microsoft's review notes that security updates have been published for multiple product families, with the potential impact for a range of products including remote code execution.
Microsoft released the October security update for Windows 11 under the identifier KB5127648, available via Windows Update for supported editions of the operating system. This includes fixes for issues with the Windows Explorer, sound, printing, and Windows Hello fingerprint login. Users of Windows 10 included in the Extended Security Updates (ESU) programme, as well as users of specific long-term service channel (LTSC) editions, can check for update KB5126657, which applies to devices covered by that programme and long-term releases. Standard editions of Windows 10 are no longer receiving regular security updates.
Microsoft's documentation states that users meeting the criteria can download the update via Windows Update. The package includes fixes for some issues with File History and the gradual introduction of new Secure Boot certificates on supported devices. Users can check the availability of the update in Settings > Windows Update, or in Windows 10 at Settings > Update & Security > Windows Update. After installation, a restart of the computer may be required.
Since the patches cover Office, .NET, and other products, users should check for updates to those applications. Windows Update and other Microsoft channels deliver the relevant packages for the specific operating system version and device, with a view to the vulnerabilities covered by the October patches available in the Security Update Guide.
