MICROSOFT released a record Patch Tuesday in October 2026, shipping fixes for 1,413 vulnerabilities across Windows, Office, Developer Tools, SharePoint Server and SQL Server. About 1,102 of these are Windows flaws, with the rest spread across other Microsoft products. Microsoft says more than 670 of the issues are privilege escalation flaws, over 300 are remote code execution flaws, and around 250 are information disclosure flaws, with more than 70 currently rated as Critical.
The scale prompted commentary from researchers, noting that while AI is accelerating bug discovery, the real concern lies in prioritising patches by exploitability rather than CVE count.
Three vulnerabilities of particular note are CVE-2026-96951 (CVSS 8.8), a command injection flaw in Windows Shell that could be exploited over a network to bypass security features, and CVE-2026-108398 (CVSS 8.8), an untrusted search path issue in the .NET Framework that could let an authorised attacker bypass WDAC and run unauthorised code locally. A separate issue, CVE-2026-92707 (CVSS 5.3), a memory allocation vulnerability in MessagePack-CSharp, could allow a denial of service over the network.
Microsoft confirms CVE-2026-96951 has been exploited in the wild and notes that an attacker could deliver a crafted file through email or messaging to trigger the flaw. CISA has added the CVEs to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply fixes by 16 October 2026. Also patched was CVE-2026-21413, a high-severity Raw Image Extension heap buffer overflow that can remotely run code when a user previews a RAW image. Microsoft emphasises prioritising updates using risk cohorts to group related CVEs for customer assessment.