Microsoft's October Patch Tuesday sets a record at about 1,400 fixes
October 13, 2026
Microsoft fixed roughly 1,400 vulnerabilities on October 13. Published counts range from 1,407 to 1,413 depending on method, against about 970 in September. One zero-day, a Windows Shell bypass of the Mark of the Web protection (CVE-2026-96951), was already being exploited, and two others were publicly disclosed. Microsoft ties the rising volume to AI-assisted vulnerability discovery. One analysis puts monthly industry-wide CVE disclosures up 145% in two years, from 3,173 in June 2024 to 7,765 in June 2026.
Why it matters
Patch volume now exceeds what many teams can test and deploy, so prioritization decides outcomes.
What defenders can take from it
- Patch exploited and publicly disclosed flaws first, then the rest by exposure.
- Confirm that systems reached the target build, not just that an update was installed.