Source: China Photos via Getty Images

As we progress further into the AI-driven "vulnpocalypse era," Microsoft’s October 2026 Patch Tuesday security update blows past last month’s record for the number of vulnerabilities addressed, disclosing 1,413 Microsoft CVEs.

Among these are 80 critical flaws and two zero-day bugs, one under active exploitation. In comparison, September's update included 974 CVEs, which seemed staggering enough.

And yet, security experts are urging teams to ignore the size of the update, and instead focus in on exploitable risk, and getting processes, tools, and people into place to be able to reduce that risk.

"Recently, I've argued that numbers are meaningless," said Tyler Reguly, associate director for security R&D at Fortra, in public emailed comments. "This month's number, 1,413, is no different. There are, however, numbers that hold meaning. Twenty-six, for example, is how many 2026 Microsoft CVEs have shown up in the CISA Known Exploited Vulnerabilities catalog. Last year, that number was 30, and the year before was 32. That means less than 1% of vulnerabilities patched by Microsoft this year are known to be exploited."

Related:Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack

Inside October's Bountiful Patch Tuesday Update

In terms of what's lurking inside this month's bumper crop of bugs, Windows harvested the lion's share of the security flaws listed — accounting for 1,102 of them, to be exact. That's followed by 134 for Office, 61 in Developer Tools (Dev Div), 36 for SharePoint Server, 22 for SQL Server, seven for Exchange Server, 15 in Azure, and four in Defender. Thirty-two are found in various "other" categories.

Microsoft also republished a Cisco Talos bug, CVE-2026-21413, which is listed as a raw image extension remote code execution (RCE) vulnerability.

Both of the zero-days are potentially scary security bypasses. CVE-2026-96951 (CVSS 8.8) is the one under active exploit, found in Windows Shell. The other is CVE-2026-108398, found in .NET Framework Security.

The exploited bug, uncovered by Anthropic's Claude AI, targets the Mark of the Web (MOTW) tag that Windows applies to files downloaded from the Internet; it classifies how dangerous those files might be. As Automox researchers explained, it allows an attacker to craft files sent to users in such a way that bypasses MoTW — and the downstream security checks that rely on it, including SmartScreen, Office Protected View, the Office block on macros, Smart App Control on Windows 11, and the Attachment Manager prompt.

"MOTW is like the sticker on a package in that every guard in the building checks the sticker, not the package [itself]," the researchers explained in their blog post on the October update. "This bug delivers the package without [a sticker]. The result is a file that opens as though the user created it locally. No warning dialog, no read-only view, no macro block. One bug turns off several controls at once."

Related:Anthropic Gives Vetted Defenders Fewer Claude Guardrails

CVE-2026-108398 (CVSS 8.8), meanwhile, is less concerning; it needs local access and a low-privilege account, and Microsoft assesses it "exploitation less likely."

"The flaw is an untrusted search path in .NET Framework," according to Automox. "An attacker places a crafted .NET assembly on the endpoint and registers it to load in a protected process, then runs code inside that process without tripping Windows Defender Application Control (WDAC)."

Mike Walters, president and co-founder of Action1, said the vulnerability is particularly dangerous as a post-compromise attack technique.

"Successful exploitation could compromise system integrity, expose sensitive business information, weaken endpoint defenses, and disrupt critical operations," he explained in Action1's blog on the update. "Although active exploitation remains unconfirmed and exploit code maturity is unproven, public disclosure … increases urgency. With no official workaround available, prioritize deployment of Microsoft's applicable security updates across affected Windows endpoints and servers, especially WDAC-protected environments, and monitor unpatched systems for suspicious assembly loading and unauthorized execution."

Related:Dual NetScaler Zero-Days Trigger Chaos for Citrix Customers

Other October Security Patches to Prioritize

One vulnerability that Automox researchers also flagged is a critical Reading Pane RCE in Outlook, tracked as CVE-2026-70242 (CVSS 9.8).

Attackers can craft an email that triggers a heap-based buffer overflow when Outlook shows it in the Reading Pane; there's no need to open the message, authenticate, or interact in any way for exploitation to occur.

"Preview-pane bugs surface every few years, and they draw attention because email is the front door," the researchers warned. "Addresses are easy to find in breach dumps and on company websites, so targeting costs an attacker almost nothing."

Dustin Childs, head of threat awareness for the Zero Day Initiative (ZDI) at TrendAI, warned security teams about CVE-2026-102866 (CVSS 8.1), a Microsoft Office SharePoint elevation of privilege vulnerability.

"It’s an improper cryptographic signature verification bug," Childs said in his monthly patch review. "An attacker who obtains a valid proof token for a targeted user could modify it, submit it to the server, and authenticate as that user. The only caveat is that the attacker has to obtain that token first, but there are multiple methods this could be achieved."

He also noted CVE-2026-65674 (CVSS 8.8), which is a Microsoft SQL Server RCE bug, as having "the best exploitability rating of any SQL Server bug this month. It’s a deserialization of untrusted data. An authenticated attacker connects to an affected SQL Server and sends a specially crafted request to run code on the server. No user interaction is needed. Definitely check this on any SQL Server directly connected to the Internet."

Another concerning bug that's ripe for prioritization is a heap-based buffer overflow RCE flaw in Microsoft QUIC, tracked as CVE-2026-105016 (CVSS score 9.8). It could allow an unauthenticated attacker to execute malicious code on affected systems over a network, and affects multiple Microsoft products, including Windows 11, Windows Server, .NET, and Visual Studio.

"An attacker could exploit this weakness by sending a specially crafted network packet to an affected service, potentially gaining control of the targeted system without requiring authentication or user interaction," Jack Bicer, director of vulnerability research at Action1, said in the company's blog. "Successful exploitation could let attackers run malicious code and take control of affected services, exposing or altering sensitive business and customer data, disrupting operations, and leaving organizations with recovery costs and damaged customer trust."

In addition to these specific vulnerabilities, Nightwing experts provided some general guidance for dealing with the monster that is Microsoft's October Patch Tuesday update:

AI Continues to Add Horror Chills to Patch Tuesday Releases

Microsoft's escalating Patch Tuesday numbers are emblematic of a broader reality of monthly CVE disclosures rising sharply; they've grown in volume by 145% over two years according to one analysis from Echo, from 3,173 in June 2024 to 7,765 in June 2026.

There are a few reasons for this: it's partly due to the expansion of CVE programs in general, according to Echo's analysis, but also of course increasingly because of AI-assisted vulnerability discovery. On an annual basis, CVE disclosures shot up from 30,949 in 2023 to 49,979 in 2025 and, based on the numbers so far, 2026 is clearly on track to surpass even that number. The question is, how are security teams to handle the increased workload?

"Is AI to blame? Partly," said ZDI's Childs. "It's accelerating bug-hunting on both sides of the fence, so vendors are finding (and fixing) more flaws, and researchers are finding them faster too. But AI isn't creating these bugs out of thin air. It’s just shortening the time between a vulnerability existing and someone noticing it."

As Fortra's Reguly implied, Childs said that security teams simply need to adapt. "What matters is that discovery is scaling faster than exploitation, so teams that triage by sheer CVE count instead of exploitability are burning cycles on the wrong bugs," he said. "Patch what's proven, prioritized, and public, and treat everything else as this month's new normal."

About the Author