Microsoft patches record number of vulnerabilities in October update
According to Microsoft's bulletin, the security round contains 1,413 vulnerabilities, including a Windows flaw already being exploited.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Microsoft released an exceptionally large security update on Tuesday. Independent security researchers count 1,413 vulnerabilities addressed, although some counts are slightly lower because of methodological differences.
Microsoft's October update covers 1,413 vulnerabilities in the company's products, according to Rapid7 and The Hacker News. Of these, 1,102 concern Windows. BleepingComputer counted 1,411 because it defines what falls under Patch Tuesday differently.
The scale is notable because Microsoft had already fixed a record number of flaws in September. This is not one coordinated attack, but a collection of security problems in Windows, Office, development tools and server software, among others.
One of the problems, CVE-2026-96951, is already being exploited in attacks, according to Microsoft. The flaw is in Windows Shell and can bypass the security warning for files from the internet. An attacker must still persuade a user to open a malicious file or follow a link.
Microsoft also identifies a vulnerability in the .NET Framework that was publicly known before the update appeared. According to the available technical descriptions, it can be used to bypass certain security restrictions, but access to the system is already required.
The update is particularly relevant to organisations that manage Windows environments. The raw scale does not mean that every vulnerability is equally urgent for every user; security teams must assess each product for exploitation, accessibility and whether systems are publicly accessible.
Microsoft published the details in its Security Update Guide. According to The Hacker News, the Cybersecurity and Infrastructure Security Agency added the actively exploited Windows flaw to its catalogue of known exploited vulnerabilities. For US federal organisations, this entails a short remediation deadline; that deadline does not automatically apply to Dutch organisations.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The technical core has been confirmed by Microsoft's own security guide and two independent security publications. The differing total count is explicitly addressed in the text.
- confirmed The October update contains 1,413 vulnerabilities, according to Microsoft's bulletin. — Rapid7 and The Hacker News give this figure based on Microsoft's release; Microsoft's interactive page is the primary source. source
- confirmed 1,102 vulnerabilities concern Windows. — Rapid7 and The Hacker News mention this part of the October release. source
- confirmed CVE-2026-96951 is being actively exploited. — Microsoft reports active exploitation; The Hacker News describes the same status. source
- confirmed BleepingComputer counts 1,411 vulnerabilities. — The publication explains its own counting method. source
Editor's note
The number of vulnerabilities varies by source because of counting methods: 1,413 in Microsoft's bulletin according to Rapid7 and The Hacker News, and 1,411 according to BleepingComputer. The actively exploited Windows flaw has nevertheless been identified unambiguously.Sources
- Security Update Guide — October 2026 — Microsoft Security Response Center
- Patch Tuesday — October 2026 — Rapid7
- Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug — The Hacker News
- Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days — BleepingComputer
More on this in Dutch media
- Trouw — „microsoft windows”
- NU.nl — „microsoft windows”
- De Telegraaf — „microsoft windows”