Microsoft Patches a Record 1,400+ Flaws in October 2026: What Windows and Exchange Admins Should Do First

Trackers count slightly differently: BleepingComputer reported 1,411 flaws, while Tenable counted 1,407 CVEs across 301 products and components. Both described it as a record release, so treat the total as roughly 1,400.

The numbers are unusual, but the playbook is not. Prioritize exploited and internet-facing systems, then work through critical remote code execution fixes. Details for every CVE are in the Microsoft Security Response Center update guide.

What Happened on October 13, 2026

Microsoft published its monthly security updates on October 13, 2026. According to BleepingComputer and Tenable, the release is the largest ever, and it includes one zero-day exploited in the wild alongside publicly disclosed flaws in widely used components.

• Exploited zero-day: CVE-2026-96951, a Windows Shell security feature bypass rated CVSS 8.8, lets attackers bypass Mark of the Web protection. Tenable notes social engineering through email or messages can trigger it.
• Publicly disclosed: CVE-2026-108398, a .NET Framework bypass of Windows Defender Application Control. BleepingComputer also lists a MessagePack-CSharp denial-of-service flaw, CVE-2026-92707, so zero-day counts differ between trackers (two or three).
• Severity: Tenable counted 69 Critical and 1,337 Important CVEs; BleepingComputer reported 70 Critical vulnerabilities.

Critical Flaws Worth Prioritizing

Beyond the zero-day, Tenable highlights critical remote code execution flaws in core enterprise services that Microsoft rates as more likely to be exploited. These are the systems that attackers target after a public patch release, so they deserve the fastest change windows.

• Active Directory Domain Services: CVE-2026-70229, remote code execution, CVSS 8.1, Critical.
• Exchange Server: CVE-2026-70571, remote code execution, CVSS 8.1, Critical; and CVE-2026-70279, spoofing, CVSS 9.3, rated Important.
• Other: Dynamics Business Central (CVE-2026-100214) and BITS (CVE-2026-88159) remote code execution flaws, both CVSS 8.8 and rated more likely to be exploited.

End-of-Support Deadlines in the Same Release

This month also marks lifecycle endings. Systems that stop receiving security updates become a standing risk, so inventory them now and plan upgrades or isolation rather than waiting for the next vulnerability disclosure.

• Windows 11 24H2: Home and Pro editions reached end of support, with October as the last update.
• Windows Server 2012 and 2012 R2: Extended Security Updates ended, per Tenable.
• Office 2021 family: Office 2021 and Office LTSC 2021 reached end of support, per Tenable.
• Windows 10 Enterprise LTSB 2016: extended support ended.

Why It Matters for B2B SaaS Buyers and IT Teams

Record patch volume strains change management. Large releases raise the odds that one fix conflicts with a line-of-business application, while delayed deployment leaves exploitable gaps. Automation and good asset data are what separate a calm patch cycle from an incident.

• Capacity: staged rings and automated approvals reduce manual testing load.
• Visibility: you cannot patch what you cannot see, so reconcile asset inventories now.
• Evidence: auditors expect proof of timely remediation, as reflected in the CISA Known Exploited Vulnerabilities catalog approach to prioritizing exploited flaws.

What to Do Now: A Patch Checklist

Move in a clear order and document each step. Start with exploited and exposed systems, validate in a small ring, then roll out broadly while you track exceptions and compensating controls for anything you cannot patch immediately.

• Today: deploy the Windows Shell fix to endpoints, starting with users who open external email and files.
• This week: patch Exchange and Active Directory servers after a backup and a pilot.
• Ongoing: retire or isolate end-of-support systems, and review application allow-listing for the .NET bypass.
• Tooling: compare options such as Action1, Automox and NinjaOne Patch Management in the Patch Management Software category, and see our WSUS client diagnostics guide.

Frequently Asked Questions

How many vulnerabilities did Microsoft fix in October 2026?
Reports vary by counting method: BleepingComputer cited 1,411 flaws and Tenable counted 1,407 CVEs. Both call it a record Patch Tuesday, so plan for roughly 1,400 fixes.

Which October 2026 Patch Tuesday flaw is being exploited?
CVE-2026-96951, a Windows Shell security feature bypass that sidesteps Mark of the Web protection, was exploited in the wild before the patch, according to BleepingComputer and Tenable.

Should I patch Exchange Server immediately after Patch Tuesday?
Prioritize it. Tenable lists Exchange remote code execution and spoofing flaws as more likely to be exploited. Back up, test on a pilot server, then deploy within your emergency change window.