Microsoft released its October 2026 security updates to address 1,411 vulnerabilities, the largest monthly total the company has announced, according to a BleepingComputer report. The package includes 70 vulnerabilities classified as “critical,” including 57 remote code execution vulnerabilities, 11 privilege escalation vulnerabilities, and two security feature bypass vulnerabilities.
The vulnerabilities addressed in the Tuesday updates consisted of 677 privilege escalation vulnerabilities, 317 remote code execution vulnerabilities, 254 information disclosure vulnerabilities, 73 denial-of-service vulnerabilities, and 40 security feature bypass vulnerabilities, in addition to 28 spoofing vulnerabilities.
Three Zero-Day Vulnerabilities
The package includes three vulnerabilities that Microsoft classified as zero-day vulnerabilities. The CVE-2026-96951 vulnerability in Windows Shell was actively exploited and allows Mark of the Web to be bypassed through command injection. Microsoft did not publish details about the parties that exploited it or how the attacks were carried out.
The CVE-2026-108398 vulnerability in .NET Framework was publicly disclosed and allows an authenticated attacker to bypass Windows Defender Application Control restrictions and execute code inside a protected process, without requiring user interaction. The vulnerability was discovered by James Forshaw of Google Project Zero.
Microsoft is also addressing the CVE-2026-92707 vulnerability in MessagePack-CSharp, a publicly disclosed denial-of-service vulnerability that can be exploited over the network.
End of Support for Windows Versions
Microsoft announced on the same day the end of support for Windows 11 version 24H2 for the Home and Pro editions, along with Windows 10 Enterprise LTSB 2016. The October 2026 update is the last security update for these editions, making migration to supported versions an immediate security matter for affected organizations and users.
The company had previously stated that the Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions would stop receiving security updates starting the following month.
What Changes in Practice for Security Teams?
With this release, Microsoft introduced an experimental method for determining patch priorities by grouping similar vulnerabilities into “risk clusters.” The company published 15 groups for October, including 136 vulnerabilities associated with Windows file systems, storage, and backup; 135 vulnerabilities involving Office documents and mail clients; 131 vulnerabilities in graphics, media, and content processing; 109 vulnerabilities affecting privilege boundaries in the Windows kernel; and 103 vulnerabilities associated with installation, deployment, and update services.
Microsoft explains that these groups do not automatically mean that the vulnerabilities they contain are the most dangerous; actual risk depends on exploitation in attacks, severity, and how the organization uses the product. Therefore, the mechanism remains experimental and complementary to current patching recommendations, not a replacement for them.
Scope of the Figures
The figure of 1,411 is limited to vulnerabilities for which Microsoft released fixes on the same Tuesday. It does not include another 348 vulnerabilities that the company fixed earlier in October in products and services such as Azure API Center, Azure App Service, Azure Event Grid, Microsoft Exchange Server, and Microsoft Partner Center.
The increase in the number does not eliminate the need to prioritize: the actively exploited vulnerability and vulnerabilities affecting exposed systems or systems with elevated privileges deserve urgent remediation before attempting to address the massive list all at once. However, the article does not provide complete details about all affected products or internal deployment schedules, making it essential to consult Microsoft’s advisories and assess each organization’s environment before determining the order of implementation.