Microsoft's Record Patch Tuesday: What More Than 1,400 CVEs Actually Mean

Microsoft's October 2026 Patch Tuesday, its monthly release of security patches (vendor code fixes for flaws), listed about 1,413 CVEs (Common Vulnerabilities and Exposures entries, the public identifiers for individual flaws), roughly eight times the 175 that held the monthly record a year earlier; one of them is confirmed exploited in attacks.⁠¹⁠²⁠³ A CVE count measures how many flaws received labels, and the number that matters to any one organization is the short list that is exploited, reachable from the internet, or public before a fix existed.

Why do outlets report different totals for October?

Outlets disagree because they count slightly different things, and Microsoft's own tables differ by a few entries. Outlets reading the October list reported anywhere from 1,409 to 1,415 CVEs. Security Boulevard,⁠¹ Hackread⁠⁴ and SOCRadar⁠⁵ each reported 1,413. Action1, quoted by Hackread, counted 1,409.⁠⁴ InfoQ⁠⁶ and Security Affairs⁠⁷ reported 1,415, and Krebs on Security wrote only that the total passed 1,400.⁠³

Counting choices explain part of the spread. Brian Krebs said some publications add Chromium bugs, flaws in the open-source browser engine under Microsoft Edge, to each Patch Tuesday total, and that he generally does not.⁠⁸ Dustin Childs of Trend Micro's Zero Day Initiative flagged one October CVE, in the MessagePack-CSharp software library, that a third party released and Microsoft included in its list.⁠¹

Microsoft's own figures also differ. According to Splashtop, an endpoint-management vendor, the release notes state 1,413 CVEs, the product-family table totals 1,414 and the published CVE list contains 1,411.⁠⁹ The reported totals sit within six of each other, so the choice of figure does not change the size of the release. This article uses 1,413, the figure in Microsoft's release notes.

How did the count get from 175 to 1,413 in a year?

October's total alone exceeds Microsoft's entire 2020 count of 1,261 CVEs, the previous record year, according to Tenable's Satnam Narang.⁠³ The monthly record had stood at 175 since October 2025 until June 2026 broke it.⁠²

The figures come from Dark Reading,⁠² Krebs on Security⁠⁸ and Security Boulevard.⁠¹ Narang also said 2026 had passed 4,000 Microsoft CVEs with two months left.⁠³ Forecast In June he had predicted that 100-plus CVEs a month would become the norm, and October came in at more than 14 times that figure.⁠² Microsoft vice president Tom Gallagher had warned a month earlier that releases of June's scale could become the new normal, because AI tools find flaws faster.⁠²

How much of the jump came from AI?

Microsoft ties the rise to AI-assisted vulnerability discovery, the use of AI systems to read code and surface flaws, yet the AI-linked tally in its October research post covers about 5% of September's CVEs. Windows executive Pavan Davuluri wrote on 9 July that AI makes it possible to "find more issues, faster, across more code."⁠⁸

Reported Microsoft's FORGE Lab, a group that builds AI systems to hunt for vulnerabilities, says its work led to 140 Windows CVEs between May and September 2026, including 52 in September's release.⁠¹⁰ September's total was 974,⁠¹ which makes FORGE's share about 5%. Microsoft adds that its monthly figures follow announcement dates rather than discovery dates, and the count covers FORGE alone, so AI-assisted work by outside researchers sits outside it.⁠¹⁰

Childs wrote that the flaws already existed and that AI only shortens the time before someone notices them.⁠¹ That places the AI effect on vulnerability detection, the step of finding a flaw, and not on how many flaws exist. Hackread reported that how much AI contributed to October's fixes remains unclear.⁠⁴

No breakdown of October's CVEs by discovery method turned up in this research.

How does a patch list turn into a patch order?

Three terms sort a patch list. CVSS, the Common Vulnerability Scoring System, rates a flaw's technical severity from 0 to 10 and says nothing about whether anyone uses it. KEV is the Known Exploited Vulnerabilities catalog kept by CISA, the US Cybersecurity and Infrastructure Security Agency, and it lists flaws with evidence of active exploitation, meaning attackers are using them in real attacks.⁠¹¹ Microsoft calls a flaw a zero-day when it was exploited or publicly disclosed before a fix shipped.⁠⁵ Each answers a different question: how bad could it be, is anyone using it, and did attackers get a head start.

October shows how far severity and exploitation can diverge. The month's highest scores, 10.0 for Partner Center and 9.9 for Bookings, were cloud-service fixes that required no customer action, while the one flaw with confirmed exploitation, CVE-2026-96951, scored 8.8.⁠⁵⁠⁷ Zero-days exploited before any fix exists push the same logic further, and the article on Citrix and Ivanti zero-day vulnerabilities takes up the same question of which flaws defenders should patch first.

Vulnerability management is the routine of finding flaws in the systems an organization runs, ranking them and fixing them; security remediation is the last step, installing the patch or otherwise closing the flaw. CISA's June directive, BOD 26-04, turned a ranking approach called risk-based vulnerability management, which orders fixes by whether a flaw is exploited, how exposed the asset is and what an attacker gains, into policy for federal agencies. It replaced flat deadlines with four yes-or-no questions: is the asset exposed to the internet, is the CVE in KEV, can an attacker automate every step, and does exploitation give total control.⁠¹²

An internet-facing asset is any system reachable from the public internet, which puts it in the attack surface, the set of points where an attacker can try to get in. Remote code execution (RCE) flaws, which let an attacker run their own code on a machine from elsewhere, are the usual candidates for the total-control question, and they made up 315 of October's CVEs by Splashtop's count.⁠⁹

Reported In an initial analysis at one large civilian agency, CISA found that only 1% of vulnerability instances fell into the three-day tier and more than 60% could wait for the next system upgrade, according to Tenable's summary.⁠¹²

Applied to October's list, the sort runs like this:

1. Start with the 1,413 CVEs on Microsoft's list.⁠¹
2. Check the base rate. Fortra's Tyler Reguly counted 26 Microsoft CVEs in KEV so far in 2026, and Narang counted more than 4,000 Microsoft CVEs; 26 ÷ 4,000 is about 0.65%.⁠³
3. Remove fixes Microsoft applied on its own servers, such as the 10.0 and 9.9 cloud-service scores above.⁠⁵
4. Pull the exploited flaw. CVE-2026-96951, scored 8.8, bypasses Mark of the Web (MotW), the tag Windows attaches to files downloaded from the internet; CISA added it to KEV on 13 October with a federal deadline of 16 October.⁠¹¹⁠⁷
5. Pull the two flaws public before a fix: CVE-2026-108398, a bypass of Windows Defender Application Control (WDAC), the feature that limits which programs may run, and CVE-2026-92707, a denial-of-service flaw (one that can knock a service offline) in MessagePack-CSharp. Neither had known exploitation.⁠⁵
6. Sort the remainder by the question each group raises. Microsoft's example Office "risk cohort," a provisional group of CVEs that raise the same question about a customer's environment, holds 119 CVEs, 23 rated Critical and 17 needing no user interaction. Its shared question is which users and workstations handle untrusted documents or mail.⁠¹³

The order shifts as facts change. A CVE that CISA adds to KEV moves to the top, and Microsoft's cohort post warns that single flaws can still deserve more attention than their group suggests because they are exploited, need no authentication or use a different attack vector. Microsoft labels cohorts exploratory and says they do not replace reviewing each CVE.⁠¹³

What do people commonly get wrong about the record?

Two readings of the record show up in reader comments and forum posts, and each has a documented counterexample.

CISA's own direction has moved the same way. Tenable's summary says BOD 26-04 replaced federal rules that leaned on CVSS and flat KEV deadlines with the four-question model, and CISA's 13 October bulletin describes it as focusing on KEV flaws that give total control of exposed assets.⁠¹²⁠¹¹

Where does counting CVEs stop helping?

Counting stops helping once exploitation, not discovery, sets the pace. Reguly noted that 26 Microsoft CVEs have reached KEV in 2026 so far, against 30 in 2025 and 32 in 2024, and that less than 1% of the CVEs Microsoft patched this year are known to be exploited.⁠⁴

Microsoft's ratings of exploit likelihood can also miss. Krebs reported that Microsoft first rated July's SharePoint zero-day as less likely to be exploited, yet CISA added it to KEV on 1 July. Narang argued that Microsoft's exploitability index, its estimate of how likely attackers are to build a working exploit, is built around human attackers rather than AI tools.⁠⁸

Reported Tenable's summary of CISA's June directive says only 26% of KEV-listed flaws were fully remediated in 2025, down from 38% a year earlier, citing Verizon's 2026 Data Breach Investigations Report, with a median of 43 days to resolve vulnerabilities.⁠¹² Both figures measure the step after vulnerability detection: whether the fix gets installed. Microsoft's FORGE team describes the supply side of the same problem: more candidate bugs add no throughput when the review queue grows faster than fixes ship.⁠¹⁰

Large updates also carry change risk. InfoQ relayed two Reddit reports that the October Windows 11 update broke Wi-Fi sign-in on an enterprise network and a VPN connection on some laptops. InfoQ presented them as user accounts and did not verify them.⁠⁶

What should teams do differently now?

Install the October update on endpoints first for CVE-2026-96951, because it is the only October CVE with confirmed exploitation and its federal deadline passed on 16 October.⁠⁷ Stage the rest of the rollout and watch for regressions, given the user reports above.⁠⁶

• Answer each cohort's environment question once and reuse the answer across its CVEs, treating the idea as an experiment: Microsoft says it is not committing to a product integration.⁠¹³
• Adopt the four-question sort for internal deadlines, starting with a list of your internet-facing assets. CISA encourages all organizations to prioritize KEV flaws and use risk-based vulnerability management, though the directive binds only federal civilian agencies.⁠¹¹
• Opinion Track time from release to installed fix and the share of KEV flaws closed, instead of CVEs counted. Microsoft's FORGE team makes a similar recommendation for AI discovery: count validated fixes, not findings.⁠¹⁰
• Retire systems that no longer receive fixes. Hackread and Splashtop both report that the October update ends security updates for Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016.⁠⁴⁠⁹

Microsoft asked for cohort feedback at CVE@microsoft.com and says responses will inform whether the idea develops.⁠¹³