14 OCT 2026 — Microsoft's October security update fixed 1,411 vulnerabilities, the most it has ever released on a single Patch Tuesday, according to BleepingComputer's count. On the same day, the company published a proposal acknowledging that releases of this size are hard for some customers to prioritise, and suggesting a different way to sort them.
One of the flaws, in Windows Shell, was already being exploited. Two more had been publicly disclosed before a fix was available.
A record, depending on how you count
BleepingComputer's tally of 1,411 counts only flaws released on 13 October. It excludes 348 fixed earlier in the month, in services including Azure, Exchange Server and Microsoft Bookings. Microsoft's own machine-readable release data for October lists 1,759 vulnerabilities once those earlier fixes are included. Totals for the same month regularly differ between trackers, as they did in August.
Whichever number is used, the scale is new. Elevation-of-privilege bugs make up almost half of BleepingComputer's total, at 677, followed by 317 remote code execution flaws. About 70 are rated Critical.
The flaw already under attack
CVE-2026-96951 lets an attacker get past Mark of the Web, the Windows label that triggers extra warnings for files downloaded from the internet. According to Microsoft's advisory, an attacker would send a specially crafted file by email or instant message and would need to persuade the user to open it. Microsoft marks the flaw as exploited but has not said who used it or against whom.
Microsoft credits three reporters, one of whom is listed as Benoît Sevens "using Claude with Anthropic".
The two publicly disclosed flaws are a .NET Framework bug that can bypass Windows Defender Application Control, credited to James Forshaw of Google Project Zero, and a denial-of-service flaw in the MessagePack-CSharp library.
Microsoft's answer to the volume
In a blog post the same day, Microsoft's Security Response Center wrote that "as security update packages address more CVEs", customers with complex environments face the familiar problem of deciding which vulnerabilities need attention first.
It suggests grouping vulnerabilities into what it calls risk cohorts: sets of CVEs that raise the same question about a customer's own environment, even if they share no root cause or severity score. The post gives 15 examples, from Office documents and mail clients to remote access, where the shared question is which RDP client, gateway and server roles an organisation actually runs and exposes.
What the proposal is not
Microsoft is careful to say what the cohorts are not. They "are not official Microsoft vulnerability categories, do not change Microsoft update guidance, and do not replace the assessment of individual CVEs," the post says, and the company is not committing to build them into its Security Update Guide.
What administrators should do now
Patch the exploited Windows Shell flaw first. It only needs an attacker to talk a user into opening a file. Organisations still on Windows 11 version 24H2 Home or Pro should note that, according to Microsoft's lifecycle page, this month's update is the last that version will receive.
Microsoft's post is a fair summary of the wider problem. Finding and fixing flaws has sped up faster than most organisations can test and deploy the fixes, so the burden of choosing what to do first has shifted to them.
Disclosure: RECATOOLS is written with the assistance of Claude, made by Anthropic, whose researcher is credited, using Claude, with reporting the exploited flaw. Readers should weigh that interest.
View author profile → · Editorial policy
