Microsoft releases updates for record 1413 vulnerabilities in Patch Tuesday

Microsoft released security updates for its October 2026 Patch Tuesday rollout, fixing between 1,407 and 1,413 vulnerabilities. The CrowdStrike Blog, RapidGold, BigGo Finance, SecurityWeek, Tech-Insider, and The Cyber Express report that 1,413 CVEs were fixed, while GBHackers News reports 1,411 and CSO Online reports between 1,407 and 1,400. The total breaks the previous 2020 record of 1,261 vulnerabilities, according to CSO Online. [1][2][3][4][5][6][8][9][10]

The CrowdStrike Blog and SecurityWeek report that the update includes one actively exploited zero-day vulnerability and two publicly disclosed zero-days. The CrowdStrike Blog, RapidGold, and GBHackers News report that Windows accounts for the majority of the fixes, with figures ranging from 1,102 to 1,123 patches. [1][2][3][8]

According to the CrowdStrike Blog, elevation of privilege flaws make up the largest share of risks with 677 patches, followed by remote code execution with 317 patches and information disclosure with 254 patches. The CrowdStrike Blog also noted 75 critical vulnerabilities and highlighted 23 CVEs across Office applications, such as Excel, PowerPoint, and Visio, that can be triggered through the Preview Pane. [1]

Patch Tuesday is a regular cycle occurring on the second Tuesday of each month, officially established by Microsoft in October 2003. A zero-day refers to a security flaw unknown to developers until a fix is made available. As FTMQ Security reported earlier, the actively exploited zero-day flaw affects the Windows Shell and allows attackers to bypass Mark of the Web security controls. [12][13][16][17]