In its October update cycle, Microsoft addressed more than 1,400 security flaws—a milestone that exceeds the 1,261 vulnerabilities patched throughout all of 2020, previously the company's highest annual count. The patches arrived on 13 October, according to reporting by Krebs on Security. This month's volume dwarfs September's nearly 1,000 fixes, which itself represented roughly ten times Microsoft's typical monthly remediation rate.
The year-to-date tally has grown substantially. "We've now crossed the 4,000 CVE mark with two months left to go," Satnam Narang of Tenable told Brian Krebs. Among October's fixes, at least 78 carry critical severity ratings, meaning they could allow attackers to execute arbitrary code on vulnerable systems.
Active exploitation already underway
One vulnerability has already become a target for attackers. CVE-2026-96951 affects the Windows Shell and enables circumvention of Mark of the Web, a Windows security mechanism that applies additional scrutiny to files originating from the internet. Microsoft classified this flaw as Important with a CVSS score of 8.8.
The vulnerability requires user interaction to exploit. An attacker would typically distribute a specially crafted file via email or messaging platforms, or direct users to a malicious website. The victim must then open the file for the attack to succeed. The patch addresses the issue across Windows 10, Windows 11, Windows Server and Outlook.com.
Microsoft acknowledged researchers Riku Bamba and Yuya Chudo from Fujitsu, a researcher identified as yhw, and Benoit Sevens, who is listed as "using Claude with Anthropic" in the advisory. The company has disclosed neither the identity of the attackers nor their targets.
A separate flaw in the .NET Framework had already become public before Microsoft released its fix, potentially giving threat actors additional time to develop exploits. However, Microsoft stated it has detected no active attacks against this vulnerability to date.
AI models driving vulnerability discovery
Microsoft attributes the sharp increase in discovered flaws to large language models. The company previously indicated that AI systems identified the vulnerabilities behind July's record patch release. This trend continued into October, with Bank of America's chief executive revealing this week that the financial institution has deployed 1,000 contractors to remediate flaws that AI has uncovered.
Strain on security operations
Security researchers caution that patch volumes of this magnitude create significant operational challenges for corporate security teams. Many organizations conduct testing on each update before deployment across their infrastructure.
Tyler Reguly of Fortra advised prioritizing the 26 Microsoft vulnerabilities that have entered the US government's official catalogue of exploited flaws so far this year. "Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act," Reguly said.
Source: The Next Web
