Microsoft patches more than 1,400 Windows security flaws
Microsoft's October security release fixes more than 1,400 flaws, including an exploited Windows Shell bypass and dozens of critical vulnerabilities.
Microsoft has issued its October security updates, fixing more than 1,400 vulnerabilities across Windows and other software, according to Krebs on Security. The unusually large release includes a Windows Shell security-feature bypass that is listed as exploited in the wild. 1
Why this patch batch matters
The reported total is far above September's already exceptional release of nearly 1,000 fixes. The Microsoft Security Response Center's update guide identifies the Windows Shell issue as CVE-2026-96951, affecting Windows 10, Windows 11 and some Windows Server versions. 2
Microsoft's own Windows 11 bulletin confirms that the October 13 cumulative update is available for current Windows 11 branches, including versions 24H2, 25H2 and 26H2. 3 The bulletin also points administrators towards Microsoft's Security Update Guide for vulnerability details.
Krebs on Security reports that at least 78 of the month's flaws are rated critical, with many allowing code execution. It also says CVE-2026-96951 is the month's zero-day, while a separate .NET Framework vulnerability, CVE-2026-108398, was publicly disclosed before the fixes arrived. 1
What Windows users should do
Install the applicable October updates through the normal Windows servicing route, then check Microsoft's Security Update Guide for the products and CVEs relevant to your organisation. Home users should keep automatic updates enabled; businesses should prioritise vulnerabilities known to be exploited and test large update batches against critical software.
The size of this month's release is a useful reminder that counting CVEs is less important than identifying which flaws are exploitable in a particular environment. Microsoft's bulletin provides the installation details, while the Security Update Guide is the better place to map individual fixes to affected products. 23
Our opinion
A four-figure patch count sounds alarming, but the practical message is simpler: do not wait for a quieter month. The exploited Windows Shell flaw deserves immediate attention, while administrators should use Microsoft's product-specific guidance rather than treating every CVE as equally urgent. The volume also makes a strong case for better asset inventories and staged testing — not for skipping the updates altogether.