Microsoft has set a new record for its Patch Tuesday updates by addressing 1,411 vulnerabilities in Windows 10 and Windows 11. This figure excludes 348 security flaws that the company patched earlier in the month.
The October update package includes 70 critical vulnerabilities. Among these, 57 are identified as remote code execution flaws, 11 relate to privilege escalation, and 2 are classified as spoofing vulnerabilities. The remaining issues cover categories such as information disclosure and denial of service.
The release addresses 3 zero-day vulnerabilities. One of these, CVE-2026-96951, affects the Windows Shell and is currently being exploited to bypass the Mark of the Web security mechanism. The other two, CVE-2026-108398 and CVE-2026-92707, impact .NET Framework and MessagePack-CSharp respectively.
Microsoft has introduced an experimental risk grouping mechanism to assist organizations in prioritizing updates. The October release features 15 such groups, with 136 vulnerabilities categorized under Windows file system, storage, and backup systems.
