On 13 October 2026, Microsoft released patches for 1,411 vulnerabilities. The company has now set a monthly record for five consecutive months. Three of the issues are zero-days, and one is already being exploited. Seventy vulnerabilities are critical. The group includes 57 remote code execution flaws. Eleven are privilege escalation flaws. Two are spoofing flaws.

Bleeping Computer counted only vulnerabilities fixed by the Tuesday evening updates. The total excludes 348 issues patched earlier in October. Those fixes covered Azure API Center, Azure App Service, Azure Event Grid, Azure SRE Agent, Mariner, Microsoft Bookings, Dataverse, Exchange Server and Partner Center.

CVE-2026-96951 is the most urgent case. It has a CVSS score of 8.8 and enables command injection through Windows Shell. An attacker can use it to bypass Mark of the Web, the security label attached to files downloaded from the internet. Microsoft has not identified the discoverer.

CVE-2026-108398 affects security features in .NET Framework. An authorized attacker can exploit an unsafe search path to bypass Windows Defender Application Control, or WDAC, and launch unauthorized applications without user interaction. The issue is rated 8.8 by CVSS and was found by James Forshaw of Google Project Zero.

CVE-2026-92707 has a CVSS score of 5.3. Uncontrolled sequential memory allocation in .NET lets an unauthorized attacker cause a network denial of service. Microsoft has not disclosed who found it. The critical issues and the exploited vulnerability make rapid installation advisable. Applying the fixes requires a machine restart.

Microsoft attributes the rising patch volume partly to AI-based security work. The company introduced MDASH, short for Microsoft Security multi-model agentic scanning harness, in May. In July, Project Perception began using MDASH, the MAI-Cyber-1-Flash model and other models. Microsoft has since claimed a leading position in vulnerability discovery.

September’s release came close to 1,000 fixes. October adds roughly 450 more. The same pattern is appearing at Apple and in open-source projects. Linux kernel 7.3 release candidates have been unusually large, with extensive fix lists, and Linus Torvalds regularly uses Claude for fixes and other improvements.