Microsoft counts 1,453 fixes for October

Microsoft's October security release, published on Tuesday, covers 1,453 Microsoft CVEs, according to the release note in the company's Security Update Guide as it stood on Friday. Windows accounts for 1,105 of them, Office for 164, developer tools for 64, SharePoint Server for 37, SQL Server for 22, Azure for 15 and Exchange Server for seven. One flaw is being exploited.

The counts published on Tuesday were lower, and they differ from each other. BleepingComputer counted 1,411, and CrowdStrike 1,413. BleepingComputer says it counts only vulnerabilities released on Patch Tuesday itself, and that its total excludes 348 flaws fixed earlier in the month in products including Azure services and Exchange Server. CrowdStrike's post does not set out its method, so the two-CVE gap between the trackers is not explained. Microsoft's figure covers the whole monthly release, and its machine-readable data for October, last revised on Friday, includes Microsoft CVEs first published on 14, 15 and 16 October, so the company's own total has grown since Tuesday.

On Microsoft's own release notes, the month is far larger than the two before it: the September note lists 999 Microsoft CVEs and the August note 457, so October is up about 45 per cent on September and about 3.2 times August, by our arithmetic. CrowdStrike's own counts, 972 for September and 415 for August, show a similar step. BleepingComputer called October "record-breaking" and wrote that this came "as Microsoft continues to use artificial intelligence platforms to find and remediate security vulnerabilities in its products." Microsoft's release note does not give a reason for the volume.

The exploited flaw is CVE-2026-96951, a Windows Shell security feature bypass that lets an attacker get around Mark of the Web, the label that flags files downloaded from the internet. Microsoft rates it Important with a CVSS score of 8.8 and lists "Exploitation Detected". BleepingComputer said no details had been shared on how attackers used it; Microsoft's entry, as read on Friday, credits four reporters, including two Fujitsu researchers and one listed as using Anthropic's Claude.

Two more were publicly disclosed before a fix. CVE-2026-108398 is a .NET Framework bypass of Windows Defender Application Control, rated Important at CVSS 8.8 and credited by Microsoft to James Forshaw of Google Project Zero. CVE-2026-92707 is a denial-of-service flaw in the MessagePack-CSharp library, rated Moderate at CVSS 5.3.

By type, both trackers counted 677 elevation-of-privilege flaws, 317 remote code execution flaws and 254 information-disclosure flaws. BleepingComputer counted 70 Critical flaws, 57 of them remote code execution; CrowdStrike counted 75. CrowdStrike highlighted 23 Office CVEs that it said can be triggered through the Preview Pane, without the user opening a file, and 15 unauthenticated network remote code execution flaws in components including DHCP Server, QUIC, the PostScript printer driver and PDF handling. It also listed six cloud-service issues, the highest rated CVSS 10.0, that Microsoft fixed on its side and that need no customer action.

Microsoft also grouped the month's flaws into 15 "risk cohorts", a new presentation explained in a Security Update Guide blog post dated 13 October. According to BleepingComputer, the largest cover Windows filesystems, storage and backup (136 flaws) and Office documents and mail clients (135); Microsoft calls the approach "still experimental" and says the groups do not by themselves show which flaws are most dangerous.

BleepingComputer also reported Microsoft's notice that this is the last update for Windows 11 version 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016. Komposite has followed a run of exploited edge-device flaws, including Citrix's NetScaler fix and Cisco's ninth SD-WAN entry of the year on the federal list of exploited flaws.