Microsoft’s October Patch Tuesday fixes a record ~1,400 flaws, more than all of 2025, as AI-driven bug discovery floods vendors
Partly confirmed
The takeaway
Microsoft’s October 13, 2026 Patch Tuesday fixed more than 1,400 vulnerabilities (1,411 per BleepingComputer, 1,413 per SecurityWeek), beating September’s record of nearly 1,000.
Status
- Claim
Partly confirmed
- Our reporting
- Medium confidence
- Importance
- 3 of 5
- Last verified
- 14 October 2026
Your AI and this story
- GPT-6 Astra166 days after its cutoff
- Claude Opus 5.5105 days after its cutoff
- Gemini 4 Argon196 days after its cutoff
- Grok 4.7135 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 105 days before it.
Key facts
- Counts: 1,411 (BleepingComputer) / 1,413 (SecurityWeek) / ‘more than 1,400’ (Krebs). SecurityWeek breakdown: 1,102 Windows, 134 Office, 61 developer tools, 36 SharePoint Server. BleepingComputer: 70 rated Critical (57 RCE)
- Previous record: September 2026, nearly 1,000 fixes (Krebs). SecurityWeek: ‘This month alone, Microsoft patched more vulnerabilities than it did in all of 2025’; 2026 has passed 4,000 fixed flaws. Tenable’s Satnam Narang compares this with 2020’s full-year 1,261 CVEs (via Krebs)
- AI attribution: Krebs says ‘Microsoft credits large language models for the high volume of bug discovery’; BleepingComputer: ‘Microsoft continues to use artificial intelligence platforms to find and remediate security vulnerabilities in its products’. Neither names specific models or programmes (e.g. Project Glasswing), and we did not find Microsoft’s own wording
- Exploited zero-day: CVE-2026-96951 (CVSS 8.8), a Windows Shell security-feature bypass that evades Mark of the Web; SecurityWeek says it was reported by researchers at Fujitsu, Anthropic and an independent expert. CISA added it to KEV with an Oct 16 deadline for federal agencies
- Two more publicly disclosed zero-days: CVE-2026-108398 (.NET Framework WDAC bypass, found by James Forshaw of Google Project Zero) and CVE-2026-92707 (MessagePack-CSharp denial of service)
- Background: in April 2026 MSRC wrote that recent models paired with security tooling find vulnerabilities ‘at a level approaching experienced human security researchers’ and that it was changing its processes accordingly
What happened
Microsoft’s monthly security update for October 2026 was the largest on record, at roughly 1,400 CVEs, after September’s update had already set a record of nearly 1,000. Security press attribute the surge to AI-assisted vulnerability discovery, and Krebs reports that Microsoft itself credits LLMs. Outlets give slightly different totals depending on how they count third-party and non-Windows CVEs.
Why it matters
It is a concrete measure of the “vulnerability flood” that defenders have warned about since models such as Claude Mythos and GPT-6 Astra crossed into expert-level bug finding: one vendor fixed more flaws in a month than in all of the previous year. Every one of these patches also tells attackers where the bugs were (Alex Stamos’s “Patch Tuesday, Ransom Wednesday” warning).
Sources
4 sources from 4 sites. Numbers match the chips in the text.
4 sources: 1 primary, 3 press
Primary
- MSRC (April 2026): Strengthening secure software at global scale: how MSRC is evolving with AImicrosoft.com, official
Press
- Krebs on Security: Microsoft patches more than 1,400 security flawskrebsonsecurity.com, press
- SecurityWeek: Microsoft patches record 1,413 vulnerabilities including exploited Windows zero-daysecurityweek.com, press
- BleepingComputer: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-daysbleepingcomputer.com, press
Changes
- Filed (Krebs, SecurityWeek, BleepingComputer read; Microsoft’s own statement not located)