There Are Over 1,400 (Known) Security Vulnerabilities in Your PC—Here’s How to Fix Them.
The number of bugs Microsoft patched as part of its monthly Patch Tuesday update has been steadily increasing since early summer, and October was no exception. The company just released patches for a record 1,411 vulnerabilities, including three zero-day vulnerabilities—vulnerabilities that were actively exploited or publicly disclosed before the official patch was released, making them particularly dangerous.
By comparison, in October 2025, Microsoft released patches for fewer than 180 vulnerabilities , six of which were zero-days, which was considered a major update at the time. The number of patches typically remained in the double digits until mid-year, when the total jumped to 206 (June), 570 (July), 400 (August), and 966 (last month). This dramatic increase is largely due to artificial intelligence models , which make it easier for attackers to develop exploits and for companies to discover and patch these vulnerabilities more quickly. This means update cycles are shortened and/or include significantly more patches. Companies like Microsoft use AI to detect and fix bugs, although AI is not as good at the latter and, in some cases, can create additional vulnerabilities in the process .
The October Patch Tuesday update fixed 1,411 vulnerabilities, including three zero-day vulnerabilities.
As reported by BleepingComputer , the October 2026 security update addresses vulnerabilities in the following categories: 677 privilege escalation vulnerabilities, 40 security feature bypass vulnerabilities, 317 remote code execution vulnerabilities, 254 information disclosure vulnerabilities, 28 spoofing vulnerabilities, and 73 denial of service vulnerabilities. Seventy of these vulnerabilities are rated “critical” and include remote code execution, privilege escalation, and spoofing vulnerabilities. Earlier this month, Microsoft fixed an additional 348 bugs in various Azure, Mariner, and Microsoft products.
One of the zero-day vulnerabilities patched this month is being actively exploited by attackers. CVE-2026-96951 is a security feature bypass vulnerability in the Windows shell that allows attackers to gain unauthorized access over the network. Microsoft did not provide details about who reported this vulnerability or how it was exploited.
Two other zero-day vulnerabilities have been disclosed. CVE-2026-108398 is a security feature bypass vulnerability in the .NET framework that allows attackers to bypass Windows Defender application control restrictions and run unauthorized applications without user interaction. James Forshaw of Google Project Zero is believed to have authored this vulnerability. Finally, CVE-2026-92707 is a denial of service vulnerability in MessagePack-CSharp, authored by an anonymous source.
You should update your computer as soon as possible.
PC users should ensure they download and install all security updates as soon as they become available. Patch Tuesday updates are typically released on the second Tuesday of each month around 10:00 AM Pacific Time and should install automatically. However, given the increased risk, it is recommended to check your computer’s update status via Start > Settings > Windows Update > Check for Windows updates .