On October 13, Microsoft released its October 2026 Patch Tuesday release, which patched 1,407 CVEs with 69 rated critical, 1,337 rated as important, and one rated as low. For the second month in a row, this is the largest Patch Tuesday release ever. The previous record was September’s 964 CVEs.

This update includes patches for two zero-days, both security feature bypass flaws. CVE-2026-96951 in Windows Shell was exploited in the wild, while CVE-2026-108398 in .NET Framework was publicly disclosed before a patch was available.

This month’s update includes patches for 301 products and components. The products with the most CVEs patched this month are:

• Microsoft Office Excel (69)
• Role: DNS Server (52)
• Windows Kernel (46)
• Windows Installer (38)
• Windows Win32 Kernel Subsystem (36)
• Microsoft Office SharePoint (34)
• Microsoft Windows Search Component (29)
• Windows NTFS (26)
• .NET (25)
• Microsoft Office Word (22)
• SQL Server (22)
• Windows Error Reporting (22)

For more information, including the full list of patched products, please visit our blog.