Microsoft's October 2026 Patch Tuesday was the largest on record. It was also the second consecutive month to set that record, which is the more interesting half of the sentence.
How large, exactly, depends on who you ask:
| Source | CVEs counted |
|---|---|
| Tenable | 1,407 |
| BleepingComputer | 1,411 |
| TechRepublic | 1,413 |
| TrinetriOps | 1,461 |
Four organisations, all of which do this professionally every month, counted the same release and published four different totals. The spread between the lowest and the highest is 54 CVEs.
Fifty-four is larger than an entire Patch Tuesday was a few years ago.
This is not carelessness
It is worth being clear that nobody here is being sloppy. The discrepancy is structural, and it comes from the fact that "a Patch Tuesday" has never had an agreed boundary.
The judgement calls include: whether to count Microsoft Edge, which ships on its own cadence. Whether to count Chromium CVEs that Edge inherits and Microsoft republishes. Whether to include Azure components, Mariner, Dynamics, and the growing list of cloud services that Microsoft now issues CVEs for even when the customer has nothing to install. Whether an advisory with no patch counts as a fix. Whether a republished third-party CVE counts once or not at all.
Each of those is a defensible choice. At forty CVEs a month, the choices moved the total by two or three and nobody cared. At fourteen hundred, they move it by fifty-four.
The consequence for anybody using the number
Any sentence of the form "Microsoft patched N flaws this month" is now a statement about counting methodology, not about Microsoft.
That matters in a specific, practical way. Security teams track this number over time. Boards see it in quarterly reports. "Patch volume is up 40 percent year on year" is a sentence that gets used to justify headcount, and it is only true if the same boundary was applied at both ends of the comparison.
If your reporting pulls from one of these sources, keep pulling from the same one. If it changed, your trend line has a step in it that has nothing to do with Microsoft.
The deeper point is that the metric has outgrown its usefulness. A count of CVEs tells you almost nothing about work. One of those 1,411 is a zero-day under active attack in a component on every desktop you own. Another is a Dynamics 365 issue that Microsoft fixed in its own cloud before anybody read the advisory. Counting them together produced a usable signal when the number was small and produces noise now.
The one that matters this month
CVE-2026-96951 is a Windows Shell flaw that bypasses Mark of the Web, the mechanism that tags files downloaded from the internet so that Office and SmartScreen treat them with suspicion. It is under active exploitation.
Mark of the Web bypasses are a recurring category because the control sits underneath a great deal of user-facing safety behaviour. If the tag is missing, a downloaded document opens without the protected view that would otherwise have stopped a macro. It is a small flaw that quietly removes a layer other defences assume is there.
CISA added it to the exploited vulnerabilities catalogue on 13 October with a three-day deadline, which is the shortest kind of deadline the catalogue issues and a thing we wrote about separately this week.
Reports differ on the other two zero-days in the release. One names CVE-2026-108398, a .NET Framework security feature bypass involving an untrusted search path.
What is not established
- The correct total. We did not tally Microsoft's update guide ourselves, and doing so would settle it.
- What each of the four sources includes and excludes. None of them published its boundary alongside the number.
- Whether Microsoft publishes an authoritative figure anywhere.
- Which two of the three zero-days were publicly disclosed before patching; sources conflict.
- Whether September's record used the same counting method as October's, which matters if you are citing two consecutive records.
