Microsoft released a record-setting security update on Tuesday, Oct. 13, addressing more than 1,400 vulnerabilities across its products, including an actively exploited Windows zero-day.
The Windows Shell flaw, tracked as CVE-2026-96951, can bypass a security feature designed to flag files from untrusted sources. Microsoft said the vulnerability was already being exploited when it issued the fix, making it an urgent concern for organizations running affected Windows systems. The update also addresses weaknesses in Office, developer tools, SharePoint Server and other Microsoft products.
Windows accounted for most of the reported issues, with more than 1,100 vulnerabilities, while Office had more than 130, according to one security analysis. The release surpasses Microsoft’s previous monthly patch records and exceeds the 1,261 vulnerabilities it fixed across all of 2020, according to CyberScoop. The unusually large volume follows a series of expanding monthly patch releases this year.
Microsoft has pointed to AI-assisted security work as one factor behind the increase, while security researchers say the growing flood of fixes puts additional pressure on teams to assess and deploy updates. The record total is striking, but the actively exploited Windows flaw stands out as a particularly pressing risk for users and administrators.