October 2026's Patch Tuesday brought 1,413 fixed vulnerabilities, the first time Microsoft has topped 1,000 in a month. According to Zero Day Initiative, the figure is larger than the full-year total for any previous year. The question for an IT team is no longer "do we patch?" but "in what order?"
This Month's Numbers
Sources differ on units: Guru3D and TechSpot cite 1,413; Security Affairs, 1,415. We use 1,413, the most repeated figure.
ZDI's Dustin Childs said it is the first Patch Tuesday with more than 1,000 vulnerabilities and that he doesn't like "this new normal." For scale: according to TechRadar, September had already brought nearly a thousand.
Why It's Growing: LLM-Driven Discovery
Coverage ties the jump to Microsoft starting to use language models to scan its own code. The press sums up the point well: the volume reflects how good the tools have become at finding bugs, not necessarily how many of those bugs are a real risk. None of the sources I checked breaks down how many of the 1,413 were found with AI, so that attribution comes from context, not a verified number.
This ties into GTIG's report on AI-found vulnerabilities, which we've already covered: the same models defenders use are used by attackers, and attackers exploit quickly. It should also be said that, according to Security Affairs, vulnerabilities are still being discovered faster than they are exploited.
What to Prioritize
Only one bug is under active attack: CVE-2026-96951, a Windows Shell security feature bypass (Mark of the Web) that requires the user to open a link or attachment. Another, CVE-2026-108398 in .NET, has public details. Other highlights include a SharePoint Server flaw (CVE-2026-102866, CVSS 8.1, unauthenticated elevation of privilege) and a SQL Server one (CVE-2026-65674, CVSS 8.8, deserialization). The 59 wormable flaws deserve attention because of their potential to spread.
Microsoft also introduced "risk cohorts," an experimental grouping of related flaws to make triage easier, noting that grouping does not indicate severity.