Microsoft Patched 1,413 CVEs in One Day. The Count Is the Wrong Number to Watch

Microsoft's October 2026 Patch Tuesday, released on 14 October, carried 1,413 CVEs according to CyberScoop and CrowdStrike. CyberScoop reports that this is more than the 1,261 CVEs Microsoft patched in its previous record year, 2020, so a single monthly release now exceeds any full year before it. The headline invites a simple reading: Windows is getting less secure. The data points the other way. Across August, September and October, Microsoft's monthly CVE count rose from 415 to 972 to 1,413, while the number of vulnerabilities exploited before a patch existed went 1, then 2, then 1. The count has stopped measuring risk, and this piece explains why and what to watch instead.

The numbers, and a caution about them

No two trackers agree on the exact total. BleepingComputer's headline says 1,411 flaws, PDQ counts 1,414, and CyberScoop and CrowdStrike both say 1,413. The differences reflect how each outlet treats republished third-party flaws and how they read Microsoft's release notes. We use 1,413 because two independent sources match on it, and we treat every count in this article as accurate to within a few CVEs.

Product breakdowns are even less tidy. CyberScoop lists Windows at 1,102, Office at 134, developer tools at 61 and SharePoint Server at 36, which adds up to 1,333, leaving 80 CVEs unaccounted for in that list. CrowdStrike's family counts (Windows 1,123, Extended Security Updates 977, Office 179) add up to more than the total because a single CVE can affect several products. The practical lesson is that the headline number is an index of Microsoft's disclosure activity, not a count of distinct problems a given organisation must fix.

Count tripled; exploitation did not

CrowdStrike's monthly table gives the comparison most coverage skipped. August 2026 had 415 CVEs, one exploited zero-day and 62 critical-rated flaws. September had 972, two exploited and 113 critical. October had 1,413, one exploited and 75 critical. October's total is 3.4 times August's and 1.45 times September's. Over the three months there were 2,800 CVEs and four exploited zero-days, about 1.4 exploited flaws per 1,000 CVEs. In October the ratio was about 0.7 per 1,000; in August it was about 2.4 per 1,000. The critical share fell from roughly 15% in August to 12% in September and 5% in October.

Those ratios are our arithmetic from CrowdStrike's published figures, and three data points are a thin series, so we do not claim a trend. What the data does show is that a tripling of volume was not accompanied by a tripling of in-the-wild exploitation. Microsoft's own zero-day tally points the same way: Dustin Childs of TrendAI's Zero Day Initiative told CyberScoop that Microsoft had 15 zero-days between January and October 2026, against 17 in the same period of 2023. That comparison comes from a single source and we attribute it to him throughout.

Why the count rose: discovery, not exploitation

Childs's explanation, as CyberScoop reports it, is that AI is shortening the time between a flaw existing and someone finding it. That is a statement about discovery speed. A vulnerability counted in October may have been sitting in code for years. Finding more of them faster raises the CVE count immediately, because each finding generates a number, while exploitation depends on a separate step: an attacker has to turn a flaw into a working attack and deploy it. Discovery can scale with tooling in a way that weaponisation, which needs reliable reproduction and a delivery path, does not. When the first runs ahead of the second, counts rise and incident counts do not.

The limit of what the source says matters. CyberScoop attributes the AI point to one analyst and describes AI as partly responsible; it does not report that Microsoft's 1,413 CVEs were found by AI systems. We have not seen Microsoft say how many were. Treat the AI explanation as an informed expert hypothesis, and keep the observable facts separate: the count is high, discovery is faster, and exploitation has not tracked it.

The exception: Windows Shell

The month's one exploited flaw, CVE-2026-96951, is in Windows Shell. CrowdStrike scores it 8.8 and Microsoft rates it Important. PDQ's analysis says it strips the Mark of the Web from downloaded files, so protections that depend on that marker, including SmartScreen warnings, Protected View and macro blocking, do not fire. It still requires a user to open the file. Satnam Narang of Tenable told CyberScoop it is the third Windows Shell flaw exploited this year, and that 26 Windows Shell vulnerabilities have been patched through October 2026, against three in 2025 and one each in 2024 and 2022.

This is where raw counts hide real information. A rise from three Shell patches to 26 in a year is a concentration, and three exploited ones out of 26 is a hit rate of roughly 12%. That is a far more useful signal for a defender than the aggregate count, because it identifies a component attackers are actively working. Two other items this month were publicly disclosed but not known to be exploited: a .NET Framework security feature bypass (CVE-2026-108398) and a MessagePack-CSharp denial-of-service flaw (CVE-2026-92707). CrowdStrike counts all three as zero-days, while CyberScoop's single exploited zero-day counts only the first. Definitions differ, so check which one a source uses before comparing years.

What to triage instead of the count

If the headline total is not the risk measure, something else has to be. Microsoft's answer this month is a feature it calls risk cohorts, which group vulnerabilities that may not share a root cause or severity score but call for a similar assessment by customers, based on questions about their own environment. That is a vendor tool, described in vendor terms, and we have not seen independent evidence yet of how well it prioritises. It is a reasonable idea, but it is Microsoft's own framework for Microsoft's own disclosures.

Independent analysts point toward exposure-based triage. CrowdStrike highlights 23 Office flaws that can be triggered just by previewing a file, 15 unauthenticated network remote-code-execution flaws across DHCP Server, QUIC, the PostScript printer driver and PDF handling, five critical Outlook flaws rated 9.8 of which two work through the Reading Pane, and a critical Active Directory Domain Services flaw, CVE-2026-70229, which PDQ advises prioritising on domain controllers. Those categories share a property: they need little or no user interaction or reach across a network. A sensible order for a small IT team is exploited flaws first, then pre-authentication network flaws, then no-click document flaws, then identity infrastructure, and the rest on the normal cycle.

The counter-argument: volume is a cost in itself

A fair objection is that low exploitation today does not make high volume harmless. Every patch must be tested and deployed, and the work scales with count even when the risk does not. Exploitation also lags disclosure: once a patch ships, attackers can study what changed, so a month with 1,400 fixes may produce more attacks in the following weeks than the month itself did. Childs's own remark, per CyberScoop, that the solace is that only one flaw is under active attack, acknowledges the burden without disputing the point. The fair summary is that the count measures workload and disclosure speed, and exploitation measures danger, and defenders need to keep the two columns separate. We covered the September release's triage framing earlier; this month shows the same logic at a larger scale.