{"id":26310,"date":"2026-10-13T17:00:27","date_gmt":"2026-10-14T01:00:27","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/10\/13\/microsoft-patches-more-than-1400-security-flaws\/"},"modified":"2026-10-13T17:00:27","modified_gmt":"2026-10-14T01:00:27","slug":"microsoft-patches-more-than-1400-security-flaws","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2026\/10\/13\/microsoft-patches-more-than-1400-security-flaws\/","title":{"rendered":"Microsoft Patches More Than 1,400 Security Flaws"},"content":{"rendered":"

Microsoft<\/strong> today issued updates to fix more than 1,400 security vulnerabilities in its Windows<\/strong> operating systems and other software. Today\u2019s epic patch batch dwarfs September\u2019s record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond.<\/p>\n

\"\"<\/p>\n

Just one of the weaknesses patched this week is considered a \u201czero day,\u201d or already exploited in the wild. CVE-2026-96951<\/a> is a security feature bypass in the Windows Shell<\/strong> that affects Windows 10 and 11 systems, as well as some Server versions.<\/p>\n

Windows 10 users might be wondering if they can still expect security updates after this month. Microsoft had been slated to stop shipping updates for Windows 10 systems in October 2025, but ended up adding another year of free updates after considerable pushback. A few months ago, Microsoft quietly extended that support<\/a> for another year (until October 2027).<\/span><\/p>\n

At least 78 of the flaws fixed this month are rated \u201ccritical,\u201d meaning they could be exploited with little or no action by the user, and most of those critical bugs allow an attacker to execute code of their choice on the vulnerable system.<\/p>\n

While Microsoft said there are no signs anyone is exploiting it yet, a security feature bypass in the .NET Framework (CVE-2026-108398<\/a>) was publicly disclosed prior to today, potentially giving attackers advance time to work out how to exploit the bug.<\/p>\n

Satnam Narang<\/strong> at Tenable<\/strong> said the number of flaws fixed this month far surpasses the previous record-setting year 2020, when Microsoft patched 1,261 CVEs.<\/p>\n

\u201cWe\u2019ve now crossed the 4,000 CVE mark with two months left to go,\u201d he said.<\/p>\n

Microsoft credits large language models for the high volume of bug discovery, and presumably AI gets credit for many of the patches used to fix these flaw. Meanwhile, security experts have been warning that these unusually large patch volleys from Microsoft are placing extra strain on corporate security teams, which often have to test individual updates before deploying them across a network to ensure the fixes don\u2019t cause problems for other software.<\/p>\n

Tyler Reguly<\/strong>, associate director of security research and development at Fortra<\/strong>, notes that just 26 Microsoft vulnerabilities appeared in the \u201cKnown Exploited Vulnerabilities\u201d (KEV) catalog maintained by the U.S. Cybersecurity & Infrastructure Security Agency (CISA) so far this year, and security teams would do well to prioritize patching those 26 vulnerabilities first.<\/p>\n

\u201cSecurity leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act,\u201d Reguly said.<\/p>\n

Which vulnerabilities deserve the most scrutiny in your organization? The folks at Cisco Talos<\/strong> have a useful roundup<\/a> of the more noteworthy flaws that Microsoft fixed today, and of course the SANS Internet Storm Center<\/strong> has a reliable roundup<\/a> that indexes vulnerabilities by severity, CVE number and affected software.<\/p>\n","protected":false},"excerpt":{"rendered":"

Microsofttoday issued updates to fix more than 1,400 security vulnerabilities in itsWindowsoperating systems and other software. Today\u2019s epic patch batch dwarfs September\u2019s record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond.Just one of the weaknesses patched this week is considered a \u201czero day,\u201d or already exploited in the wild.CVE-2026-96951is a security feature bypass in theWindows Shellthat affects Windows 10 and 11 systems, as well as s<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10642],"tags":[],"class_list":["post-26310","post","type-post","status-publish","format-standard","hentry","category-krebs"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=26310"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26310\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=26310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=26310"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=26310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}