Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)

69Critical1337Important0Moderate1LowMicrosoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, marking the second consecutive month to reset the bar as the largest Patch Tuesday release. This month’s updates include patches for two zero days, including one that was exploited in the wild.Microsoft patched 1,407 CVEs in its October 2026 Patch Tuesday release, with 69 rated critical, 1,337 rated as important, and one rated as low.This month’s update includes patches for 301 products and components. The following table lists the products with the most CVEs patched this month. A full list of patched products is available in the appendix.RankProductCVE Count1Microsoft Office Excel692Role: DNS Server523Windows Kernel464Windows Installer385Windows Win32 Kernel Subsystem366Microsoft Office SharePoint347Microsoft Windows Search Component298Windows NTFS269.NET2510 (Tie)Microsoft Office Word2210 (Tie)SQL Server2210 (Tie)Windows Error Reporting22Elevation of Privilege (EoP) vulnerabilities accounted for 47.9% of the vulnerabilities patched this month, followed by remote code execution (RCE) vulnerabilities at 22.3%.ImportantCVE-2026-96951 | Windows Shell security feature bypass vulnerab…

≈