Microsoft shipped fixes for 1,413 vulnerabilities in October. September’s total was 974, which was itself a record at the time. Microsoft is past 4,000 CVEs for the year with two months left.
Microsoft’s own explanation is that it’s using AI to find and fix bugs, and that we should expect more fixes every month from here.
What’s in it
1,102 of them are in Windows. Then 134 in Office, 61 in developer tools, 36 in SharePoint Server, 22 in SQL Server. Counts of how many are rated critical vary between about 70 and 85 depending on who’s counting, and most of those are remote code execution.
Three are zero-days. One was already being exploited: CVE-2026-96951, a Windows Shell bug at CVSS 8.8 that bypasses Mark of the Web, which is the thing that puts the “this came from the internet” warning on a downloaded file. The other two were public before a patch existed, including CVE-2026-108398 in .NET Framework, which gets around Windows Defender Application Control.
Microsoft also introduced “risk cohorts” this month, which group related flaws so you can prioritise. That feature is the interesting part. It only needs to exist because the list stopped being something a person can read.
The bottleneck moved
Finding vulnerabilities used to be the expensive, slow, human-limited half of this. Applying fixes was the easy half. That ratio has flipped and nobody’s deployment process has caught up.
A model can read a lot of code quickly and doesn’t get bored on the four hundredth parser. What it can’t do is stage a patch, reboot a domain controller at 2am, or find out which of your line-of-business apps breaks. Those are the same speed they were in 2015.
So the pipeline now produces findings faster than the other end can absorb them, and the gap shows up as a backlog of known-but-unapplied fixes. Which is exactly the window every incident we’ve written about this month ran through. The Plex chain had a fix available for ten weeks and still caught 49,000 servers inside a day of the exploit going public.
It cuts the other way too
Worth being fair about this. The same capability is available to whoever wants to point it at the same code, and most of these bugs have been sitting there for years waiting for someone to look.
A fixed bug is better than an unfixed one, and 1,413 of them getting closed is genuinely good news, even if the number is alarming to read. The uncomfortable version is that the number reflects what was always there, and we’re only seeing it now because something finally had the patience to look at all of it.
Compare it to the Broadcom WPS flaw, which has been exploitable since 2010 and still has no CVE. Microsoft shipping 1,413 fixes is a vendor whose process works, running at a volume that’s hard to look at. The router in your hallway is a vendor whose process doesn’t, and you can’t see that in any number at all.
What to actually do with this
For a homelab or a small shop, the practical change is that “patch everything promptly” has stopped being a plan. The volume is past the point where a person triages it by reading.
Narrow it to what’s reachable. A CVE in a component nothing can route to is not your emergency, and a CVSS 7 on a service listening on a public address is more urgent than a CVSS 9 on something behind a VPN. Exposure beats severity for ordering the work.
Then get the boring parts automatic. Unattended upgrades for the OS, a container digest you actually bump, something that tells you a service is three versions behind before an advisory does. The goal is to not be reading a 1,413-line list looking for your own software.
And expect this to be the new normal. Microsoft said as much.
Sources: The Hacker News on the 1,413 fixes and the exploited Shell bug, Malwarebytes on the zero-days and Microsoft’s AI statement, Computer Weekly on the yearly trajectory.