Microsoft's October Patch Tuesday broke records with a staggering 1,407 CVEs to be addressed, surpassing the previous high of 1,261 set in 2020. The sheer volume delayed the release, frustrating administrators. Among the vulnerabilities are three zero-days, one of which, CVE-2026-96951, is actively exploited and bypasses Windows Shell protections. This marks the third exploited Windows Shell flaw this year, with 26 such vulnerabilities patched in 2026 alone, a stark increase from previous years.
Another zero-day, CVE-2026-102866, affects SharePoint, allowing unauthenticated attackers to hijack user accounts. The third, CVE-2026-108398, enables bypassing Windows Defender Application Control. Additionally, GitLab issued a critical patch for self-managed instances to prevent arbitrary code execution through malicious regular expressions in CI/CD configurations.
IBM also warned of a critical flaw in its IBM i operating systems, while Atlassian reported exploitation attempts against self-hosted products like Jira and Confluence. Microsoft released four updates for on-premises Exchange Server, each addressing high-severity vulnerabilities. Experts emphasized prioritizing patches based on exploitability rather than sheer volume.
While some commentators labeled the patch count as 'monster,' others argued that the number of vulnerabilities is less meaningful than their exploitability. SAP released 16 new security notes and advisories, rounding out a month of critical updates across major tech providers.