---
title: Microsoft fixes 1,411 vulnerabilities in October updates for Windows 10 and Windows 11
url: https://www.dataloco.com/en/microsoft-fixes-1411-vulnerabilities-in-october-updates-for-windows-10-and-windows-11
published: 2026-10-16T18:20:31+00:00
language: en
section: Security
source: https://www.ithome.com/1/012/661.htm
organizations: bleepingcomputer, cve, win10, win11, windows
publisher: Dataloco
---

# Microsoft fixes 1,411 vulnerabilities in October updates for Windows 10 and Windows 11

On October 14, a technology media outlet reported that during this month's Patch Tuesday event on October 13, Microsoft fixed a total of 1,411 vulnerabilities in updates for Windows 10, Windows 11, and other system products. This figure breaks the record for the most vulnerabilities fixed in a single Patch Tuesday, and it does not include the 348 vulnerabilities that were fixed earlier this month.

The updates released by Microsoft in October 2026 mainly addressed various types of vulnerabilities, including 677 privilege escalation vulnerabilities, 40 security feature bypass vulnerabilities, 317 remote code execution vulnerabilities, 254 information disclosure vulnerabilities, 73 denial of service vulnerabilities, and 28 spoofing vulnerabilities. Among these updates, there were 70 classified as "critical" vulnerabilities, with 57 being remote code execution vulnerabilities.

Additionally, Microsoft patched three zero-day vulnerabilities in this update. The vulnerability identified as CVE-2026-96951 is a Windows Shell security feature bypass that has been actively exploited by attackers, allowing them to bypass the "Web Markup" security mechanism. Microsoft has not disclosed the details of the exploitation or the identity of the discoverer. The other two zero-day vulnerabilities were publicly disclosed. CVE-2026-108398 affects the .NET Framework and allows unauthorized applications to run bypassing Windows Defender Application Control, while CVE-2026-92707 affects MessagePack-CSharp and can be used to initiate denial of service attacks.

Microsoft has introduced a "risk group" mechanism in this update, categorizing related vulnerabilities into the same risk category to help organizations prioritize their remediation efforts. The October update included 15 risk groups, with 136 vulnerabilities related to Windows file system, storage, and backup. Microsoft emphasized that the risk group is intended for sorting purposes only and does not directly represent the severity of the vulnerabilities. The actual risk depends on factors such as whether vulnerabilities are being exploited, their severity, and the organization's software usage. This mechanism remains an experimental feature.

## This story in other languages

- [Русский](https://www.dataloco.com/ru/microsoft-ispravila-1411-uiazvimostei-v-windows-10-i-windows-11)
- [Svenska](https://www.dataloco.com/sv/microsoft-satter-nytt-rekord-med-1-411-atgardade-sarbarheter-i-oktoberuppdateringar)