Microsoft's October Patch Tuesday Sets a Record, but Outlets Count 1,411 and 1,413 CVEs

Microsoft's October 13 Patch Tuesday fixed a record number of flaws, and the outlets counting them cannot agree on how many: BleepingComputer reports 1,411, Splashtop reports 1,413, and the category figures BleepingComputer prints add up to 1,389.

Only one flaw is marked as exploited by either outlet: Windows Shell CVE-2026-96951, a Mark of the Web bypass. BleepingComputer counts three zero-days and Splashtop counts two.

What the October 2026 Patch Tuesday counts disagree on

BleepingComputer, in a report by Lawrence Abrams, calls its totals approximate and says they exclude 348 flaws fixed earlier in October that appear in its full table. Splashtop cites 1,413 CVEs from Microsoft's release notes, a product-family table that totals 1,414 across 176 updates, and a published CVE list of 1,411.

Measure	BleepingComputer	Splashtop
Headline total	1,411	1,413
Critical	70	78
Zero-days	3	2

Splashtop puts September's total at 974, so a count of 1,413 is roughly 45% higher. BleepingComputer attributes the volume to Microsoft's continued use of AI platforms to find and fix vulnerabilities. Splashtop does not offer a cause.

Three zero-days, one of them exploited

The label depends on the definition. CVE-2026-96951 in Windows Shell is rated Important and has exploitation detected. CVE-2026-108398, a .NET Framework security feature bypass, is publicly disclosed but not exploited, and BleepingComputer credits its discovery to James Forshaw of Google Project Zero. Splashtop describes it as letting an authenticated attacker bypass Windows Defender Application Control and run code in a protected process.

The third entry in BleepingComputer's table, CVE-2026-92707, is a denial of service in MessagePack-CSharp rated Moderate and publicly disclosed. Neither outlet prints CVSS scores for any of the three.

The score cannot settle this either way. Splashtop describes the Shell flaw as getting around Mark of the Web warnings on downloaded files. Neither outlet says what attack it was used in, so the exploitation claim rests on Microsoft's own label.

Critical flaws to patch first on servers

Splashtop lists five Critical remote code execution flaws in Windows DHCP Server (CVE-2026-96934, CVE-2026-88117, CVE-2026-88120, CVE-2026-88119 and CVE-2026-88171) and one in the DHCP Client (CVE-2026-70250). It also lists Critical RCEs in Remote Desktop Gateway (CVE-2026-70187) and Active Directory Domain Services (CVE-2026-70229, which BleepingComputer also lists).

Office carries 34 Critical RCEs, 19 of them in Excel, by Splashtop's count. Microsoft's new "risk cohorts" group 15 clusters of related flaws, from 136 in Windows filesystem, storage and backup to 103 in installation and update services. Microsoft says the cohorts do not rank which flaws are most dangerous and calls the approach experimental.

1. Elevation of privilege677 flaws
2. Remote code execution317 flaws
3. Information disclosure254 flaws
4. Denial of service73 flaws
5. Security feature bypass40 flaws
6. Spoofing28 flaws

Source: BleepingComputer, October 13, 2026 (category figures sum to 1,389, against a stated total of 1,411)

Windows 11 24H2 Home and Pro get their last update

The October 2026 update is the last for Windows 11 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016, Microsoft says. Windows 11 23H2 Enterprise, Education and IoT Enterprise stop receiving security updates next month, per an earlier Microsoft announcement.

Other vendors patched actively exploited flaws the same week. BleepingComputer lists a Fortinet FortiMail zero-day (CVE-2026-104286), a Citrix NetScaler flaw (CVE-2026-88779) and an Ivanti Connect Secure zero-day. The site's earlier coverage includes a kernel overflow in OpenBSD and a FortiOS path traversal that CISA catalogued.

The totals cannot be reconciled before deploying, so the practical order is the exploited Shell flaw first, then the DHCP and Active Directory servers. The figure to watch is Splashtop's 1,413 against September's 974, when November's release notes publish.