Aided in large part by AI-assisted vulnerability discovery, Microsoft’s October Patch Tuesday update has once again addressed a record number of common vulnerabilities and exposures (CVEs), with over 1,400 flaws listed, mor than in the entirety of 2023.
This blows past the previous record of approximately 1,000 set one month ago, which in turn superseded that of a little over 600 set in July 2026. By way of comparison, the October 2025 update addressed roughly 175 CVEs. It is important to note that exact totals often vary and are hard to pin down thanks to the presence of third-party flaws and how they are counted.
Dustin Childs, head of threat awareness at the Zero Day Initiative, conceded that he was starting to think he doesn’t much care for the new normal as he described a “breaking point” for enterprise patch management.
When AI can generate essentially a year’s worth of vulnerabilities in 30 days, any organisations still cleaving to traditional monthly triage patch management models are leaving their network boundaries dangerously exposed, he explained.
“Hundreds of CVEs in a single release used to be the exception; now it’s the baseline. Is AI to blame? Partly,” said Childs.
“It’s accelerating bug-hunting on both sides of the fence, so vendors are finding – and fixing – more flaws, and researchers are finding them faster too. But AI isn’t creating these bugs out of thin air; it’s just shortening the time between a vulnerability existing and someone noticing it.
“The volume isn’t the real story anymore,” he told Computer Weekly via email. “What matters is that discovery is scaling faster than exploitation, so teams that triage by sheer CVE count instead of exploitability are burning cycles on the wrong bugs. Patch what’s proven, prioritised, and public, and treat everything else as this month’s new normal.”
This month, Childs noted in particular the presence of 55 unauthenticated, zero-click vulnerabilities across DHCP, Remote Desktop Gateway, and Network Policy Server – mass wormable attack surfaces that create the “highest lateral propagation risk in years.”
High-profile flaws
Diving into some of the more high-profile flaws listed this month, Childs advised defenders to prioritise immediate perimeter ring-fencing to counter an active zero-day command injection in Windows Shell, tracked as CVE-2026-96951, that bypasses Mark of the Web (MotW) protections. This flaw was supposedly discovered in part by Anthropic’s Claude AI model and has already made it to the Cybersecurity and Infrastructure Security Agency’s (Cisa’s) Known Exploited Vulnerabilities (Kev) catalogue.
Also worth close attention, he said, is CVE-2026-102866, an elevation of privilege (EoP) flaw in SharePoint that enables an unauthenticated attacker to exploit a cryptographic token validation issue to take control of user accounts.
Action1 vulnerability research director Jack Bicer said that for security leaders, the challenge this month will not be in simply deploying more updates but in deciding what needs attention first without causing any issues for downstream services.
“This month, the answer depends on more than severity scores,” wrote Bicer. “Active exploitation, exposed services, and the role each system plays in your network should guide deployment order.”
Sick days for CISOs
Meanwhile, research conducted on behalf of Cardiff-based cyber security consultancy Socura has reported that Patch Tuesday causes major stress among cyber professionals, with nearly a third feeling “significant anxiety” in the days running up to the second Tuesday of the month, and a fifth saying that they had either deliberately called in sick or planned holiday time specifically to avoid having to deal with it.
“You expect your accountant to be available for your tax return deadline, and your lawyer for your court date,” said Andrew Kays, Socura CEO.
“It speaks volumes about the unhealthy levels of stress and burnout in our industry that cyber security leaders would deliberately avoid the office during their most consequential day of work. CVE numbers are rising every year and with AI facilitating cyber criminals to exploit vulnerabilities faster than ever, I think Patch Tuesday stress could get worse before it gets better.
“Fortunately, while AI is making Patch Tuesday more difficult, the same AI tools and resources are also in the hands of defenders. AI is improving our customer outcomes, and the time it takes to respond to an incident. And this is the case for many security teams,” he said.
