Microsoft's October release of 1,407 CVEs tops the 2020 record by 146

The record count sets the size of the queue and says little about its order. Microsoft's 1,407 CVEs top the 2020 record of 1,261 ^[1] by 146 ^[17], or about 11.6 percent ^[18]. The list was long enough that the release arrived several hours after the usual 1 p.m. Eastern drop time, according to CSO Online ^[2]. The total as reported does not include a breakdown by severity.

The Windows Shell figures say more about where to start. Narang called 26 patched Shell flaws in 2026 "a staggering figure compared to previous years" ^[6]. Against three in 2025, that is about 8.7 times as many ^[19]. Three Shell flaws have been exploited in the wild this year ^[5]. One of them, CVE-2026-32202, was a fix for an incomplete patch of CVE-2026-21510 ^[5], the bug linked to APT28 ^[5].

A CVE count tracks how hard researchers looked as much as how much is broken, so the 26 on its own proves little about attack surface. The exploitation record is a different matter. Attackers have used three Shell flaws this year ^[5], and the October one bypasses Mark of the Web protections ^[4].

After the Shell bypass, the order is a judgement call. The SharePoint hole, CVE-2026-102866, is one CSOs need to act on, according to Dustin Childs, head of threat awareness at TrendAI's Zero Day Initiative ^[15]. Nightwing flagged four on-premises Exchange updates, each fixing one flaw rated CVSS 8.8 ^[13]. "Exchange admins should prioritize testing and deployment of these patches, given the historical track record of Exchange vulnerabilities being actively targeted in the wild," said Nicholas Carroll, Nightwing's cyber incident response manager ^[14]. Nightwing also noted that Microsoft has introduced new risk cohort classifications for prioritizing vulnerabilities ^[21].

Self-hosted products carry a separate exposure. GitLab has fixed its hosted instance, which leaves self-managed servers to patch ^[11]. "CVE-2026-97229 puts a critical part of the software supply chain at risk," said Gene Moody, Field CTO at Action1 ^[12]. Atlassian Cloud is patched ^[10], while CVE-2026-21589 affects eight self-hosted products ^[9]. Nightwing advised log review and secret rotation where exposure is suspected ^[10]. IBM rates its IBM i flaw, CVE-2026-96119, at CVSS 9.9 ^[16].

October's queue is the exploited Shell bypass, then SharePoint, Exchange and the self-hosted products. The standing item is Shell, and we'd expect it to appear in the November release. The year's 26 Shell fixes through October average about 2.6 a month ^[20].