Microsoft October update fixes 1,408 bugs; active SharePoint exploit demands urgent patching
The October update cycle addresses a record number of security issues, including a SharePoint flaw that is currently being exploited in the wild.
Key points
- Microsoft released fixes for 1,408 vulnerabilities during its October Patch Tuesday cycle.
- A SharePoint flaw marked as not exploited is actually under active attack.
- Computerworld recommends immediate patching for Windows, Office, Exchange, and developer tools.
Microsoft released security updates for 1,408 vulnerabilities during its October Patch Tuesday cycle, marking the largest batch of fixes ever issued by the company. The release addresses flaws across multiple product lines, including Windows, Office, SQL Server, and developer tools. One Windows Shell vulnerability included in this batch is already under active attack, according to Computerworld.
The October update also includes a critical finding regarding a SharePoint flaw that Microsoft initially marked as not exploited. Computerworld states that this specific vulnerability is actually under attack right now. The outlet notes that this discrepancy between the initial marking and the actual threat level requires immediate attention from administrators. Computerworld recommends a "Patch Now" scheduling priority for Windows, Office, Exchange, and developer tooling.
Context on the October Release
The practice of releasing security updates on the second Tuesday of the month, known as Patch Tuesday, was initiated to streamline the distribution process for IT system administrators. This schedule allows users to manage updates more efficiently across various Microsoft products, from browsers to SQL Server. Computerworld describes the practice as a staple of IT industry information, maintaining a rolling list of recent patches to help professionals keep up with fixes.
As Threat Times reported on 18 October 2026, Microsoft released its largest update batch ever on 13 October, fixing over 1,400 vulnerabilities. That earlier reporting highlighted the Windows Shell flaw as the primary exploited vulnerability in the initial announcement. The current coverage clarifies the additional risk posed by the SharePoint component, which was not initially flagged as exploited.
Comparison with Previous Months
Microsoft’s September Patch Tuesday was the largest release of 2026 prior to October, addressing 963 CVEs. That release included two exploited flaws: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Advanced Local Procedure Call. Computerworld recommended prioritizing Windows, Office, and SQL Server for September, with a standard patch release schedule for Exchange.
In August 2026, Microsoft closed 751 CVE entries across all product families, with 108 rated as critical. One exploited flaw, CVE-2026-68820, was an elevation of privilege in the Windows WinSock driver (afd.sys). Two additional vulnerabilities were disclosed in August but were not reported as exploited. The October release significantly exceeds the volume of fixes provided in both September and August.
What should you do?
Administrators should verify that their systems have received the latest October updates, particularly for SharePoint, Windows, Office, and Exchange servers. Computerworld advises applying these patches immediately rather than waiting for a standard release cycle. Organizations should monitor their logs for any signs of exploitation related to the SharePoint flaw, given the discrepancy in its initial risk assessment.
What to do and how to stay safe: Microsoft
- Apply the October Patch Tuesday updates immediately to all Windows, Office, Exchange, and developer tooling systems.
- Verify that SharePoint servers have received the latest security patches to address the actively exploited flaw.
- Monitor system logs for unusual activity related to the SharePoint vulnerability, even if it was initially marked as not exploited.
- Review patching schedules to ensure SQL Server updates are applied according to standard release procedures.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many vulnerabilities did Microsoft patch in October 2026?
Microsoft patched 1,408 vulnerabilities in its October 2026 Patch Tuesday release.
Is the SharePoint flaw in the October update being exploited?
Yes, the SharePoint flaw is currently under active attack, despite being initially marked as not exploited.
Which products should be patched immediately?
Computerworld recommends immediate patching for Windows, Office, Exchange, and developer tooling.
