Patch Tuesday 2026 continues to make history. Not only did it break the record for total number of patches in a month three times this year, this month shattered the previous record set last month (964). This month, there were more CVEs patched (1,407) than in the previous record-setting year 2020, when Microsoft patched 1,261 CVEs. We’ve now crossed the 4,000 CVE mark with two months left to go.

This month, two zero-days were patched, including one that was exploited.

CVE-2026-96951 is a security feature bypass in Windows Shell. This is the third flaw in Windows Shell that was exploited in the wild this year. The other two were CVE-2026-21510, which is linked to the advanced persistent threat group APT28 (also known as Fancy Bear), and CVE-2026-32202, which was a fix for an incomplete patch for CVE-2026-21510. The exploitation of CVE-2026-32202 has yet to be attributed, and it is unclear if CVE-2026-96951 was created to address another incomplete fix or if exploitation is linked to APT28. There have been 26 Windows Shell vulnerabilities patched in 2026 through October, a staggering figure compared to previous years, with only 3 Windows Shell CVEs in 2025, and just one in 2024 and 2022. – Satnam Narang, Senior Staff Research Engineer at Tenable