Microsoft's October update patches 1,415 flaws, one already exploited in the wild

Security teams face a large testing load, and some users report the update broke Wi-Fi and VPN connections.

Microsoft's October security update patches 1,415 vulnerabilities across Windows, Office, Exchange, .NET, Edge, and potentially Hyper-V and Azure components, with 85 rated critical. One Windows Shell flaw has been exploited in the wild, though the sources do not tie that exploitation to a specific CVE. Researchers warn the window between disclosure and exploitation is effectively zero at this scale, and advise prioritising everything scored above 9.0. A .NET Framework security feature bypass, CVE-2026-108398, was publicly disclosed before the release, though Microsoft reports no evidence of exploitation so far. Users have reported that one update, KB5127648, stopped clients joining WPA-Enterprise Wi-Fi until it was uninstalled, and a separate report says an update broke an IPsec VPN on some laptops. Because of the patch volume, security teams face extra testing work, which makes staged rollouts sensible.