October 2026 Patch Tuesday: Microsoft Fixes a Record 1,413 Flaws as AI-Assisted Research Adds to Discovery

This October Patch Tuesday asks more of your team than September did. Microsoft’s release notes list a whopping 1,413 CVEs, up from 974 in September. In this month guidance on using risk cohorts to prioritize security updates, Microsoft notes that AI-assisted research is contributing to how vulnerabilities are found. For your team, that means a longer queue yet with AI assistance depending on your AI workflow in terms of vulnerability management, so the order you work in matters more than before.

Microsoft: 1,413 Fixes, One Already Being Used in Attacks

Windows alone accounts for 1,102 of the fixes. Office has 134, Developer Tools 61, SharePoint Server 36 and SQL Server 22.

One flaw is being used in attacks now. CVE-2026-96951 lets a file arriving by email or chat avoid the warning Windows normally shows for downloaded files. It scores 8.8 and needs the user to open the file. Microsoft marks it “Exploitation Detected”, and it is on CISA’s Known Exploited Vulnerabilities list.

A second flaw is public but not yet exploited. CVE-2026-108398 is in .NET Framework and can get around Windows Defender Application Control, a tool used to restrict which programs can run. Microsoft rates exploitation as less likely.

As mentioned earlier, a very helpful resource is Microsoft's guidance on using risk cohorts to prioritize security updates. A risk cohort is a group of related CVEs that call for a similar assessment of your environment. You assess the group once and decide for all of its fixes together, instead of testing and approving each CVE separately. With a release this large, that is how many teams will keep up.

SAP: Four Critical Items, One Scoring 10.0

SAP’s page lists 22 rows this month, and four are rated Critical. The highest, at 10.0, is CVE-2026-89111, a request-forgery flaw in SAP Cloud SDK for Python, affecting versions before 0.45.2. SAP published it as a GitHub advisory rather than a numbered note, so if your teams only watch the notes list, this could be missed.

Two more score 9.9. CVE-2026-89110 is broken access control in SAP NetWeaver Visual Composer 7.50, and CVE-2026-89107 is code injection in SAP S/4HANA, in the Manage Substitution/Validation Rules function, across versions 105 to 109. The fourth, CVE-2026-89108, scores 9.1 and is a missing authorization check in SAP Manufacturing Integration and Intelligence (MII), versions 15.4 and 15.5. The rest of the list is mostly High and Medium items, including several cross-site scripting fixes.

How this affects MedTech

Manufacturers run Windows on engineering, service and office machines, so the 1,102 Windows fixes land on your estate. SAP MII connects plant-floor machines to SAP systems, so if you run it, the 9.1 fix is worth your attention. SAP systems may also hold records that 21 CFR 820.35 requires you to control, such as complaint, servicing and device identifier records. Check whether yours do.

Quick recommendations this week

1. Patch CVE-2026-96951 first. It is exploited and on the CISA list.

2. Sort the rest by severity, exploitation status and EPSS, then follow your own vulnerability management process.

3. Check which of your SAP systems run Visual Composer, S/4HANA 105 to 109, MII 15.4 or 15.5, and apps using Cloud SDK for Python.

4. Apply the four SAP Critical fixes in your next change window. Do not wait for the monthly cycle.

5. Plan for monthly releases of this size, not September’s.

Key Takeaway

The count is the headline, but one exploited flaw and four Critical SAP items decide where your week starts. Fix those first, then work through the long tail in order of risk.

Sources and Further Reading:
MSRC October release notes MSRC risk cohorts post SAP Patch Day, October 2026