Windows needed more than 1,000 security fixes in October 2026, but Microsoft swears it’s not “less secure” and warns against hitting the brakes on Windows updates. The company is using AI to find more bugs in Windows, but attackers can use it to study those fixes and work out how to exploit a bug within hours.
Microsoft’s wider October 2026 security release addressed 1,413 CVEs across its product portfolio, according to its October Security Update Guide. Of those, 1,123 affected Windows.
Microsoft is not sounding alarms all of a sudden. I’ve been observing these warnings for the past six months, and the clearest one landed in July 2026.
Jeremy Chapman, a director at Microsoft 365 who works closely with Windows customers on security, warned against delaying Windows updates. He told IT admins that Microsoft now recommends a deferral of less than three days for monthly quality updates on managed PCs where they can shorten the rollout.
“If you’re not delivering critical quality updates with security fixes until a couple of weeks after they’ve been issued, that’s ample time for attackers using AI to find and exploit known security gaps,” Jeremy warned.
To see how much the number of fixes has grown, take a look at this year’s Windows vulnerabilities and compare them to the numbers from 2025. I made this table using Microsoft’s security portal. It counts vulnerabilities fixed across the Windows product family, including Windows Server.
| Month | Windows CVEs fixed in 2025 | Windows CVEs fixed in 2026 | YoY |
|---|---|---|---|
| January | 132 | 93 | -29.5% |
| February | 37 | 32 | -13.5% |
| March | 37 | 48 | +29.7% |
| April | 90 | 131 | +45.6% |
| May | 44 | 66 | +50.0% |
| June | 44 | 120 | +172.7% |
| July | 103 | 413 | +301.0% |
| August | 67 | 233 | +247.8% |
| September | 58 | 726 | +1,151.7% |
| October | 134 | 1,123 | +738.1% |
October makes even July’s 413 fixes look small. A year ago, Microsoft fixed 134 Windows vulnerabilities in October. This time, it fixed more than eight times as many, and it leaves you wondering how many more bugs are still waiting to be found.
Microsoft says more fixes don’t mean Windows is less secure
According to Microsoft, the higher number of fixes comes down to how much more Windows code it can now examine with AI. Security researchers outside Microsoft are finding and reporting bugs, too. What Microsoft doesn’t say is how many of those 1,123 Windows vulnerabilities its own AI actually found.
“The number of CVEs doesn’t tell the full story, though,” Nuno Costa, Partner Director for Windows Servicing and Delivery, wrote on November 5. “We are using AI to examine more code, more deeply.”
“A higher number of CVEs does not mean Windows has become less secure,” the company insists. “It means more vulnerabilities have been discovered and closed, reducing the opportunities attackers have to exploit them.”
Microsoft also makes a point about transparency. It publishes CVE information whether a bug was found by an outside researcher, its own engineers or its AI systems. If you manage Windows PCs, those details can help you work out which devices are affected and which ones you should update first.
At a recent hardware event, Microsoft also talked about what it’s doing to make Windows more secure:
Microsoft is using AI to find Windows bugs, but attackers can use it too
Microsoft sounds quite impressed with its own tool called “MDASH,” an AI-powered scanner that uses Microsoft’s own security model alongside models such as Anthropic’s Mythos. It also has specialized agents to find and validate potential vulnerabilities.
However, AI does not mean engineers have been sent home, at least not at this point. Even though AI finds bugs and helps develop fixes, a human engineer still makes the final decisions. AI is also helping engineers figure out which versions of Windows are affected by a certain bug and test the fix before it goes out.
Microsoft doesn’t want you to delay these monthly updates because once a fix is public, attackers can compare the old and new versions to see exactly what changed. Microsoft warns that they could use AI to turn that information into a working exploit within hours.
We heard those words from Jeremy back in July, but Microsoft’s August figures give you an idea of how long some PCs stay exposed. Fewer than half of the enterprise devices in its sample had installed the security update after two weeks. About one in four still hadn’t installed it after four weeks.
I understand why you might want to wait. Windows updates can be buggy. Take the built-in backup tool File History, for example. Backups started working again in our testing after the October update, but when we checked again on November 6, File History was still partially broken. The USB audio bug is still not fully patched either.
Even with those bugs, I wouldn’t put off a monthly security update for more than three days on my own PC. Jeremy was talking to IT admins, but if you’re using Windows at home, the same risk applies to you. Attackers can start studying a fix the day Microsoft releases it, even if you decide to wait until next week to install it.
