Microsoft's own October security update document lists 1,456 Microsoft-assigned flaws, one of them flagged as exploited1. Microsoft assigns Common Vulnerabilities and Exposures (CVE) numbers, the shared reference for a single flaw, to bugs in its own software, so the count is its own. September's document now holds 998 entries; on September's Patch Tuesday it held 973.
22OCT
Microsoft lists 1,456 of its own CVEs
1 min read
16:31UTC
Microsoft's own October security update document lists 1,456 Microsoft-assigned flaws, one of them exploited. September's document holds 998.
TechnologyAssessed
Key takeaway
Microsoft's October update document holds 1,456 of its own CVEs, one exploited.
Deep Analysis
In plain English
What could happen next?
- Consequence
IT teams must rank far more fixes per month, raising the chance that a dangerous but unexploited flaw waits behind lower-risk ones.
First Reported In
Update #15 · Fridge hack spoils food in seven countries
Microsoft· 22 Oct 2026
Read original →Causes and effects
This Event
Microsoft lists 1,456 of its own CVEs
Microsoft's own data gives a count that matches neither figure in press coverage of October's release.
Different Perspectives
Hospital Sírio-Libanês
Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.
The Foschini Group
The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.
FirstVDS
FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.
ESET
ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.
JPCERT/CC
JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.
Cyber Security Agency of Singapore
The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.