October 2026 Third-Party Vulnerabilities and Patches 

October set a new record. During the month we identified 1,853 unique vulnerabilities across 110 applications, and vendors released 270 patched versions to fix them. That is up from 1,374 in September, so month over month the count rose by about 35%. It’s the highest number we have ever recorded, clearly above the previous record of 1,539 from July. For comparison, a normal month through 2024 and 2025 landed somewhere between 80 and 140. 

This time the growth was not only about volume. The number of affected applications jumped from 77 in September to 110, and patched versions went from 166 to 270. Both are the highest we have seen so far. So unlike September, when a lot of vulnerabilities landed on a few busy vendors, October spread the work across a much wider set of products. A big part of that comes from one shared library. A single flaw in Google’s Brotli compression library showed up in 27 different products in our catalog, from .NET runtimes and Visual Studio to Node.js and Git. More on that below. 

Browsers still carry most of the load. Chromium products alone accounted for 1,031 of the 1,853 vulnerabilities, and when you add Firefox, Pale Moon, and Waterfox, browsers make up about 71% of everything we saw. Microsoft Edge led this month with 946 vulnerabilities across nine releases, ahead of Brave at 742 and Google Chrome at 731. Chromium shipped two new major versions in October, 155 and 156, and each major version brings hundreds of upstream fixes at once. 

The single biggest update was Microsoft Edge 156.0.4314.42, which closed 609 vulnerabilities on its own. Because Chromium fixes flow down into every browser built on top of it, one upstream release spreads the same fixes across several products, so these numbers say more about how Chromium patches than about hundreds of separate findings. 

Notable vulnerabilities in October third-party patches 

The vulnerabilities below stand out either because a working exploit already exists or because they carry an EPSS score above 0.1. Both raise the odds of real-world abuse and shorten the time you have to patch safely, so they are the ones worth prioritizing. This month two cleared the bar. Both have known exploits, and both are in CISA’s Known Exploited Vulnerabilities catalog, so neither of them is theoretical. 

CVE-2026-111497 is the standout this month. It’s a critical out-of-bounds write in Brotli, the open source compression library from Google that a lot of software uses to unpack compressed data. An attacker who can feed a crafted Brotli stream to a vulnerable application can corrupt memory, leak data, crash the process or possibly run code, and no login is needed. It carries a CVSS score of 9.2 and the highest EPSS score we saw all month at about 0.83. Google fixed it in Brotli 1.2.1 on October 21, Microsoft shipped an out of band .NET update on October 25, and CISA added it to the KEV catalog on October 27 after it was seen exploited in the wild. 

What makes this one interesting for us is how far it reaches. Brotli is a library and not a product, so the same bug landed in 27 different products in our catalog this month. That includes the .NET 8, 9, and 10 runtimes; SDKs and ASP.NET Core hosting bundles; the Windows Desktop Runtime; Visual Studio 2019, 2022, and 2026; three Node.js release lines, Git, and Yaak. This is the hard part with shared components. One fix upstream turns into many separate updates, and every vendor ships on its own schedule. For .NET, applications are exposed when they decompress Brotli data through ASP.NET Core request decompression, HttpClient automatic decompression or the System.IO.Compression Brotli APIs. The first two are not on by default, and .NET Framework is not affected. Self-contained applications need to be rebuilt with the new runtime, because installing a newer runtime on the host is not enough. The fix ships in .NET 8.0.33, 9.0.22 and 10.0.14. More information is available in the Microsoft .NET advisory, the Brotli release notes, and CISA’s KEV entry. 

CVE-2026-96951 is a different kind of problem. It’s a Windows Shell flaw that lets an attacker get around Mark of the Web, the warning Windows shows on files that came from the internet. Microsoft rates it Important with a CVSS score of 8.8, and it was already being exploited when the fix came out on October 13 Patch Tuesday. CISA added it to KEV the same day and gave U.S. federal agencies only three days to patch. The user has to open a crafted file or link, so phishing is the most likely way in. Bypasses like this are popular with attackers because they remove the one warning that might make a user stop and think before running something. It shows up in our data because Microsoft also lists Edge as affected, and Edge 154.0.4258.62 and newer versions include the fix. The Windows side still needs the October cumulative update, so updating Edge alone does not close it. More information is available in Microsoft’s Security Update Guide and CISA’s KEV entry. 

Taken together, the October data shows two sides of the same problem. The Brotli bug shows how one flaw in a shared library spreads into dozens of products, and each of them needs its own update before the gap is really closed. The Windows Shell bug shows that attackers don’t wait, because it was used before the fix even shipped. In both cases, what matters most is how quickly the fix actually reaches the machine, and knowing which of your applications quietly carry the same component. 

Browser security updates in October 2026 

Browser updates were again the biggest driver of vulnerability activity in October. The table below breaks down the counts down. This month Microsoft Edge led with 946 vulnerabilities addressed across nine releases, followed by Brave at 742 across seven and Google Chrome at 731 across seven. Vivaldi and Opera were back in our catalog with 11 and 10. Because all these browsers are built on Chromium, most of the fixes trace back to the same upstream releases, so the counts are better read as one coordinated patching effort than as separate findings. Browsers built on Firefox were quieter. Mozilla Firefox fixed 248 vulnerabilities across four releases, and its 115 and 153 branches handled 248 and 206. Pale Moon added 11 and Waterfox just one. Put together, browsers made up about 71% of everything fixed this month. 

Microsoft product updates included in October 2026 third-party patches 

Microsoft issued security updates for several other products: 

• Microsoft .NET Runtime 10.0 

• Microsoft .NET Runtime 8.0 

• Microsoft .NET Runtime 9.0 

• Microsoft .NET SDK 10.0 

• Microsoft .NET SDK 8.0 

• Microsoft .NET SDK 9.0 

• Microsoft 365 Access Runtime 

• Microsoft 365 Apps 

• Microsoft ASP.NET Core Runtime 10.0 

• Microsoft ASP.NET Core Runtime 8.0 

• Microsoft ASP.NET Core Runtime 9.0 

• Microsoft ASP.NET Core Runtime Hosting Bundle 10.0 

• Microsoft ASP.NET Core Runtime Hosting Bundle 8.0 

• Microsoft ASP.NET Core Runtime Hosting Bundle 9.0 

• Microsoft Azure Kubelogin 

• Microsoft Edge for Business 

• Microsoft Project 

• Microsoft Visio 

• Microsoft Visual Studio 2019 Enterprise 

• Microsoft Visual Studio 2019 Professional 

• Microsoft Visual Studio 2022 Enterprise 

• Microsoft Visual Studio 2022 Professional 

• Microsoft Visual Studio 2026 Community 

• Microsoft Visual Studio 2026 Enterprise 

• Microsoft Visual Studio 2026 Professional 

• Microsoft Visual Studio Code 

• Microsoft Windows Desktop Runtime 10.0 

• Microsoft Windows Desktop Runtime 8.0 

• Microsoft Windows Desktop Runtime 9.0 

Detailed list of October third-party patches