Microsoft right now issued updates to repair greater than 1,400 safety vulnerabilities in its Home windows working techniques and different software program. As we speak’s epic patch batch dwarfs September’s document of almost 1,000 fixes, which was already about ten instances the traditional month-to-month patch load from Redmond.
Simply one of many weaknesses patched this week is taken into account a “zero day,” or already exploited within the wild. CVE-2026-96951 is a safety function bypass within the Home windows Shell that impacts Home windows 10 and 11 techniques, in addition to some Server variations.
Home windows 10 customers may be questioning if they will nonetheless count on safety updates after this month. Microsoft had been slated to cease delivery updates for Home windows 10 techniques in October 2025, however ended up including one other yr of free updates after appreciable pushback. Just a few months in the past, Microsoft quietly prolonged that help for one more yr (till October 2027).
At the least 78 of the failings fastened this month are rated “vital,” which means they may very well be exploited with little or no motion by the person, and most of these vital bugs enable an attacker to execute code of their alternative on the susceptible system.
Whereas Microsoft stated there are not any indicators anybody is exploiting it but, a safety function bypass within the .NET Framework (CVE-2026-108398) was publicly disclosed previous to right now, doubtlessly giving attackers advance time to work out easy methods to exploit the bug.
Satnam Narang at Tenable stated the variety of flaws fastened this month far surpasses the earlier record-setting yr 2020, when Microsoft patched 1,261 CVEs.
“We’ve now crossed the 4,000 CVE mark with two months left to go,” he stated.
Microsoft credit giant language fashions for the excessive quantity of bug discovery, and presumably AI will get credit score for most of the patches used to repair these flaw. In the meantime, safety specialists have been warning that these unusually giant patch volleys from Microsoft are inserting additional pressure on company safety groups, which regularly have to check particular person updates earlier than deploying them throughout a community to make sure the fixes don’t trigger issues for different software program.
Tyler Reguly, affiliate director of safety analysis and growth at Fortra, notes that simply 26 Microsoft vulnerabilities appeared within the “Recognized Exploited Vulnerabilities” (KEV) catalog maintained by the U.S. Cybersecurity & Infrastructure Safety Company (CISA) thus far this yr, and safety groups would do effectively to prioritize patching these 26 vulnerabilities first.
“Safety leaders ought to concentrate on exploitable danger, and ask whether or not their groups have the readability, capability and help to behave,” Reguly stated.
Which vulnerabilities deserve essentially the most scrutiny in your group? The parents at Cisco Talos have a helpful roundup of the extra noteworthy flaws that Microsoft fastened right now, and naturally the SANS Web Storm Heart has a dependable roundup that indexes vulnerabilities by severity, CVE quantity and affected software program.
