Microsoft today released updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch batch eclipses September’s record of nearly 1,000 fixes, which was already about ten times Redmond’s normal monthly patch load.
Only one of the weaknesses fixed this week is considered “zero day” or already exploited in the wild. CVE-2026-96951 is a security feature bypass in the Windows shell This affects Windows 10 and 11 systems, as well as some server versions.
Windows 10 users may be wondering if they can still expect security updates after this month. Microsoft was supposed to stop providing updates for Windows 10 systems in October 2025, but ended up adding another year of free updates after considerable pushback. A few months ago, Microsoft quietly extended this support for another year (until October 2027).
At least 78 of the flaws patched this month are rated “critical,” meaning they could be exploited with little or no user action, and most of these critical bugs allow an attacker to run any code they want on the vulnerable system.
While Microsoft said there are no signs of anyone exploiting it yet, a bypass of a security feature in the .NET Framework (CVE-2026-108398) was publicly disclosed before today, potentially giving attackers time to figure out how to exploit the bug.
Satnam Narang has Defensible said the number of vulnerabilities patched this month far exceeds the previous record year of 2020, when Microsoft patched 1,261 CVEs.
“We have now crossed the 4,000 CVE mark with two months to go,” he said.
Microsoft credits large language models for the high volume of bug discoveries, and it can be assumed that AI is credited with many of the patches used to fix these flaws. Meanwhile, security experts have warned that these unusually large patch volleys from Microsoft are putting additional pressure on the company’s security teams, who often must test individual updates before rolling them out across a network to ensure the patches don’t cause problems for other software.
Tyler Regularlyassociate director of security research and development at Fortranotes that only 26 Microsoft vulnerabilities have appeared in the “Known Exploited Vulnerabilities” (KEV) catalog maintained by the US Cybersecurity and Infrastructure Security Agency (CISA) so far this year, and security teams would do well to prioritize fixing these 26 vulnerabilities first.
“Security leaders should focus on actionable risks and ask whether their teams have the clarity, capacity and support to act,” Reguly said.
Which vulnerabilities deserve the most attention in your organization? People at Cisco Talos get a useful overview of the most notable flaws that Microsoft fixed today, and of course the SANS Internet Storm Center has a reliable summary that indexes vulnerabilities by severity, CVE number and affected software.
Gn tech
