Microsoft Patches a Record 1,400-Plus Flaws in a Single Month

Microsoft has shipped another round of updates, this time patching more than 1,400 vulnerabilities across Windows and its other products. The latest batch dwarfs September's record of nearly a thousand fixes — which itself ran about ten times Redmond's usual monthly load.

Only one of the flaws closed this week qualifies as a "zero day," meaning it was already being exploited in the wild. CVE-2026-96951 is a security feature bypass in the Windows Shell affecting Windows 10 and 11 as well as some Server editions.

Windows 10 users may wonder whether updates will keep coming. Microsoft had planned to stop shipping them back in October 2025, but after considerable pushback added a free extra year of support. A few months ago it quietly stretched that support out another year, to October 2027.

At least 78 of this month's fixes are rated "critical": they can be exploited with little or no user interaction, and most let an attacker run code of their choosing on the target system. Separately, a security feature bypass in the .NET Framework (CVE-2026-108398) was publicly disclosed ahead of the patch, giving attackers a head start in figuring out how to exploit it — though Microsoft says there are no signs of attacks yet.

Record after record

Satnam Narang of Tenable notes that this month's tally far surpasses the previous record set in 2020, when Microsoft patched 1,261 CVEs. "We've now crossed the 4,000 CVE mark with two months left to go," he said.

Microsoft itself credits the surging rate of bug discovery to large language models, and presumably AI deserves some of the credit for many of the fixes as well. Security experts, meanwhile, warn that these unusually large volleys strain corporate security teams, which often must test each update before rolling it out across a network to make sure a fix doesn't break other software.

Tyler Reguly of Fortra urges a sober sense of priorities: only 26 Microsoft flaws have made it into CISA's Known Exploited Vulnerabilities catalog all year, and those are the ones to tackle first. "Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act," he said.

Source: Krebs on Security