- Published on
Microsoft Patches More Than 1,400 Security Flaws
- Authors
- Name
- DeepHorus
Microsoft today released updates fixing more than 1,400 security vulnerabilities in Windows and other software. The batch is the largest ever, far exceeding September's record of nearly 1,000 fixes. That September total was already about ten times Microsoft's normal monthly patch load. The scale signals a sharp rise in flaw discovery across Microsoft products.
Only one patched flaw is a zero-day exploited in the wild. CVE-2026-96951 is a Windows Shell security feature bypass affecting Windows 10, Windows 11 and some Server versions. A .NET Framework bypass, CVE-2026-108398, was publicly disclosed before today, though Microsoft sees no exploitation yet. That disclosure could give attackers advance time to develop exploits.
Windows 10 users also learned they can expect updates longer. Microsoft had planned to stop updates in October 2025 but added a year of free updates after pushback. It then quietly extended support again, until October 2027. Many organizations still rely on Windows 10, so the extension matters.
At least 78 fixed flaws are rated critical. Most allow attackers to execute code of their choice on vulnerable systems. Satnam Narang of Tenable said the total surpasses 2020, when Microsoft patched 1,261 CVEs. "We've now crossed the 4,000 CVE mark with two months left to go," Narang said.
Microsoft credits large language models for the high volume of bug discovery, and likely for many patches. Security experts warn that such large patch volleys strain corporate security teams. Those teams often must test updates before deploying them network-wide to avoid breaking other software.
Tyler Reguly of Fortra noted that just 26 Microsoft vulnerabilities appeared in CISA's Known Exploited Vulnerabilities catalog this year. He advised security teams to prioritize patching those 26 first. "Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act," Reguly said. As AI accelerates vulnerability discovery, Microsoft's patch cadence may stay elevated.
