Microsoft Releases Record Patch Batch With More Than 1,400 Fixes

Microsoft has issued updates for more than 1,400 security vulnerabilities across Windows and other software, according to Krebs on Security. The batch dwarfs September's record of nearly 1,000 fixes, which was already about ten times the normal monthly load. Tenable's Satnam Narang noted that the total number of flaws fixed this year has passed 4,000 with two months still to go, well above the previous record year of 2020, when 1,261 were patched.

Only one flaw is confirmed as a "zero day", meaning it is already being exploited in the wild. CVE-2026-96951 is a security feature bypass in the Windows Shell affecting Windows 10 and 11, as well as some Server versions. A second issue, a security feature bypass in the .NET Framework (CVE-2026-108398), was publicly disclosed before the update. Microsoft says it has seen no sign of exploitation yet, but disclosure may give attackers a head start. At least 78 of the fixes are rated critical, and most of those could let an attacker run code of their choice on a vulnerable system.

Microsoft credits large language models for the high volume of bug discovery. Security experts warn that such large patch releases strain corporate security teams, who often test updates before rolling them out so fixes do not break other software. Windows 10 users should also note that Microsoft has extended free security updates until October 2027.