Microsoft Ships Record 1,413 Patches in One Release, Including a Fix for an Actively Exploited Windows Flaw

Microsoft has broken its own Patch Tuesday record, releasing fixes for 1,413 vulnerabilities in a single update. The total includes 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server and 22 in SQL Server. More than 670 relate to privilege escalation, over 300 to remote code execution and 250 to information disclosure. Over 70 are rated Critical.

One flaw, CVE-2026-96951, has been exploited in the wild. Microsoft says it lets an attacker evade Mark of the Web (MOTW) defences, the warning system that flags files from untrusted sources. An attacker could send a specially crafted file by email or instant message, but would still need to convince the user to act, for example by clicking a link or opening an attachment. It is unclear how the flaw is being used in real attacks, by whom, or who has been targeted. The US Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities catalogue, with federal agencies required to apply the fix by 16 October 2026.

Dustin Childs of the Zero Day Initiative says hundreds of fixes in one release is now the baseline, partly because AI is speeding up bug-hunting for both vendors and researchers. He argues the volume is not the real story: teams that triage by raw CVE count rather than exploitability risk wasting effort. His advice is to patch what is proven, prioritised and public.