That dwarfs September’s near-1,000-fix haul, which was itself about ten times a normal monthly patch load.
More from Future Wire: 570 Vulnerabilities One.
At least 78 of the flaws are rated critical, meaning they can be exploited with little or no user interaction — and most of those allow an attacker to run arbitrary code on an affected system. Just one vulnerability is classified as a zero-day: CVE-2026-96951, a security feature bypass in the Windows Shell affecting Windows 10, Windows 11, and certain Server versions. A second flaw, a security feature bypass in the .NET Framework (CVE-2026-108398), was publicly disclosed before today’s patches shipped, giving potential attackers advance time to study the bug — though Microsoft says it has seen no signs of active exploitation.
Microsoft has credited large language models for the surge in bug discovery, and KrebsOnSecurity reports the company presumably attributes many of the patches themselves to AI-generated fixes as well. Satnam Narang at Tenable told the publication that this month’s volume far surpasses the previous record-setting year of 2020, when Microsoft patched 1,261 CVEs across the entire year. “We’ve now crossed the 4,000 CVE mark with two months left to go,” Narang said.
The Strain on Security Teams Is Real
The volume isn’t just a headline number — it’s a operational burden. Security experts have warned that unusually large patch waves place extra strain on corporate security teams, which often must test individual updates before rolling them out across a network to ensure the fixes don’t break other software. Tyler Reguly, associate director of security research and development at Fortra, offered a practical triage framework: only 26 Microsoft vulnerabilities have appeared in CISA’s Known Exploited Vulnerabilities catalog so far this year, and those 26 should be prioritized first. “Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act,” Reguly said.
Microsoft had originally planned to end free security updates for Windows 10 in October 2025, extended support by a year after pushback, and has since quietly extended that window again — through October 2027.
Source: Krebs report.
