MICROSOFT has issued a sweeping patch batch fixing more than 1,400 security vulnerabilities across Windows operating systems and related software. The roll-up dwarfs September’s near-1,000 fixes and underscores an unusually large month for Microsoft’s patch Tuesday. Among the fixes, at least one is treated as a zero-day: CVE-2026-96951, a security feature bypass in the Windows Shell affecting Windows 10 and 11, and some Server versions.
The scale of the update is notable for its breadth and severity. Roughly 78 of the flaws are rated critical, meaning they could be exploited with minimal user action and may allow code execution on vulnerable systems. Microsoft also notes that a publicly disclosed but not yet exploited vulnerability in the .NET Framework, CVE-2026-108398, could give attackers a head start for exploitation. The company says there are no signs of active exploitation yet.
Analysts have highlighted the volume as one of the largest patch batches in recent memory, with commentary crediting large language models and AI-assisted discovery for at least part of the surge. Microsoft had extended Windows 10 support for another year, until October 2027, after plans to end updates in October 2025.
Security researchers and organisations—such as Satnam Narang of Tenable, Cisco Talos, and the SANS Internet Storm Center—have underscored the importance of prioritising patching, particularly for the Known Exploited Vulnerabilities (KEV) catalog. So far this year, 26 Microsoft vulnerabilities appeared in KEV, suggesting prioritisation of those flaws alongside the broader update.