Microsoft Fixes Nearly 1,100 Security Vulnerabilities

Microsoft released a massive software update on Patch Tuesday, fixing nearly 1,100 security vulnerabilities across its Windows operating systems and supported software. The month’s update addressed 63 critical flaws, including a zero-day vulnerability in Microsoft Outlook. This surge in patches comes as other software makers like Adobe, Apple, Google, and Mozilla also released important security updates this week.

Out of the 1,093 vulnerabilities tackled by Microsoft, nearly half are remote code execution flaws, which can allow attackers to take control of a Windows system with minimal user interaction. A total of 535 flaws let attackers elevate their privileges on vulnerable devices.

Microsoft has now shipped over 5,100 security patches this year, a significant increase from the average of 100 patches per month a year ago. The company attributes the large volume of patches to advancements in artificial intelligence that help identify and fix security bugs.

One of the flaws, CVE-2026-124194, has already been exploited in the wild, affecting Microsoft 365 Apps for Enterprise and editions of Microsoft Office. Several other major software vendors also pushed important security patches this week, with Apple fixing nine vulnerabilities in iOS, iPadOS, macOS, watchOS, and visionOS. Google released Chrome version 157.0.8103.50, which resolves nine security issues, including a zero-day vulnerability.

Adobe addressed at least 110 vulnerabilities across its products, though no evidence suggests these flaws are actively being exploited. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) notes that while 95,000 vulnerabilities have been assigned CVEs this year, only 217 have been added to its Known Exploited Vulnerabilities (KEV) list. The majority of vulnerabilities, 44%, are found in edge devices and IT management or remote access tools.