Microsoft Fixes Nearly 1,100 Security Vulnerabilities
Microsoft released updates to fix 1,093 security vulnerabilities in its Windows operating systems and supported software, including 63 critical flaws and a zero-day in Outlook.
This month's Patch Tuesday addresses 63 critical flaws that can be exploited to seize control over a Windows system with little or no help from users. Nearly half of those critical bugs are remote code execution vulnerabilities. Overall, 535 of the flaws addressed this month allow an attacker to elevate their privileges on a vulnerable device.
Zero-Day Exploited
According to Redmond, just one of the flaws is already seeing active exploitation: CVE-2026-124194, a spoofing bug in Outlook. The advisory for this vulnerability says it affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office.
Other Tech Updates
Several other major software makers pushed security updates this week to fix critical weaknesses in their products. Apple on Monday released out-of-cycle security updates to fix at least nine vulnerabilities in iOS/iPadOS, macOS, watchOS and visionOS.
You really need to get to version 27.2.1 of their OSes and push folks who are holding onto devices which cannot run the current version. The best plan often involves setting an upgrade date for old hardware.
Industry-Wide Concerns
Google this week released Chrome version 157.0.8103.50, which resolves nine security holes, including CVE-2026-125350, the sixth zero-day vulnerability this year for Chrome. Mozilla Firefox 160 resolves almost 100 CVEs, about half of them high severity. Adobe released patches for at least 110 vulnerabilities across its products.
Chris Goettl, vice president of product management at Ivanti, noted that while 95,000 vulnerabilities have been assigned CVEs this year across all vendors, only 217 have been added to the Known Exploited Vulnerabilities list maintained by CISA.
Teams that can quickly identify those assets, confirm exposure and act on confirmed exploitation can focus on the small slice of vulnerabilities attackers are actively using, while the rest stays on the normal patch cadence.
User Recommendations
Security experts recommend users back up important data before applying operating system updates and ensure all devices are running the latest supported versions of their operating systems. Microsoft has now shipped more than 5,100 security patches so far this year, significantly more than the approximately 100 patches per month the company was averaging a year ago.
Related
