Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has come under active exploitation.

These include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to privilege escalation, followed by over 300 remote code execution flaws and 250 information disclosure flaws. Over 70 flaws are rated Critical in severity.

"Hundreds of CVEs in a single release used to be the exception; now it's the baseline," Dustin Childs, head of Threat Awareness at the Zero Day Initiative (ZDI), said. "Is AI to blame? Partly. It's accelerating bug-hunting on both sides of the fence, so vendors are finding (and fixing) more flaws, and researchers are finding them faster too."

"But AI isn't creating these bugs out of thin air; it's just shortening the time between a vulnerability existing and someone noticing it. The volume isn't the real story anymore. What matters is that discovery is scaling faster than exploitation, so teams that triage by sheer CVE count instead of exploitability are burning cycles on the wrong bugs. Patch what's proven, prioritized, and public, and treat everything else as this month's new normal."

Microsoft, which credited Fujitsu's Riku Bamba and Yuya Chudo, as well as Anthropic's Benoit Sevens and a researcher named yhw for reporting CVE-2026-96951, said the vulnerability has been exploited in the wild.

"An attacker who successfully exploited the vulnerability could evade Mark of the Web (MOTW) defenses," the Windows-maker said.

Source link