Overview
- Microsoft published its largest single Patch Tuesday this month, releasing fixes for roughly 1,413 vulnerabilities that span Windows, Office, SharePoint, SQL Server and developer tools.
- The update includes an actively exploited Windows Shell command‑injection/Mark of the Web bypass tracked as CVE‑2026‑96951, which CISA added to its Known Exploited Vulnerabilities list and which requires rapid patching on exposed systems.
- Security teams are also being urged to address clusters of high‑risk flaws this month, including five Outlook preview‑pane remote code execution bugs and about 55 unauthenticated, zero‑click 'wormable' RCEs affecting DHCP, Remote Desktop Gateway and Network Policy Server.
- Microsoft said it will group related fixes into 'risk cohorts' so organizations can prioritize by exploitability, exposed services and business impact rather than by raw CVE count.
- Defender teams face elevated operational strain from the surge in disclosures, with researchers saying AI has speeded discovery and that organizations should focus first on actively exploited, publicly disclosed and externally exposed vulnerabilities while planning longer‑term patch workflows.