Microsoft released updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software on Tuesday marking another four-digit patch drop.
According to Krebs on Security, the November update from Redmond addresses 1,093 security issues, resolving 63 critical vulnerabilities that attackers could leverage to take over a Windows machine with minimal or zero user interaction. Nearly half of those critical bugs are remote code execution vulnerabilities, while 535 of the addressed flaws allow an attacker to elevate their privileges on a vulnerable device.
Following this current set of software corrections, the total number of security patches delivered by Microsoft throughout the year has surpassed 5,100. Artificial intelligence advancements are credited by Microsoft for assisting in the identification and resolution of such a high volume of security bugs over the past few months, succeeding last month’s release of over 1,400 fixes.
According to Redmond, just one of the flaws is already seeing active exploitation. That bug is CVE-2026-124194, a spoofing vulnerability in Outlook affecting Microsoft 365 Apps for Enterprise and editions of Microsoft Office.
Several other major software makers pushed security updates this week to fix critical weaknesses in their products. Apple released out-of-cycle security updates on Monday to fix at least nine vulnerabilities in iOS/iPadOS, macOS, watchOS, and visionOS.
Google released Chrome version 157.0.8103.50 this week to resolve nine security holes, including CVE-2026-125350, which marks the sixth zero-day vulnerability this year for Chrome. This bug is also being patched in Chromium-based browsers like Edge, following a November 3 release that fixed 213 vulnerabilities.
Mozilla Firefox released Firefox 160 today, resolving almost 100 CVEs with about half of them rated high severity. At least 110 vulnerabilities spanning multiple product lines were addressed in today’s software updates from Adobe, where approximately half of the issues received a high severity classification and active exploitation has not been observed.
The sheer number and severity of recent Microsoft security releases can easily cause corporate security departments to feel overwhelmed, remarked Chris Goettl, Ivanti’s vice president of product management. However, he said that while some 95,000 vulnerabilities have been assigned CVEs this year across all vendors, only 217 have so far been added to the Known Exploited Vulnerabilities list maintained by the U.S. Cybersecurity and Infrastructure Security Agency.
“Roughly four in ten of this year’s exploited vulnerabilities sit in operating systems, endpoint software, browsers, and server platforms, which a continuous patch strategy can close quickly,” Goettl said.
“The rest calls for exposure management alongside patching, especially the 44% that sit in edge devices and IT management or remote access tools, the internet-facing systems that hold privileged access. Teams that can quickly identify those assets, confirm exposure and act on confirmed exploitation can focus on the small slice of vulnerabilities attackers are actively using, while the rest stays on the normal patch cadence.”
Earlier coverage: Microsoft Patches Critical Outlook Zero-Day Vulnerability Being Exploited by Attackers
