Record on Microsoft Patch Day: Almost 1000 vulnerabilities closed
Microsoft closes nearly 1000 security vulnerabilities on Patch Day. Two are already being actively exploited and have the highest priority.
(Image: heise medien)
The Vulnocalypse continues to gallop unabated: With 974 CVEs, Microsoft is once again closing a record number of security vulnerabilities; 723 of them in Windows alone. The rest are distributed across Office, SQL, Developer Tools, and other MS products. According to the Microsoft Security Response Center, two of the vulnerabilities are already being actively exploited.
The two vulnerabilities already being exploited should therefore be the top priority for administrators, even though their severity is only rated as “Important”; both are also listed by CISA as Known Exploited Vulnerabilities.
- Windows Update Stack – Elevation of Privilege – CVE-2026-81963, CVSS 7.8
- Windows Advanced Local Procedure Call (ALPC) – Elevation of Privilege – CVE-2026-85880, CVSS 7.8
Videos by heise
This is followed by a total of 114 new vulnerabilities classified as critical. However, not all of them can be patched individually; Microsoft only delivers one update package per product and version. An overview page from MSRC provides the overview. Those who need a complete list of all CVEs with the respective links will find it at Trend ZDI.
(ju)
