Microsoft Fixes Nearly 1,100 Security Vulnerabilities
Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software.
Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software.
This month’s Patch Tuesday addresses 63 critical flaws — including a zero-day in Microsoft Outlook — and comes amid important security updates from other software makers, including Adobe, Apple, Google and Mozilla.
November’s patch release from Redmond tackles 1,093 vulnerabilities, fixing 63 critical flaws that can be exploited to seize control over a Windows system with little or no help from users.
According to Redmond, just one of the flaws is already seeing active exploitation: CVE-2026-124194, a spoofing bug in Outlook; apple on Monday released out-of-cycle security updates to fix at least nine vulnerabilities in iOS/iPadOS, macOS, watchOS and visionOS.
Overall, 535 of the flaws addressed this month allow an attacker to elevate their privileges on a vulnerable device; the advisory for CVE-2026-124194 says it affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office.
Among the weaknesses reportedly fixed in Apple’s release include an iMessage flaw that could let a remote attacker join a group chat and receive its messages; the updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined.
Teams that can quickly identify those assets, confirm exposure and act on confirmed exploitation can focus on the small slice of vulnerabilities attackers are actively using, while the rest stays on the normal patch cadence.
Nearly half of those critical bugs are remote code execution vulnerabilities.
Google this week released Chrome version 157.0.8103.50, which resolves nine security holes, including CVE-2026-125350, the sixth zero-day vulnerability this year for Chrome (this bug also is being patched in Chromium-based browsers like Edge).
The latest Chrome version follows its November 3 release, which fixed 213 vulnerabilities.
This latest round of updates means Microsoft has shipped more than 5,100 security patches so far this year, a staggering number considering that a year ago Microsoft was averaging around 100 patches per month.
Microsoft credits advances in artificial intelligence for helping to find (and fix) such a large volume of security bugs in recent months.
Several other major software makers pushed security updates this week to fix critical weaknesses in their products; adobe today released patches for at least 110 vulnerabilities across a range of products, with nearly half of the flaws rated high severity.
What happened
Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software.
This month’s Patch Tuesday addresses 63 critical flaws — including a zero-day in Microsoft Outlook — and comes amid important security updates from other software makers, including Adobe, Apple, Google and Mozilla.
November’s patch release from Redmond tackles 1,093 vulnerabilities, fixing 63 critical flaws that can be exploited to seize control over a Windows system with little or no help from users.
What changed
According to Redmond, just one of the flaws is already seeing active exploitation: CVE-2026-124194, a spoofing bug in Outlook; apple on Monday released out-of-cycle security updates to fix at least nine vulnerabilities in iOS/iPadOS, macOS, watchOS and visionOS.
Who is affected
Overall, 535 of the flaws addressed this month allow an attacker to elevate their privileges on a vulnerable device; the advisory for CVE-2026-124194 says it affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office.
Why it matters
Among the weaknesses reportedly fixed in Apple’s release include an iMessage flaw that could let a remote attacker join a group chat and receive its messages; the updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined.
Teams that can quickly identify those assets, confirm exposure and act on confirmed exploitation can focus on the small slice of vulnerabilities attackers are actively using, while the rest stays on the normal patch cadence.
Technical details
Nearly half of those critical bugs are remote code execution vulnerabilities.
Google this week released Chrome version 157.0.8103.50, which resolves nine security holes, including CVE-2026-125350, the sixth zero-day vulnerability this year for Chrome (this bug also is being patched in Chromium-based browsers like Edge).
The latest Chrome version follows its November 3 release, which fixed 213 vulnerabilities.
Response
This latest round of updates means Microsoft has shipped more than 5,100 security patches so far this year, a staggering number considering that a year ago Microsoft was averaging around 100 patches per month.
Microsoft credits advances in artificial intelligence for helping to find (and fix) such a large volume of security bugs in recent months.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.