Microsoft releases record patch for 974 vulnerabilities, including two actively exploited zero-days

Microsoft has published the most substantial security updates in its history, closing 974 vulnerabilities in Windows and other software. The previous record, set in July 2026 with 570 flaws, has been far surpassed. With this update, the total number of bugs fixed this year exceeds 2,600, more than double the 2020 record.

Quick Answer

  • Microsoft has fixed 974 vulnerabilities in its latest update, including two actively exploited zero-days (CVE-2026-81963 and CVE-2026-85880)
  • 113 vulnerabilities are classified as "critical," with potential for remote control of machines
  • Among the most serious: CVE-2026-69730 (DNS weakness) and CVE-2026-69829 (Windows Shell flaw with CVSS 9.8)
  • Artificial intelligence accelerates vulnerability discovery, but companies struggle to manage the volume of patches

Two zero-day vulnerabilities actively exploited

Among the vulnerabilities fixed, two have been actively exploited in attacks: CVE-2026-81963 and CVE-2026-85880. Both allow privilege escalation on Windows systems. Microsoft recommends immediate patching, especially for enterprise environments.

Critical vulnerabilities with remote control potential

113 of the fixed vulnerabilities are classified as "critical." Among these, CVE-2026-69730 is particularly concerning: a DNS weakness present in Windows Server 2012 and later versions, and in Windows 10. An unauthenticated attacker could exploit it by sending specially crafted packets.

Flaw in Windows Shell with high risk of remote execution

Another critical vulnerability is CVE-2026-69829, a flaw in Windows Shell that can lead to remote code execution. With a CVSS score of 9.8, this vulnerability can be exploited with low attack complexity, without privileges and without user interaction.

The impact of artificial intelligence on vulnerability discovery

Microsoft attributes the increase in discovered vulnerabilities to the use of artificial intelligence to accelerate identification processes. However, as Tyler Reguly of Fortra observes, this creates significant challenges for organizations in testing and deploying patches.

The operational challenges for companies

Reguly emphasizes that CISOs must face the operational challenge of deploying patches in a timely manner. Many organizations require in-depth testing before deployment, a process that can require overtime and additional resources.

Strategic prioritization of vulnerabilities

Satnam Narang of Tenable highlights a crucial point: despite the increase in discovered vulnerabilities, the number of those relevant to most organizations remains low. It is essential for companies to understand which vulnerabilities actually apply to their systems and prioritize fixes based on risk context.

Implications for end users

While enterprise administrators must manage complex patching operations, end users can apply updates directly through Windows Update. However, with the increase in the size of updates, it is advisable not to accumulate patches for months.

Resources for update management

Windows administrators can monitor askwoody.com for news about any issues with updates. The SANS Internet Storm Center provides a breakdown by severity and urgency of each patch.

The increase in patch volume among software vendors

Microsoft is not the only vendor to release more frequent and voluminous updates. Companies like Adobe, Cisco, Google, Mozilla, and Oracle are all increasing their patching pace, attributing this trend to the use of AI-assisted research.

The importance of an effective patching strategy

In this context, adopting an MDR service could prove crucial for organizations seeking to effectively manage the growing workload associated with patching. A well-structured SOC as a Service can help identify and prioritize the most critical vulnerabilities, reducing the risk of breaches.

Considerations on NIS2 and DORA compliance

As the deadlines for NIS2 and DORA compliance approach, organizations must consider how the increase in patch volume may affect their security programs. A well-defined patching strategy is fundamental to meeting regulatory requirements and maintaining digital operational resilience.

The impact on cyber insurance

The increase in vulnerabilities could have implications for the cost of cyber insurance. Insurance companies may require proof of effective patch management as a condition for coverage or to reduce premiums. Organizations should evaluate whether their cyber risk policies adequately cover the risks associated with this new landscape.

The importance of a comprehensive risk assessment

While artificial intelligence is transforming the vulnerability discovery landscape, it is essential that organizations adopt a structured approach to patch management. This includes comprehensive risk assessment, strategic prioritization, and the implementation of advanced solutions such as MDR services to ensure comprehensive protection against emerging threats.

Frequently Asked Questions

How long does the patching process typically take for enterprise organizations?

The time required can vary significantly, but it often takes several hours or days to test and deploy patches in complex environments.

What tools are available to help with update management?

Tools such as SIEM, enterprise DLP, and identity access management solutions can help manage and monitor the patching process.

How can I check if my system is vulnerable to these flaws?

You can use vulnerability assessment tools or penetration testing services to identify and evaluate vulnerabilities in your systems.

The economic impact of accelerated patching

The exponential increase in patches forces companies to significantly review the budgets dedicated to cybersecurity. According to Gartner, operational costs for managing updates have increased by 47% in the last two years, with peaks of 72% for organizations adopting hybrid cloud solutions. This trend puts pressure on IT teams, forcing them to consider the purchase of advanced patching automation tools or Managed SOC services to reduce management overhead.

The challenge of managing priorities

The high number of critical vulnerabilities requires a more sophisticated approach to prioritization. Narang of Tenable emphasizes that only 15-20% of the vulnerabilities fixed in each Microsoft update are actually relevant to most organizations. This implies that companies must invest in advanced vulnerability assessment tools to identify which patches to apply first, based on specific factors such as IT architecture, sensitive data handled, and operational context.

The emergence of new service models

The market is responding to this complexity with the emergence of new service models. For example, some companies are offering MDR services specialized in patch management, which combine automated analysis with human intervention to ensure that the most critical vulnerabilities are addressed promptly. These services often include support for NIS2 and DORA compliance, helping organizations maintain regulatory compliance.

The impact on the cyber insurance market

The increase in vulnerabilities is also changing the landscape of cyber insurance. According to a report by Aon, 68% of insurance companies are now requiring proof of regular patching as a condition for coverage. Additionally, the cost of cyber risk policies has increased by 25% in 2026, with premiums that can vary significantly based on the demonstrated ability to effectively manage patches. This trend is pushing many companies to re-evaluate their cyber insurance premium strategies and invest in more robust protection solutions.

Implications for cloud security

The increase in vulnerabilities in Windows environments has significant repercussions for cloud security posture. Many organizations are adopting hybrid architectures, and the need to patch both on-premises and cloud environments is introducing new complexities. This has led to an increase in demand for CSPM (Cloud Security Posture Management) solutions that can help manage and monitor vulnerabilities in distributed environments.

The importance of continuous training

Another crucial aspect is the training of IT teams. With the increase in the volume of patches, the skills required to effectively manage the update process have become more specialized. Many companies are investing in continuous training programs for their technicians, with a particular focus on zero trust architectures and identity access management (IAM), which are essential to mitigate the risks associated with critical vulnerabilities.

Future perspectives

Looking ahead, it is likely that the use of artificial intelligence for vulnerability discovery will continue to grow. However, this trend presents both opportunities and challenges. On one hand, AI can help identify vulnerabilities more quickly and accurately. On the other hand, the increase in the volume of patches will require more advanced solutions for management and prioritization, which may include the widespread adoption of DRaaS services (Disaster Recovery as a Service) and enterprise backup solutions to ensure operational continuity.

The evolution of the regulatory landscape

As the deadlines for NIS2 and DORA compliance approach, organizations must prepare for an increase in regulatory pressure. The new regulations require not only patch management but also the demonstration of complete digital operational resilience. This implies that companies will need to invest in Security Information and Event Management (SIEM) and Data Loss Prevention (enterprise DLP) solutions to monitor and respond to threats in real time.

Editorial Note and Disclaimer

The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.

GoYou does not constitute a journalistic publication nor an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.

The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the improper use of the information published.

In the Crypto sector, every investment involves risks: readers are invited to always inform themselves autonomously before making any decision.