Microsoft released updates on Tuesday to address 1,093 security vulnerabilities across its Windows operating systems and supported software, including 63 critical flaws that attackers could use to take over a Windows system with little or no user interaction. Nearly half of the critical bugs are remote code execution vulnerabilities, and 535 of the flaws fixed this month allow an attacker to elevate privileges on a vulnerable device. The release is part of Microsoft's monthly Patch Tuesday.
One flaw is already being actively exploited, according to Microsoft: CVE-2026-124194, a spoofing bug in Outlook. The advisory for the vulnerability says it affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office. Microsoft attributes the high volume of fixes in recent months to advances in artificial intelligence that help find and address security bugs.
The November release follows more than 1,400 fixes Microsoft shipped last month and brings its total security patches so far this year to more than 5,100. A year ago, the company was averaging around 100 patches per month. Other software makers also issued important security updates this week.
Apple on Monday released out-of-cycle updates addressing at least nine vulnerabilities in iOS/iPadOS, macOS, watchOS and visionOS. The fixes include an iMessage flaw that could let a remote attacker join a group chat and receive its messages, along with a separate iMessage flaw that could let someone added to a group access messages sent before they joined. Lee Neely, an instructor at the SANS Institute, noted that Apple backported the fix to iOS 18.
Google released Chrome version 157.0.8103.50, which resolves nine security holes including CVE-2026-125350, the sixth zero-day vulnerability for Chrome this year; the bug is also patched in Chromium-based browsers such as Edge. The release follows Chrome's November 3 update, which fixed 213 vulnerabilities. Mozilla's Firefox 160, out today, resolves almost 100 CVEs, about half of them high severity. Adobe released patches for at least 110 vulnerabilities across a range of products, nearly half rated high severity, and said it has no evidence any of them are being actively exploited.
Chris Goettl, vice president of product management at Ivanti, said security teams at large enterprises can easily feel overwhelmed by the volume and criticality of recent Microsoft patches. He noted that while some 95,000 vulnerabilities have been assigned CVEs this year across all vendors, only 217 have been added so far this year to the Known Exploited Vulnerabilities list maintained by the U.S. Cybersecurity and Infrastructure Security Agency. Goettl said roughly four in ten of this year's exploited vulnerabilities sit in operating systems, endpoint software, browsers and server platforms, which a continuous patch strategy can close quickly, while the rest, especially the 44% in edge devices and IT management or remote access tools, calls for exposure management alongside patching.
More cybersecurity news from TechManNews.
