Microsoft patches record 1,413 vulnerabilities, including exploited Windows Shell zero-day

Microsoft released a record Patch Tuesday with 1,413 vulnerabilities, surpassing its previous high of 1,261 CVEs in 2020. One Windows Shell flaw (CVE-2026-96951) is under active exploitation; 1,102 defects affect Windows and 134 affect Office.

• 1,413 vulnerabilities in a single update, beating the 2020 record of 1,261 CVEs
• Actively exploited zero-day CVE-2026-96951 in Windows Shell
• 1,102 flaws in Windows, 134 in Office, 61 in developer tools, 36 in SharePoint
• Microsoft introduced 'risk cohorts' to help prioritize patching