Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row

For the second consecutive month, Microsoft disclosed over 1,000 vulnerabilities in a single Patch Tuesday release, including 63 critical flaws and one actively exploited Outlook vulnerability (CVE-2026-124194) already added to CISA's Known Exploited Vulnerabilities catalog. The sheer volume of disclosures — over 5,160 vulnerabilities in a single year — underscores how difficult it has become for organizations to maintain an effective patching cadence. When a zero-day is actively exploited before patches are widely applied, attackers gain a significant head start against unpatched systems. This situation matters because a single unpatched Outlook vulnerability can serve as an initial access vector into an entire organization's network, as email clients are universally deployed and highly trusted.