Microsoft released updates today to fix at least 398 security vulnerabilities across Windows and its supported software, including one flaw already being actively exploited in the wild and two others that were publicly disclosed before the patch shipped.
This month’s batch is smaller than July’s record-breaking release of more than 570 fixes, but it is roughly double June’s then-record haul of nearly 200 vulnerabilities. Microsoft has attributed the surge in patch volume to AI-assisted vulnerability discovery, and security experts say organizations should expect Patch Tuesdays covering hundreds of flaws to become the norm rather than the exception.
Of the 398 vulnerabilities patched today, 42 received Microsoft’s most severe “critical” rating, meaning attackers could exploit them to seize remote control of a Windows machine with minimal user interaction.
The Actively Exploited Flaw
The sole confirmed zero-day this month is CVE-2026-68820, a privilege escalation vulnerability in afd.sys, a core Windows driver that handles socket connections on nearly every endpoint. Security firm Automox described it as a second-stage exploit rather than an initial entry point, noting that attackers likely phish their way into a low-privilege foothold first, then use the driver flaw to escalate control. The vulnerability carries a 7.0 severity score, reflecting the high attack complexity of the race condition involved, though researchers noted someone is clearly succeeding at exploiting it regardless.
A second notable flaw, CVE-2026-62832, is a privilege escalation issue in the Windows User Profile Service that Microsoft flags as likely to be exploited. It may be connected to a recent public disclosure known as “LegacyHive.” A third flaw, CVE-2026-72971, is a low-impact local tampering issue that Microsoft considers unlikely to be exploited.
AI Cuts Both Ways
Other major vendors, including Adobe, Cisco, Google, Mozilla, and Oracle, are also shipping updates more frequently as AI accelerates vulnerability discovery. But researchers caution that AI is far less reliable at fixing bugs than finding them. A recent study from 1Password found that large language models generating patches for complex, newly disclosed vulnerabilities failed to fix the flaw, introduced a new weakness, or both, more than half the time.
SANS Technology Institute president Ed Skoudis said AI-generated patches can work well when paired with human oversight and iterative testing, but warned against relying on one-shot AI fixes.
Advice for Defenders
Security professionals note that despite the massive patch count, only one vulnerability this month is known to be under active exploitation, meaning teams don’t need to rush deployment. Experts recommend backing up systems before applying this month’s large update bundle and, where possible, waiting a few days to let any problematic patches get ironed out before wide deployment.