Microsoft released its first security update of 2026, fixing 112 vulnerabilities, including a zero-day in Desktop Window Manager that can leak sensitive information. While this zero-day is actively exploited, attackers need local access to the system to exploit it. Eight vulnerabilities were flagged as likely to be targeted this month.

Microsoft’s November 2025 Patch Tuesday updates resolved 63 vulnerabilities, including a critical zero-day in the Windows kernel actively under attack. The updates also addressed an Office vulnerability allowing unauthorized code execution. This month saw a significant decrease in reported flaws compared to October.

Microsoft's August 2025 Patch Tuesday addressed 107 vulnerabilities, including a critical zero-day in Windows Kerberos that could allow domain administrator privilege escalation. The update also fixed thirteen critical vulnerabilities, predominantly related to remote code execution and information disclosure, highlighting ongoing security challenges for Windows users.