Microsoft breaks record with 622 Patch Tuesday updates
Security patches address 622 vulnerabilities, 58 rated critical.
1Record-breaking update
Microsoft patched 622 vulnerabilities in this month's Patch Tuesday updates, more than tripling last month's record. 428 Chromium vulnerabilities affecting Edge aren't included in this count. 58 flaws are critical, with two actively exploited.
2Actively exploited vulnerabilities
Microsoft fixed two actively exploited flaws: an elevation of privilege in Active Directory Federation Services (CVSS 7.8) and an authentication bypass in SharePoint (CVSS 5.3). Both require some access but demand immediate patching.
3Notable critical vulnerabilities
Copilot has a CVSS 9.6 remote code execution flaw where even low-privileged Hyper-V users can run malicious code. Microsoft Exchange has a CVSS 9.6 spoofing vulnerability allowing JavaScript execution via crafted emails.
4Office application risks
16 remote code execution flaws were found in Microsoft Office, all scoring around CVSS 7.8. Issues include heap-based buffer overflows and use-after-free vulnerabilities. Users are advised to install updates immediately.
5Adobe's security patches
Adobe released patches for 64 vulnerabilities. ColdFusion's CVSS 9.9 path traversal flaw enables arbitrary code execution. Commerce suite has a CVSS 9.6 privilege escalation vulnerability from unsafe file uploads.
6The new normal in cybersecurity
The volume of vulnerabilities suggests AI-assisted bug hunting may be at play. While Microsoft didn't confirm AI's role, such patch volumes exceed human capacity alone. Security teams must prioritize these critical updates.