In September, Microsoft released fixes for 999 vulnerabilities, marking one of the largest patch batches in company history. The update addressed 723 flaws in Windows alone, alongside 111 fixes for Office and Office 2016, 62 for SQL Server, and 25 for third-party projects. Two high-severity Windows vulnerabilities, CVE-2026-81963 and CVE-2026-85880, were actively exploited for local privilege escalation and unauthorized code execution; both have now been patched.

Microsoft is expanding its memory integrity protection across Windows 11, with rollout starting in October. This feature uses Virtualization-based Security (VBS) to isolate the kernel via hardware virtualization, assuming the kernel may already be compromised. It enables security hotpatches without requiring a restart, allowing critical systems to stay operational during updates. The company will continue stress-testing Windows kernel security, viewing this patch wave as a key step forward.