Microsoft’s streak of record-breaking vulnerability disclosures continued with a mega Patch Tuesday, containing 1,413 defects affecting the company’s various enterprise products and services. 

The monthly batch of patches surpassed the company’s previous annual record of 1,261 common vulnerabilities and exposures (CVEs) set in 2020. 

“Hundreds of CVEs in a single release used to be the exception — now it’s the baseline,” Dustin Childs, head of threat awareness at TrendAI’s Zero Day Initiative, wrote in an email. AI is partly to blame, he added, but it “isn’t creating these bugs out of thin air; it’s just shortening the time between a vulnerability existing and someone noticing it.”

Yet, for defenders understandably overwhelmed by the surge of defects found in Microsoft products, actively exploited zero-day vulnerabilities aren’t growing in kind.

“If there’s solace to be had, it’s in the fact that only one of these bugs is under active attack,” Childs wrote in a blog post. “If you go back to the hot 0-day summer of 2023, there were 17 Microsoft 0-days between January and October as opposed to 15 this year during the same period.”

Microsoft disclosed one actively exploited zero-day affecting Windows Shell — CVE-2026-96951 — that allows unauthorized attackers to bypass a security feature. The high-severity defect is the third Windows Shell vulnerability exploited this year, according to Satnam Narang, senior staff research engineer at Tenable. 

“There have been 26 Windows Shell vulnerabilities patched in 2026 through October, a staggering figure compared to previous years, with only 3 Windows Shell CVEs in 2025 and just one in 2024 and 2022,” he added.

The vast majority of defects Microsoft disclosed in this month’s security update affect Windows, its ubiquitous operating system , spanning 1,102 vulnerabilities combined. The update also included 134 vulnerabilities in Office, 61 in various developer tools and 36 in SharePoint Server. 

Microsoft tried to address the toll this monthly flood of vulnerabilities has on its customers by introducing “risk cohorts.” These groups of vulnerabilities don’t necessarily share a root cause or severity rating, but generally require a similar customer assessment that could guide prioritization efforts, the company said. 

“The volume isn’t the real story anymore,” Childs added. “What matters is that discovery is scaling faster than exploitation, so teams that triage by sheer CVE count instead of exploitability are burning cycles on the wrong bugs. Patch what’s proven, prioritized, and public, and treat everything else as this month’s new normal.”

The full list of vulnerabilities addressed this month is available in Microsoft’s Security Response Center.

The post Microsoft drops an actively exploited zero-day among record high of 1,413 vulnerabilities appeared first on CyberScoop.

Flock, the controversial public safety company entangled in controversy amid recurring law enforcement abuse of its products, gained authority to assign CVE IDs to vulnerabilities in its own products and grade those defects as a CVE Numbering Authority.

The manufacturer of various surveillance systems, including automated license plate readers (ALPRs) and AI-powered cameras, said it joined the global footprint of more than 550 CNAs to assess, coordinate and prioritize response to vulnerabilities internally.

“It allows us to move faster when researchers report findings, eliminate confusion from duplicate or conflicting vulnerability entries and give our customers a single, trusted source for security information about our products,” Chris Castaldo, chief information security officer at Flock, said in a statement. 

Security experts acknowledge that many vendors are granted CNA authority for good reason. Separately, Flock’s business has drawn considerable public and legal scrutiny over privacy concerns, along with multiple reports of police abusing the technology.

Controversies stemming from such misuse have impacted Flock’s credibility and could cloud how security researchers view the company as a CNA. The development also highlights the limitations of the CVE program, including what constitutes a vulnerability. 

“The measure of Flock as a CNA is whether its records give cities, police departments, and the public enough detail and accuracy to let people track specific risks by product version, the nature of the vulnerability, and ideally how to mitigate or fix it,” Katie Moussouris, founder at CEO at Luta Security, told CyberScoop.

Flock declined to answer questions or make an executive available for an interview, and instead referred back to a blog post.

The company published its vulnerability disclosure policy in August and recently created a security advisories page where it will publish all newly discovered and confirmed vulnerabilities going forward.

Zach Edwards, a security and privacy researcher, noted that numerous activists have done technical teardowns of Flock’s products and said he expects some researchers to continue disclosing Flock vulnerabilities without coordinating with the company.

Researchers last year reported multiple defects in Flock’s license-plate reader and gunshot detection system, which the company submitted for inclusion in the National Vulnerability Database, but deemed not material because the vulnerabilities require physical access to the device. 

“These cameras sit on poles on public streets,” Moussouris said.

Because CNAs are “essentially grading their own homework,” as Edwards put it, credibility and trust have to be earned consistently by properly addressing every defect that meets a reasonable threshold.

“Vendors make sense as CNAs for their own products if they can be trusted to maintain accurate records. They know the code, they can confirm the flaw, and they can tie the record to affected versions and the fix,” Moussouris said. 

“The conflict of interest manifests when they lack the organizational and technical maturity to correctly assess the flaws and their impact,” she added. “A vendor in the CNA role writes the description and often sets the severity score, so an immature vendor may inaccurately represent an issue, either through ignorance or in a misdirected effort to downplay it.”

Flock’s vulnerability disclosure policy specifically disallows testing against live customer deployments, accessing law enforcement or investigative data, physical attacks, denial-of-service testing or social engineering. The company does not run a paid bug bounty program.

“Flock stands out as a CNA because its products track drivers’ movements, its customers are police, and its policy reserves the right to hold back publication if it decides disclosure would create a safety risk to law enforcement or the public,” Moussouris said. “The latter may lead to an abuse in their authority and control of CVEs unless they embrace a more mature customer-safety-first stance of timely, transparent, and accurate vulnerability disclosure.”

Edwards is also dubious about Flock’s position as a CNA, but adds that many vendors, including some offering similar products, are already in the program. 

There are also relatively few norms in how CNAs operate because the responsibility ultimately comes down to each participating vendor. Some companies granted CNA authority are incredibly active while others haven’t publicly disclosed vulnerabilities in their products for years.

“Only time will tell how Flock operates their CVE program and if they issue CVEs for vulnerabilities publicly disclosed,” Edwards said. “But, if their recent history is any indication, they will probably screw it up in some epic way that somehow unites people across the United States to demand CVE issuing reform.”

The post Flock can now issue CVEs for its own products. Should we trust it? appeared first on CyberScoop.

Citrix customers just got through back-to-back weekends filled with varying levels of uncertainty and worry, as yet another actively exploited zero-day vulnerability was discovered in Citrix NetScaler products.

Researchers and security experts said the vulnerability — CVE-2026-88779 — is less concerning because exploitation triggers denial of service and only impacts instances that have SAML (security assertion markup language) enabled. 

“This means it doesn’t work out of the box against every NetScaler deployment,” Jake Knott, head of threat intelligence at watchTowr, told CyberScoop. “While this is very inconvenient, it doesn’t have organizations scrambling to trigger incident response.”

Citrix was much quicker and consistent in alerting customers to the emerging threat Friday, and followed up the next day with a more detailed blog post and security advisory that contained a patch for the high-severity defect. 

“After we were alerted to this issue we immediately developed and published a mitigation while concurrently developing, testing and deploying a fix,” a company spokesperson said in a statement. “The fix for this issue is available, and we urge all customers to quickly apply it to their NetScaler instance.”

The Cybersecurity and Infrastructure Security Agency added the defect to its known exploited vulnerabilities catalog Sunday.

The vendor’s response also provided some relief for customers and researchers who spent much of the previous weekend rushing to assess widespread rumors of other defects in the assailed network edge gateways. In that case, Citrix took most of the weekend to confirm attackers were actively exploiting a pair of NetScaler zero-days, some of which researchers said remained undetected for at least three weeks.

“Citrix did a better job with their response to this vulnerability,” and took steps that enabled customers to make their own risk-based decisions with more currently available information, said Joe Toomey, vice president of underwriting security at insurance provider Coalition. 

“Although it’s difficult to celebrate given this is the third publicly-exploited NetScaler zero-day vulnerability in a two-week window, it is a step in the right direction,” he added. 

Citrix declined to say how many customers are impacted by the latest zero-day or when the first instance of exploitation occurred. Yet, Knott at watchTowr said exploitation likely began Friday. 

The newer defect doesn’t share any technical links with the pair of zero-days Citrix disclosed less than a week prior, but it can accelerate one of those vulnerabilities — CVE-2026-88771 — by intentionally crashing machines to speed up exploitation, Knott said.

While risk is currently perceived low for CVE-2026-88779, it is “incredibly simple to trigger, with a single specially crafted request being all that is needed to knock an appliance offline,” Knott added. “Exploitation is already occurring in the wild, and disrupting an authentication gateway can prevent legitimate users from accessing the services behind it.”

Toomey also described the denial-of-service vulnerability as less serious than the previous week’s actively exploited zero-days. Yet, he noted, exploitation attempts of CVE-2026-88779 “clearly contain shellcode that implies that the threat actor believes they can use this vulnerability, or chain it with another vulnerability, in order to achieve remote-code execution.”

The post Citrix discloses third actively exploited NetScaler zero-day in less than a week appeared first on CyberScoop.

Microsoft’s monthly Patch Tuesday security program reached an unrivaled pinnacle this month, as the vendor addressed 622 vulnerabilities across its suite of business products and systems. 

“The bug apocalypse has finally descended upon us,” Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative, wrote in a blog post Tuesday.

“The mother of all releases. To call this record-breaking is an understatement,” he added. “The CVE count year-to-date exceeds all other years’ totals.”

The startling increase in vulnerabilities reflects a compounding effect taking root across software as artificial intelligence plays a growing role in discovering and developing patches for defects lurking in error-riddled applications. 

Microsoft’s June Patch Tuesday update broke the previous all-time record with 206 vulnerabilities.

The company last week warned forewarned customers and defenders that a flood of defects would be uncovered as it applies its multi-model agentic scanning harness (MDASH) to discover and address vulnerabilities at greater speed and scale.

The monthly exponential rise in Microsoft vulnerabilities already puts the vendor on pace to break a full-year record, ending 2026 with the largest annual collection of defects, beating the previous record of 1,245 CVEs in 2020, Satnam Narang, senior staff research engineer at Tenable, said in an email. 

“It’s probable that we will not only exceed 2,000 CVEs in a calendar year, but potentially over 3,000 CVEs this year or more,” he added.

“The volume is striking, but it reflects how good these tools have become at finding bugs, not how many of those bugs actually pose a risk to organizations,” Narang said.

Microsoft disclosed two actively exploited zero-day vulnerabilities — CVE-2026-56155 and CVE-2026-56164, privilege escalation defects in Active Directory Federation Services and Microsoft SharePoint Server, respectively. 

The monthly batch of patches included 416 defects in Windows, 82 in Office and 46 in Microsoft Edge. More than 1 in 10 vulnerabilities the vendor disclosed — 63 total — were rated as critical.

“The products covered this month are also astonishing,” Childs said. “Just about everything you’ve ever heard of is getting patched.”

The full list of vulnerabilities addressed this month is available in Microsoft’s Security Response Center.

SAP also addressed a fresh assortment of vulnerabilities Tuesday, including critical defects CVE-2026-44747 in SAP NetWeaver Application Server and CVE-2026-27690 in SAP Approuter.

The post Microsoft discloses ‘the mother of all’ vulnerability loads, tripling June’s previous record appeared first on CyberScoop.