Do Emergency Microsoft, Oracle Patches Point to Wider Issues?
Microsoft’s emergency update, KB5085516, addresses an issue that arose after installing the mandatory cumulative updates pushed live on Patch Tuesday earlier this month. According to Microsoft, it has since emerged that many users experienced problems signing into applications with a Microsoft account, seeing a “no internet” error message even though the device had a working connection. This had the effect of preventing access to multiple services and applications. It should be noted that organisations using Entra ID did not experience the issue.Michael Bell, founder/CEO of Suzu Labs tells Computer Weekly that Microsoft’s patch for the sign-in bug follows “separate hotpatches for RRAS remote code execution flaws and a Bluetooth visibility bug. Three emergency fixes in eight days does not shout reliability era.”
But Microsoft’s emergency patch comes just days after it doubled down on a commitment to software quality, reliability and stability. In a blog post published just 24 hours prior to the latest update, Pavan Davuluri of Microsoft’s Windows Insider Program Team said updates should be “predictable and easy to plan around”.
Oracle’s patch, meanwhile, addresses CVE-2026-21992, a remote code execution flaw in the REST:WebServices component of Oracle Identity Manager and the Web Services Security component of Oracle Web Services Manager in Oracle Fusion Middleware. It carries a CVSS score of 9.8 and can be exploited by an unauthenticated attacker with network access over HTTP.
Funny!
Depends
I think Microsoft in general does a great job considering they test numerous software packages going back decades, as I understand it.
"
The real question is, each time this happens, do they sit down and have a meeting and discuss why the problem happened, what they can do to keep it from happening again, and then implement a solution in their testing? If so then it’s fine. It’s only if they fail to learn from each emergency that we have a problem.
Same should apply to Oracle.
Also not sure why we’re discussing these specific Microsoft and Oracle bugs. The bugs are not similar at all. Microsoft’s isn’t even a security issue like Oracle’s is.
Apply Betteridge’s Law
And the law of large numbers. Statistically, there will but patch clusters, the same way there are clusters of every other random-ish event. The fact that one happens to occur right after Microsoft promises a commitment to predictable patch schedules means not just nothing the but opposite. Any commitment to doing better means that they recognize they haven’t been doing well enough, and obviously it’s not possible to do significantly better immediately; changing processes takes time, and observing the effects of those changes takes even longer.
So, no, this cluster of patches doesn’t tell us anything in particular beyond what we already knew: That emergency patches are relatively common.
It points to AI slop code
It’s a huge problem but there isn’t really a solution.
What “wider issues”?
Vibe-coding?