Microsoft's Patch Count Went Up Six-Fold Since June. The Number Being Exploited Didn't Move.
This morning we called Microsoft's 1,415-fix Patch Tuesday a strange number and said nobody could explain it yet. Tonight we pulled Microsoft's own release data for every month of 2026, and the number isn't strange so much as it's the fourth step of a staircase. More useful than that, the one thing that matters to a small shop hasn't moved at all.
The staircase
We counted only CVEs where Microsoft is the assigning authority and that were first published in that month's release. That strips out the Linux, Chromium and open-source entries Microsoft also lists. From January through June 2026 Microsoft fixed between 61 and 220 of its own bugs a month, the same range as 2025. Then July jumped to 663. August was 456, September 998, October 1,417. October is about six times June.
We should have said this morning that the climb started in July. Calling October a one-off made it sound like a surprise, when it's a trend that has been building in plain sight for four months.
The flat line underneath it
Now cross every one of those fixes against CISA's catalog of vulnerabilities known to be exploited in the wild. January through June: 845 Microsoft fixes, 17 of them exploited, about 2 percent. July through October: 3,534 fixes, 10 exploited, 0.28 percent. Month by month the exploited count runs 3, 6, 0, 4, 4, 0, 5, 2, 2, 1. The pile got six times bigger and the number of bugs attackers actually use stayed where it has been all year.
One caveat, stated plainly. Recent months have had less time for a bug to be exploited and added later. So far, late additions have come in at one bug each from January, April, May, July and August. Even if September and October each pick up one or two more, the shape doesn't change.
Why that matters if you're the IT person
A lot of small shops run a simple rule: patch every Critical within a set window. In February that rule meant 7 Critical bugs. In September it meant 132. The rule didn't change, but the work it demands went up nineteen-fold while the risk it's meant to cover stayed flat. Severity ratings scale with volume. Exploitation hasn't.
So the triage that still holds is short.
Anything in CISA's Known Exploited Vulnerabilities catalog, by its due date. This month that's the Windows Shell Mark-of-the-Web bypass, CVE-2026-96951, and Ivanti Connect Secure, CVE-2026-104935, both due Thursday.
Then anything internet-facing: VPNs, mail servers, remote desktop gateways, DNS and DHCP servers reachable from outside.
Then anything that reads email or opens files from strangers, because that's how this month's exploited bug arrives.
Everything else rides the normal monthly cumulative update, which on Windows is one install whether it carries 120 fixes or 1,400.
That last point is the good news. What changed is the pressure to treat every Critical as an emergency. That pressure now exceeds the risk by a wide margin.
Who is finding all of these
The credits tell part of the story. In October, the ten most frequent credit lines show up on 640 fixes, and 219 fixes are credited only to "Anonymous." A single credit line appears on 52 fixes by itself. A September handle translates from Japanese as "AI Physical Interface Unit No. 2." Credits that name an AI tool, such as diffract-ai, z.ai's GLM, XBREACH.AI and Claude, ran about 8 percent of fixes in each of the last four months, a steady share of a growing pile.
We can't tell you how the other 92 percent were found, and we won't guess. What the data does show is industrial-scale finding concentrated in a small number of hands. Whether that comes from AI, fuzzing or both, Microsoft is shipping fixes at a rate it never has before, and defenders who rank by severity alone are drowning in it.
What we'll watch
The November release lands on the 10th. We'll rerun the same count against the same catalog and publish whatever it says, including if the exploited line finally moves. If it starts climbing alongside the pile, the triage above needs to change, and we'll say so.
Method: Microsoft Security Response Center CVRF documents 2026-Jan through 2026-Oct, counting CVEs whose assigning authority is Microsoft and whose first revision date falls in that release month. CISA KEV catalog as downloaded October 13, 2026. This method counts 1,417 for October; this morning's 1,415 was counted by product title, and the two-bug difference doesn't change anything above. Today's companion post on the release itself is "1,415 Patches, One Fire."
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=microsoft-patch-tuesday-volume-six-fold-exploited-flat-kev-2026
Comments