Microsoft’s patch count rose from 71 to 1,475 a month; exploited flaws stayed flat

01From 71 to 1,475 in eleven months

The count stayed between 61 and 220 a month from November 2025 to June 2026, then jumped: 663 in July, 998 in September, 1,475 in October and 1,095 in November.¹² November’s release note gives Microsoft’s own figure, 1,094, and splits it by product family: Windows 726, Office 174, SQL Server 59, developer tools 53, SharePoint Server 27, Azure 20 and Exchange Server 9.³ Krebs on Security counted 1,093, the entries published on release day.⁷

A patch count measures catalogued flaws, not updates to install. Each CVE is one flaw with its own number. Windows 10 and 11 updates are cumulative: one monthly package for each Windows version carries every security fix, so November’s 726 Windows flaws arrive in a handful of installs, one per version.³ Nor is the count padded with cloud fixes that need nothing from the customer: 3 of November’s 1,095 entries are marked as needing no customer action.¹

Severity rose more slowly than volume. Flaws rated Critical went from 12 in November 2025 to a high of 132 in September and 64 this month, so their share fell from 17% to under 6%.¹² Microsoft’s release data does not say why the count rose. The one line we found is in its Security Response Center’s post of 13 October, on sorting large releases: “As AI-assisted research contributes to vulnerability discovery, this kind of approach may become more useful.”⁴

02Exploited flaws stayed flat, and most were not rated Critical

The number that decides urgency barely moved. When it ships a fix, Microsoft marks the flaws it knows are being exploited. That flag was set on 0 to 6 flaws a month, 23 in thirteen months, and on 8 in the five months from July, when 4,688 flaws were fixed.¹² CISA’s catalogue of exploited flaws adds 8 more from the same files that Microsoft’s entries still do not mark as exploited, 5 of them in SharePoint Server, listed between 8 days and five months after the fix.⁶

Of those 31 exploited flaws, Microsoft rated 5 Critical, 22 Important, 3 Moderate and 1 Low. A team that patched Critical flaws first and the rest later would have left 26 of the 31 in the later pile.¹⁶

November’s exploited flaw, CVE-2026-124194, is rated Moderate, with a CVSS score of 6.5. Microsoft says a crafted message file opened in Outlook can make it connect to an attacker’s server without the usual external-content warning, disclosing the user’s NTLMv2 hash, which can be used to sign in as that user. It affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024.⁵ CISA added it to its catalogue on 10 November, with a due date of 24 November for US federal agencies.⁶

03How to sort a thousand entries, and what to watch

Microsoft’s post of 13 October says each flaw still needs its own review, but that in a large release many share one question about the customer’s own systems: is the role deployed, can untrusted content reach it, who can cross the privilege boundary. It calls these groups “risk cohorts” and illustrates 15 of them, from Office documents and mail clients to remote access and RDP. It calls them exploratory, not an official category, and the Security Update Guide does not show them.⁴ Put together with the counts above, the order runs like this:

• Exploited first. Microsoft’s “Exploitation Detected” flag, and CISA’s catalogue checked again during the month, because 8 of the 31 exploited flaws above are marked only there, some months after the fix.⁶
• Exposed roles next. Servers that untrusted users or the internet can reach: SharePoint, Exchange, remote-access gateways, DNS. Microsoft’s own example is to put an RD Gateway reachable from outside the network ahead of client-side flaws.⁴
• Then Critical and “Exploitation More Likely”. November has 64 and 42; with the one exploited flaw, 102 entries, about one in eleven.¹
• The rest on the monthly cycle. Test and roll out each Windows version’s cumulative update; most of the 726 Windows flaws need no separate decision.³

What to watch.

• 8 December, the next release: whether the count stays above 1,000 for a third month.
• CISA’s additions from the September to November files. They have had the least time to arrive, and earlier months gained up to two later listings each.⁶
• A statement from Microsoft on what is driving the volume, and whether risk cohorts reach the Security Update Guide.⁴

For the order to patch across other vendors in a single week, see our Analysis of every critical fix of 20 to 29 October.