---
title: "Microsoft’s patch count rose from 71 to 1,475 a month; exploited flaws stayed flat"
summary: "Our count of Microsoft’s own security-update files, November 2025 to November 2026: the flaws fixed each month, the few exploited, and how to sort a release of 1,000 entries."
url: https://www.thetechbag.com/blog/microsoft-patch-count-71-to-1475-exploited-flat
format: Trend
desk: "Security"
area: "Risk & compliance"
region: Global
published: 2026-11-12
facts_checked: 2026-11-12
author: TechBag (The TechBag Journal)
tags: ["Patch Tuesday November","Microsoft Patch Tuesday","Microsoft security updates","exploited vulnerabilities","Outlook zero-day","CVE-2026-124194","MSRC","Security Update Guide","CISA KEV","known exploited vulnerabilities","patch management","vulnerability prioritisation","risk cohorts","SharePoint","Windows","CVE count","NTLM"]
cover: https://www.thetechbag.com/blog/covers/microsoft-patch-count-71-to-1475-exploited-flat.png
---

# Microsoft’s patch count rose from 71 to 1,475 a month; exploited flaws stayed flat

*Our count of Microsoft’s own security-update files, November 2025 to November 2026: the flaws fixed each month, the few exploited, and how to sort a release of 1,000 entries.*

Trend · Security · Risk & compliance · By TechBag · Published 2026-11-12 · Facts checked 2026-11-12 · Canonical: https://www.thetechbag.com/blog/microsoft-patch-count-71-to-1475-exploited-flat

The short version

1. Microsoft fixed 1,095 security flaws of its own in its November release, after 1,475 in October. In November 2025 the figure was 71. That makes 5,533 so far in 2026, by our count of Microsoft’s own data.[1][2]
2. Exploited flaws did not follow. Microsoft flagged between 0 and 6 a month as exploited, and one in November: an Outlook flaw it rates Moderate. Of 31 exploited Microsoft flaws in these 13 months, counting 8 that CISA listed later, 5 were rated Critical.[1][6]
3. So the order is exploited first, from Microsoft’s flag and CISA’s catalogue, then what is exposed, then the rest on the monthly cycle. In November, 102 of the 1,095 entries carried one of Microsoft’s three urgent markers.[1][4]

On the second Tuesday of every month Microsoft publishes its security updates with a machine-readable file that lists every flaw they fix. We counted thirteen of those files, November 2025 to November 2026, with one rule throughout (the method box gives it). The number of flaws grew more than fifteenfold in a year. Does that mean fifteen times the risk, and how does an IT team sort a month with more than a thousand entries?[1][2]

## From 71 to 1,475 in eleven months

The count stayed between 61 and 220 a month from November 2025 to June 2026, then jumped: 663 in July, 998 in September, 1,475 in October and 1,095 in November.[1][2] November’s release note gives Microsoft’s own figure, 1,094, and splits it by product family: Windows 726, Office 174, SQL Server 59, developer tools 53, SharePoint Server 27, Azure 20 and Exchange Server 9.[3] Krebs on Security counted 1,093, the entries published on release day.[7]

**Figure: Microsoft fixed 1,475 flaws in October and 1,095 in November, against 71 a year earlier**

*Security flaws (CVEs) numbered by Microsoft in each monthly release file, November 2025 to November 2026*

|  | Microsoft-numbered flaws |
| --- | --- |
| Nov ’25 | 71 |
| Dec ’25 | 65 |
| Jan | 124 |
| Feb | 61 |
| Mar | 97 |
| Apr | 181 |
| May | 162 |
| Jun | 220 |
| Jul | 663 |
| Aug | 457 |
| Sep | 998 |
| Oct | 1,475 |
| Nov | 1,095 |

Source: Microsoft Security Response Center, CVRF release files; TechBag count · as of 12 November 2026 · Excludes the Chrome, Linux and other third-party flaws Microsoft republishes

A patch count measures catalogued flaws, not updates to install. Each CVE is one flaw with its own number. Windows 10 and 11 updates are cumulative: one monthly package for each Windows version carries every security fix, so November’s 726 Windows flaws arrive in a handful of installs, one per version.[3] Nor is the count padded with cloud fixes that need nothing from the customer: 3 of November’s 1,095 entries are marked as needing no customer action.[1]

Severity rose more slowly than volume. Flaws rated Critical went from 12 in November 2025 to a high of 132 in September and 64 this month, so their share fell from 17% to under 6%.[1][2] Microsoft’s release data does not say why the count rose. The one line we found is in its Security Response Center’s post of 13 October, on sorting large releases: “As AI-assisted research contributes to vulnerability discovery, this kind of approach may become more useful.”[4]

## Exploited flaws stayed flat, and most were not rated Critical

The number that decides urgency barely moved. When it ships a fix, Microsoft marks the flaws it knows are being exploited. That flag was set on 0 to 6 flaws a month, 23 in thirteen months, and on 8 in the five months from July, when 4,688 flaws were fixed.[1][2] CISA’s catalogue of exploited flaws adds 8 more from the same files that Microsoft’s entries still do not mark as exploited, 5 of them in SharePoint Server, listed between 8 days and five months after the fix.[6]

**Figure: Exploited Microsoft flaws stayed between 0 and 6 a month while the total rose fifteenfold**

*Microsoft-numbered flaws known to be exploited, by month of the fix: as flagged by Microsoft, and with CISA's later listings added, November 2025 to November 2026*

|  | Flagged by Microsoft | With CISA's later listings |
| --- | --- | --- |
| Nov ’25 | 1 | 2 |
| Dec ’25 | 1 | 1 |
| Jan | 2 | 3 |
| Feb | 6 | 6 |
| Mar | 0 | 0 |
| Apr | 2 | 4 |
| May | 3 | 4 |
| Jun | 0 | 0 |
| Jul | 3 | 5 |
| Aug | 1 | 2 |
| Sep | 2 | 2 |
| Oct | 1 | 1 |
| Nov | 1 | 1 |

Source: Microsoft Security Response Center, CVRF release files; CISA Known Exploited Vulnerabilities catalogue, version 2026.11.10; TechBag count · as of 12 November 2026 · Recent months have had the least time to reach CISA's list

Of those 31 exploited flaws, Microsoft rated 5 Critical, 22 Important, 3 Moderate and 1 Low. A team that patched Critical flaws first and the rest later would have left 26 of the 31 in the later pile.[1][6]

November’s exploited flaw, CVE-2026-124194, is rated Moderate, with a CVSS score of 6.5. Microsoft says a crafted message file opened in Outlook can make it connect to an attacker’s server without the usual external-content warning, disclosing the user’s NTLMv2 hash, which can be used to sign in as that user. It affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024.[5] CISA added it to its catalogue on 10 November, with a due date of 24 November for US federal agencies.[6]

TechBag countHow we matched the two lists

We read the exploited flag in each Microsoft file as it stood on 12 November, then looked up every Microsoft flaw CISA added from 1 November 2025 to 10 November 2026. 23 carry both. 8 are on CISA’s list only; we count them in the month whose file holds the fix. CISA’s other Microsoft additions in that time are older flaws, from 2008 to 2025, not in these files.

|  | Microsoft flaws | Critical | Exploitation More Likely | Flagged exploited | Later on CISA's list |
| --- | --- | --- | --- | --- | --- |
| Nov ’25 | 71 | 12 | 6 | 1 | 1 |
| Dec ’25 | 65 | 8 | 7 | 1 | 0 |
| Jan | 124 | 17 | 8 | 2 | 1 |
| Feb | 61 | 7 | 6 | 6 | 0 |
| Mar | 97 | 19 | 6 | 0 | 0 |
| Apr | 181 | 23 | 18 | 2 | 2 |
| May | 162 | 46 | 18 | 3 | 1 |
| Jun | 220 | 48 | 16 | 0 | 0 |
| Jul | 663 | 78 | 44 | 3 | 2 |
| Aug | 457 | 84 | 37 | 1 | 1 |
| Sep | 998 | 132 | 57 | 2 | 0 |
| Oct | 1,475 | 94 | 104 | 1 | 0 |
| Nov | 1,095 | 64 | 42 | 1 | 0 |

## How to sort a thousand entries, and what to watch

Microsoft’s post of 13 October says each flaw still needs its own review, but that in a large release many share one question about the customer’s own systems: is the role deployed, can untrusted content reach it, who can cross the privilege boundary. It calls these groups “risk cohorts” and illustrates 15 of them, from Office documents and mail clients to remote access and RDP. It calls them exploratory, not an official category, and the Security Update Guide does not show them.[4] Put together with the counts above, the order runs like this:

- **Exploited first.** Microsoft’s “Exploitation Detected” flag, and CISA’s catalogue checked again during the month, because 8 of the 31 exploited flaws above are marked only there, some months after the fix.[6]
- **Exposed roles next.** Servers that untrusted users or the internet can reach: SharePoint, Exchange, remote-access gateways, DNS. Microsoft’s own example is to put an RD Gateway reachable from outside the network ahead of client-side flaws.[4]
- **Then Critical and “Exploitation More Likely”.** November has 64 and 42; with the one exploited flaw, 102 entries, about one in eleven.[1]
- **The rest on the monthly cycle.** Test and roll out each Windows version’s cumulative update; most of the 726 Windows flaws need no separate decision.[3]

**What to watch.**

- **8 December,** the next release: whether the count stays above 1,000 for a third month.
- **CISA’s additions from the September to November files.** They have had the least time to arrive, and earlier months gained up to two later listings each.[6]
- **A statement from Microsoft** on what is driving the volume, and whether risk cohorts reach the Security Update Guide.[4]

For the order to patch across other vendors in a single week, see [our Analysis of every critical fix of 20 to 29 October](https://www.thetechbag.com/blog/one-week-php-node-java-oracle-critical-patches).

How we did this

Figures as of 12 November 2026, 8:30pm IST

We read Microsoft’s CVRF release files for 2025-Nov to 2026-Nov from its Security Update Guide API as they stood on 12 November (the October and November files were last revised early that day, UTC). An entry counts when its assigning-authority note reads “Microsoft”, so the Chrome flaws Microsoft republishes for Edge, the Linux kernel flaws it republishes for Azure Linux, and entries numbered by GitHub, MITRE and others are left out. Each CVE is counted once, in the month whose file holds it; that includes cloud-service flaws and a few entries published in the days before release (two in November). Microsoft’s release notes give slightly different totals (63 for November 2025, 173 for April, 999 for September, 1,474 for October, 1,094 for November) because entries were added to or moved between files after release day. Krebs on Security’s 1,093 for November matches the entries published on 10 November; it gives 63 Critical where we count 64, because we take the highest rating on any affected product. “Exploited” is “Exploited:Yes” in each entry’s exploitability field, which Microsoft sets at release and did not update for the 8 flaws CISA later listed; “Exploitation More Likely” comes from the same field. CISA’s catalogue is version 2026.11.10. The shares, sums and the November total of 102 entries carrying at least one urgent marker are our arithmetic.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [Microsoft Security Response Center, November 2026 Security Updates (CVRF file 2026-Nov)](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Nov) — 10 November 2026, revised 12 November 2026
2. [Microsoft Security Response Center, monthly CVRF files 2025-Nov to 2026-Oct](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Oct) — files as revised to 12 November 2026 Other months at the same address, changing the month.
3. [Microsoft Security Update Guide, release notes for November 2026](https://msrc.microsoft.com/update-guide/releaseNote/2026-Nov) — 10 November 2026
4. [Microsoft Security Response Center, Using risk cohorts to prioritize security updates](https://www.microsoft.com/en-us/msrc/blog/2026/10/using-risk-cohorts-to-prioritize-security-updates) — 13 October 2026
5. [Microsoft Security Update Guide, CVE-2026-124194: Microsoft Outlook Spoofing Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194) — 10 November 2026
6. [CISA, Known Exploited Vulnerabilities catalogue, version 2026.11.10](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) — 10 November 2026
7. [Krebs on Security, Microsoft Fixes Nearly 1,100 Security Vulnerabilities](https://krebsonsecurity.com/2026/11/microsoft-fixes-nearly-1100-security-vulnerabilities/) — 10 November 2026

**Disclosure.** TechBag is a software reseller: it earns when companies buy through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [Six days from patch to exploited: PHP, Node.js, Oracle and the order to fix them](https://www.thetechbag.com/blog/one-week-php-node-java-oracle-critical-patches) — Beyond Microsoft: every critical fix of 20 to 29 October across PHP, Node.js, Oracle and Java, put in patch order, and six days from patch to exploited.

Go deeper on TechBag

- [RMM and patch management guide](https://www.thetechbag.com/browse/endpoint-management/rmm-patch) — the tools that roll a monthly cumulative update out across a fleet
- [Vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) — tools that rank flaws by exploitation and exposure, not severity alone
- [Memory-corruption bugs fell from 31% to 14% of exploited flaws](https://www.thetechbag.com/blog/memory-corruption-share-exploited-flaws-falls) — which kinds of flaws reach CISA’s exploited list