Microsoft Just Published More CVEs Today Than All of Last Year
1,408 Microsoft CVEs in one Patch Tuesday, against 1,244 in all of 2025, in a year when the whole CVE count has doubled: what that does to a patch queue, and how Empirical helps you work it.
Microsoft shipped its October security updates today with 1,408 new CVEs. In all of 2025, Microsoft published 1,244.
That is one Tuesday against twelve months, and the Tuesday won. It also isn't a fluke. It's the fourth straight month Microsoft's release has blown past anything it published before this summer, and it's landing in a year when the whole CVE Program has already doubled.
One Tuesday, One Year
Microsoft CVEs in each full year from 2016 to 2025, and on October 13, 2026
Microsoft's busiest full year before this one was 2020, at 1,262 CVEs. For most of the last decade it published between 700 and 1,250 a year. Today's release beats every one of those years, 2020 included, and clears 2025 by 164.
| Metric | Value |
|---|---|
| Microsoft CVEs released October 13, 2026 | 1,408 (Microsoft's count) |
| Microsoft CVEs in all of 2025 | 1,244 |
| Microsoft's busiest full year before 2026 | 1,262 (2020) |
| Microsoft CVEs Jan 1 to Oct 10, 2026 | 2,970 (936 in the same window of 2025) |
| All CVEs Jan 1 to Oct 10, 2026 | 76,765 (36,831 in the same window of 2025) |
| CVEs added to CISA KEV, Jan 1 to Oct 8, 2026 | 255 (196 in the same window of 2025) |
This Has Been Building Since July
For two years Microsoft's monthly release ran between 54 and 200 CVEs. Then July brought 570, August 402, September 965, and today 1,408. September 8 alone was 965 of Microsoft's 1,000 CVEs for the month. If you run Windows, your month is one day.
It's Not Just Microsoft
CVEs published January 1 to October 13, each year from 2016 to 2026. 2026 is 79,680, 2.15 times 2025's 36,998
As of noon Pacific today the CVE Program has published 79,680 CVEs this year, 2.15 times the same window of 2025, and it passed all of 2025 back in August. Even counting today, Microsoft is a small share of that growth: 3,413 of the 42,682 extra CVEs, 8%. GitHub and VulnCheck each added more, and Google Chrome, the Linux kernel and Oracle together added more than twice as much. Every one of those lands in somebody's scanner.
Most of It Will Never Be Exploited
The CVE count doubled. The number of CVEs CISA added to its Known Exploited Vulnerabilities catalog went from 196 to 255 over January 1 to October 8, up 30%. KEV is a floor, not a full count of exploitation, so the real number runs higher. Even so, the two curves aren't close.
September's release shows it at the scale of one day: 2 of its 965 Microsoft CVEs are in KEV today. Today's release starts the same way: Microsoft marked 1 of the 1,408 as already exploited. The rest still need patching eventually. They don't all need patching first.
How Empirical Helps a Team Work a Queue This Size
No team doubled its headcount this year, and none should have to. What has to change is the order of the work. That's the problem Empirical is built for.
Every CVE gets an exploitation score the day it publishes. Empirical maintains and trains EPSS. Its Foundation model combines EPSS with real-time exploitation telemetry. Customers can also run Radiant models trained on their own environment. A 1,408-CVE Tuesday becomes a ranked list instead of a pile.
Fixes are ranked by how much risk they remove. A Windows cumulative update closes many CVEs at once. Empirical ranks each fix by the share of an asset group's total risk it removes, so the question changes from "which of 1,408 CVEs?" to "which few updates, on which machines, first?"
The work goes where the work already happens. Ranked fixes export to ServiceNow as one problem per fix and one task per affected asset.
You hear about it when a CVE starts being exploited. Notifications fire when a CVE newly gains exploitation activity, by email or webhook, and you can filter them to a vendor like Microsoft. Today's low-scoring CVE that turns hot next week doesn't wait for next Patch Tuesday to get noticed.
What to Do This Week
If you patch Windows: plan for Patch Tuesday as a 1,000-plus CVE day from now on, and spend triage time on the updates that carry exploited or high-scoring CVEs before the rest of the cumulative stack.
If you run the vulnerability program: stop setting your SLAs and staffing against raw CVE counts. Volume measures how CVEs get published. Exploitation is what costs you.
If you report up: a chart that says "Microsoft CVEs doubled" without the KEV line next to it will be read as "Windows got twice as dangerous." It didn't.
One More Thing: It Was Two Hours Late
What time Microsoft's Patch Tuesday CVEs reached the CVE List, October 2024 to October 13, 2026, in Pacific time
Microsoft's records usually hit the CVE List within a few minutes of 10:00 a.m. Pacific. Today the first one landed at 11:56, the latest start since April 2023, and 95% were in by 12:01. I know because I spent those two hours refreshing four feeds every 90 seconds and eating ramen at my desk. The CVE List caught up in five minutes; the GitHub mirror and NVD that a lot of tools read were still nearly empty at 12:08. Worth knowing which one your scanner reads before next month.
Methodology and Reproducibility
CVE counts: the CVE List V5, published and non-rejected records, by datePublished. Microsoft counts are records with Microsoft as the assigning CNA. Year-over-year comparisons run from January 1 to 12:10 p.m. Pacific on October 13 in every year.
Patch Tuesday: the second Tuesday of each month, Microsoft-assigned CVEs published that day.
Today's release: the Microsoft Security Update Guide October 2026 release, counted at 19:03 UTC on October 13, Microsoft-assigned CVEs first released that day. Release timing from the CVE List datePublished of each Patch Tuesday's first Microsoft record; October 13 times from CVE Services, looked up per ID at 19:09 UTC, and the cvelistV5 mirror.
Exploitation: the CISA KEV catalog, release of October 8, 2026, counted by dateAdded.
Data collected and analyzed on October 13, 2026.
