If you patch Windows, your monthly change just got ten times bigger. In January, Microsoft fixed 113 CVEs on Patch Tuesday. Yesterday it fixed 1,093.
That isn't Windows getting worse. It's AI getting very good at finding bugs, and that part isn't going back in the box. The CVE count is the headline. The real story is what all that change does to your apps, your scripts and your two-week window.
See every change proven with your own apps
We’ll run this month’s update against your real workflows, live, and you keep the receipts.
Every Patch Tuesday since July has beaten the first half's high of 198 CVEs
Microsoft CVEs fixed per Patch Tuesday, January to November 2026: 5,160 in total
|
113
|
54
|
83
|
163
|
118
|
198
|
569
|
398
|
964
|
1,407
|
1,093
|
| Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov |
Grey: January to June. Blue: July onwards. Source: Tenable Patch Tuesday reviews (Microsoft-only CVEs).
For six months, a big Patch Tuesday was about 200 CVEs. Then July shipped 569, and nothing since has come close to the old normal. October set the record at 1,407, more than twelve times January.
| Patch Tuesday 2026 | Microsoft CVEs fixed | vs. Jan–Jun average (122) |
|---|---|---|
| January | 113 | 0.9x |
| February | 54 | 0.4x |
| March | 83 | 0.7x |
| April | 163 | 1.3x |
| May | 118 | 1.0x |
| June | 198 | 1.6x |
| July | 569 | 4.7x |
| August | 398 | 3.3x |
| September | 964 | 7.9x |
| October | 1,407 | 11.6x |
| November | 1,093 | 9.0x |
That's 5,160 CVEs in eleven releases, and 4,431 of them landed in the last five. All counts are Tenable's Microsoft-only figures. Headline totals that include Chromium and other third-party fixes run higher (1,411 in October and 1,235 in November, per BleepingComputer). Whichever count you pick, the line isn't flat.
A step that sharp, over a single summer, doesn't look like worse code. It looks like a change in how bugs get found. The timeline lines up:
AI is also on the fixing side. Microsoft says AI now helps its engineers with remediation, though they still review the work. Cheaper finding plus faster fixing means more CVEs per release. ZDI's Dustin Childs put it plainly: AI is “accelerating bug-hunting on both sides of the fence.”
One fair caveat. Not everyone thinks AI explains all of it, and Fortra's Tyler Reguly called it “a slight difference” back in June. That was before July happened.
I keep hearing people treat October as a spike. I don't think it is. The models that found these bugs aren't getting worse, they're getting cheaper, and every vendor is pointing them at its own code now.
Microsoft itself told customers in May that patch volume would “continue trending larger for some time.” Anthropic expects its open-source finding count to keep rising too. In June, Tenable's Satnam Narang said he'd expect 100-plus CVEs a month to become the norm. We blew through that by a factor of ten within a quarter.
And the clock got shorter at the same time. Microsoft now warns attackers can build exploits from a published fix potentially within hours. Its own data from August says fewer than half of enterprise devices had the update two weeks after release. So you're being asked to ship ten times the change, faster, with the same team. Honestly, that math doesn't work by hand.
Every one of those fixes is a change to code your apps depend on. This month's release shows how quietly that bites.
PowerShell script signing got stricter. The Windows 10 ESU and LTSC update (KB5131096) adds stricter UTF-8 validation for signed scripts. Badly encoded scripts can now fail their signature check. Think about the install wrappers written by someone who left in 2019, the Intune detection scripts, and the “fix this” script you pushed at 4pm on a Friday and never thought about again. A stray BOM or a pasted smart quote is enough. Nobody owns those scripts, so nobody notices until the ticket comes back with a different title.
Memory integrity (HVCI) is switching on for more devices. The Windows 11 update (KB5132061) widens HVCI to more eligible machines. That's good security. It's also a classic way for an old driver-dependent app to install cleanly and then just not work.
DPAPI has a deadline. Prompt-based DPAPI now warns ahead of its retirement in April 2027. That date will arrive faster than you think.
Microsoft lists no known issues for Windows 11 this month. That means nobody has told Microsoft yet. It doesn't tell you anything about your apps.
You can't read 1,093 release notes and reason about each one by hand. You need the same checks, every month, on real endpoints.
That list is the gap, and it gets longer every month the CVE count goes up. It's the part we built ATP360 for. Your patching and detection tools tell you a change is coming. ATP360 runs your real workflows against it in your tenant, collects the evidence, and hands it to a human who makes the call. Production is never touched. One team took a validation cycle from 3 weeks to 23 minutes. Same build.
AI made finding bugs cheap. Proving your apps still work after the fix shouldn't be the expensive part.
See every change proven on your own apps. We'll run this month's update against your real workflows, live, and you keep the receipts.
P.S. I'm not going to tell you AI will stop the CVE count climbing. It won't. It's why the count is climbing. But the same shift that's flooding Patch Tuesday is what makes checking every change, every month, finally realistic.