Microsoft has listed 974 vulnerabilities with Common Vulnerabilities and Exposures (CVE) identifiers in its latest security release, including two Windows privilege-escalation flaws it said are already being exploited.
Those 974 CVEs do not represent 974 separate updates. The release comes as Microsoft moves AI-assisted vulnerability discovery into its engineering workflows and the CVE Program reports a sharp increase in published vulnerability records.
AI accelerates discovery, but CVE counts are not patch counts
Microsoft said in April that advanced AI models can autonomously discover weaknesses, chain lower-severity flaws into working exploits and generate proof-of-concept code.
A month later, the company said its MDASH multi-model system, which coordinates more than 100 specialized AI agents, had helped researchers find 16 Windows vulnerabilities, including four critical remote-code-execution flaws.
By June, Microsoft said MDASH had moved into active engineering workflows across Windows, Azure and identity systems.
The CVE Program reported 20,709 published records in the second quarter of 2026, up more than 36% from 15,176 in the first quarter. The program has linked the growing volume and velocity of vulnerability discovery to AI-assisted research, automation and large-scale analysis, with effects extending into reporting, validation, remediation and downstream vulnerability management.
Its release notes list 723 Windows vulnerabilities but 32 distinct cumulative updates (CUs). Office lists 111 vulnerabilities and 11 cumulative updates, with Office 2016 listed separately, while 62 SQL vulnerabilities are associated with one cumulative update.
Packaging fixes together reduces the number of updates administrators deploy, but Gene Moody, field chief technology officer at patch-management vendor Action1, said it does not remove the testing burden for critical workloads.
“When you apply a CU, you have to account for everything it changed,” Moody told TechInformed. According to Moody, Workstations can generally tolerate broader deployment, he added, but business-critical systems may require a more selective deployment approach or temporary mitigation before an update can be applied.
Microsoft’s own September deployment guidance shows how those deployment requirements can differ. Devices running Windows Server 2025 Datacenter: Azure Edition that are enrolled in hotpatching must take September’s release as a standard update and restart because some security changes affect components that cannot be updated without rebooting.
Moody said patches can be delayed by staffing shortages, competing priorities and policies or procedures that have not adapted to faster threat cycles.
Remediation timelines are stretching longer
Verizon’s 2026 Data Breach Investigations Report provides a separate measure of remediation performance. It found that only 26% of vulnerabilities it classified as critical because they appeared in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities catalog were fully remediated in 2025, down from 38% a year earlier.
Median time to full resolution rose from 32 to 43 days, and the median organization had 50% more critical vulnerabilities to address.
Those figures do not establish that AI caused remediation to slow. They show that organizations in Verizon’s dataset were already taking longer to close a growing number of vulnerabilities with confirmed exploitation.
However, not every vulnerability carries that same urgency and the share that does is smaller than the headline CVE count suggests.
Exploitation evidence narrows the queue
More vulnerability disclosures do not translate one-for-one into exploited flaws.
VulnCheck found first-time exploitation evidence for 495 CVEs in the first half of 2026, equivalent to about 1.4% of the CVEs disclosed during the period. Among 1,061 vulnerabilities it identified as discovered using AI tools, 14, or 1.3%, had evidence of real-world exploitation.
A low exploitation rate among disclosed CVEs doesn’t mean exploitation is rare in breach data. In Verizon’s dataset of breaches excluding its Error and Misuse categories, vulnerability exploitation accounted for 31% of known initial-access vectors, compared with 13% for credential abuse.
Exploitation frequency is only part of the prioritization problem; timing matters too. Mandiant estimated mean time to exploitation at negative seven days across the vulnerabilities it analyzed, meaning exploitation preceded patch availability on average.
Two external signals distinguish documented or predicted exploitation from severity alone. CISA maintains its Known Exploited Vulnerabilities catalog for flaws with documented exploitation in the wild.
The Forum of Incident Response and Security Teams’ (FIRST) Exploit Prediction Scoring System (EPSS) estimates the probability that an individual CVE will be exploited over the following 30 days.
Moody said those signals still have to be matched to the systems an organization actually runs. His starting point is an accurate asset inventory followed by classification according to business impact. A vulnerability affecting payroll, customer-facing infrastructure or identity systems can create different consequences, and the same vulnerability can represent different levels of risk on two systems inside the same company.
For that reason, Moody said severity alone should not determine deployment order. A severity score does not establish whether the affected software is present in a particular environment, exposed to the internet or attached to a business-critical system.
Action1’s September assessment applies that approach to Microsoft’s release. It puts the two actively exploited Windows privilege-escalation vulnerabilities at the front of the queue, then gives additional weight to unauthenticated remote-code-execution flaws affecting infrastructure such as DNS, DHCP and failover clustering.
The assessment also weighs exposure, authentication requirements, privilege impact and the role of the affected system rather than treating every critical vulnerability alike.
Decision-making bottlenecks slow remediation
Moody pointed to decision-making as another source of delay before remediation. For smaller organizations, he described vulnerability management in three stages: learning that a vulnerability exists, finding it in the organization’s systems and remediating or mitigating it.
“Most do not fail at application, they fail at making timely decisions,” Moody told TechInformed. If the workload exceeds available staff, he said, vulnerability management becomes a business-continuity issue requiring management involvement rather than an IT-only problem.
Ultimately, the same conundrum appears in Microsoft’s own work. Its researchers said: “Finding the bug is half the job. Closing it is the other half.”