Patch Tuesday Statistics 2026: Microsoft Patched Three Times More Flaws, Not Three Times More Zero-Days
Patch Tuesday statistics are usually reported one month at a time. We pulled every monthly release from Microsoft’s Security Update Guide API since January 2021 and counted the vulnerabilities Microsoft itself assigned, leaving out the Linux and Chromium entries that the same feed now carries. The 2026 numbers break every prior year, but the count of flaws exploited before a fix did not move.
Every Patch Tuesday since 2021
2021 to 2025 2026 one exploited zero-day
Microsoft-assigned CVEs per monthly release, excluding Edge (Chromium-based), Azure Linux, and other third-party entries. Red dots above each bar stack one per CVE marked “Exploited: Yes”.
From 2021 to 2025, Microsoft fixed between 855 and 1,209 of its own CVEs a year. In 2026, the total through Sep is 2,859, up 219% on the same months of 2025, and 2,034 of those arrived in July, August, and September alone. The largest single release was 2026-Sep, with 993.
Where the surge came from
The third-quarter jump is spread across core products rather than one component. Product families with the most CVEs in July to September 2026, against the same quarter of 2025:
| Product family | Q3 2026 | Q3 2025 |
|---|---|---|
| Microsoft Office Excel | 95 | 15 |
| Microsoft Office | 72 | 12 |
| SQL Server | 68 | 10 |
| Microsoft Office Word | 67 | 8 |
| Microsoft Office SharePoint | 64 | 8 |
| Windows Biometric Service | 64 | 0 |
| Windows NTFS | 61 | 3 |
| Windows DHCP Server | 57 | 0 |
Zero-days did not triple
19 CVEs fixed in 2026 are flagged as exploited in the wild, compared with 20 in the same months of 2025. Most of the growth is in vulnerabilities found and fixed before attackers used them. For patch prioritization that is the key ratio: in 2026, roughly 1 in 150 Microsoft CVEs was exploited before its fix, against 1 in 45 a year earlier.
CVE-2026-20805Desktop Window Manager 2026-JanCVE-2026-21509Microsoft Office 2026-JanCVE-2026-21519Desktop Window Manager 2026-FebCVE-2026-21533Windows Remote Desktop 2026-FebCVE-2026-21513MSHTML Framework 2026-FebCVE-2026-21510Windows Shell 2026-FebCVE-2026-21514Microsoft Office Word 2026-FebCVE-2026-21525Windows Remote Access Connection Manager 2026-FebCVE-2026-32201Microsoft Office SharePoint 2026-AprCVE-2026-32202Windows Shell 2026-AprCVE-2026-41091Microsoft Defender 2026-MayCVE-2026-42897Microsoft Exchange Server 2026-MayCVE-2026-45498Microsoft Defender 2026-MayCVE-2026-56155Active Directory Federation Services (AD FS) 2026-JulCVE-2026-56164Microsoft Office SharePoint 2026-JulCVE-2026-58644Microsoft Office SharePoint 2026-JulCVE-2026-68820Windows Ancillary Function Driver for WinSock 2026-AugCVE-2026-81963Windows Update Stack 2026-SepCVE-2026-85880Windows ALPC 2026-Sep
Year by year
| Year | CVEs | Exploited | Critical | Remote code execution | Elevation of privilege | Cloud, no action |
|---|---|---|---|---|---|---|
| 2021 | 855 | 26 | 11.7% | 37% | 30% | 0 |
| 2022 | 917 | 17 | 9.4% | 33% | 41% | 0 |
| 2023 | 916 | 22 | 9.3% | 36% | 26% | 0 |
| 2024 | 1,039 | 26 | 7.0% | 39% | 30% | 23 |
| 2025 | 1,209 | 24 | 13.0% | 30% | 40% | 68 |
| 2026* | 2,859 | 19 | 15.8% | 24% | 45% | 174 |
*2026 is January to Sep. Critical is Microsoft’s maximum severity rating for the CVE. Impact is the most frequent impact rating across affected products.
What this means for MSPs
A tripling of monthly patch volume strains testing and deployment windows, but the exploited share fell. Treat the exploited and publicly disclosed CVEs as same-week deployments, follow Critical remote code execution flaws in internet-facing services next, and let the remaining volume flow through normal rings. Cloud-service CVEs marked as requiring no customer action can be excluded from patch reporting to clients.
Frequently asked questions
How many vulnerabilities did Microsoft patch in 2026?
From January to Sep 2026, Microsoft’s security update guide lists 2,859 CVEs assigned by Microsoft itself, compared with 896 in the same months of 2025. That already exceeds every full year in our series; the previous high was 1,209 in 2025.
How many zero-days has Microsoft patched in 2026?
19 of the 2026 CVEs are currently marked as exploited in the wild, compared with 20 in January to Sep 2025. The number of exploited flaws did not rise with the total.
Which Microsoft products have the most vulnerabilities in 2026?
In July to September 2026, the product families with the most CVEs were Microsoft Office Excel (95), Microsoft Office (72), and SQL Server (68).
What was the biggest Patch Tuesday?
2026-Sep, with 993 Microsoft-assigned CVEs in our data.
What are cloud CVEs with no customer action?
Since 2024-Jun, Microsoft has also published CVEs for vulnerabilities it fixed in its own cloud services, marked as requiring no customer action. There were 174 in 2026 through Sep. They count toward totals but need no patching by MSPs or clients.
Methodology
Source. Microsoft Security Response Center, Security Update Guide CVRF API v3.0, one document per monthly release, retrieved October 2026. The 2026 October release was not yet published at retrieval.
Filters. Kept CVEs whose assigning CNA note is Microsoft (or, in older documents with no CNA note, entries not tagged Azure Linux). Excluded security advisories (ADV), Microsoft Edge (Chromium-based) entries, and Azure Linux (Mariner) entries, which cover third-party open source packages. With these filters, monthly counts match Microsoft’s published totals for spot-checked months (for example, 48 in January 2024 and 142 in July 2024).
Coverage. The series starts in January 2021 because several earlier monthly documents in the API (including October 2017, September 2018, and March, April, and October 2020) now contain only backfilled Azure Linux entries.
Limitations. Exploited and severity flags reflect Microsoft’s current ratings, which can be revised after release. One CVE can affect several products; product family is the first tag listed.
Not advice. This is an analysis of public vulnerability data, not a patching recommendation for any environment.
Cite as:The Uptime Report. "Patch Tuesday Statistics 2026: Microsoft Patched Three Times More Flaws, Not Three Times More Zero-Days." October 2026. https://theuptimereport.com/patch-tuesday-statistics-2026/
References
- Microsoft Security Response Center, Security Update Guide. Accessed October 2026.
- MSRC CVRF API v3.0, updates index. Accessed October 2026.
Research library
More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research
Threats and breaches
- Password Statistics 2026
12,674 passwords tested against HIBP - Ransomware Groups 2026
Most active ransomware groups, ranked - Ransomware Statistics 2026
Leak-site victims by month since 2021 - Malicious npm Packages
Malicious npm packages, day by day - Cybersecurity Statistics 2026
70 sourced stats, every number traced - Zero-Day Statistics
Every tracked zero-day since 2014 - Phishing Statistics 2026
Four phishing measures, one evidence board - Disaster Declarations by State
FEMA data for continuity planning - Data Breach Statistics 2026
980 breaches in Have I Been Pwned - Ransomware Initial Access Vectors
CISA advisories coded by entry technique - CVE Statistics 2026
Vulnerabilities published per year, NIST NVD - How Long Do Companies Take to Report a Data Breach?
1,675 Washington notices - Known Exploited Vulnerabilities
The CISA KEV catalog analyzed - Healthcare Data Breach Report 2026
HHS OCR breach portal scorecard - Ransomware Reported to the FBI
Five-year IC3 trend
Infrastructure and uptime
- Windows 11 Market Share 2026
Windows 10 vs 11 share by country - Cloud Computing Statistics 2026
Hyperscaler revenue and capex, SEC data - AWS Outage History
Every AWS Post-Event Summary since 2011 - Data Centers by State 2026
Sites, jobs, power for every state - Data Center Statistics 2026
Data center power, spending, jobs - 99.9% Uptime
Uptime calculator and 35 real SLAs - Power Outage Statistics by State
Outage hours by state, EIA data - Cost of Downtime
Revenue per hour for 3,001 public companies - Windows Server End of Life
Support dates and CVEs per server version
Regulation and disclosure
- SEC Cybersecurity Incident Disclosures
Every 8-K Item 1.05 filing - HIPAA Enforcement Tracker
Every OCR penalty and settlement
Workforce and pay
- Tech Layoffs 2026
Tech layoffs from state WARN notices - Remote Work Statistics 2026
Telework by job, industry, and state - Highest Paying Cities for IT Jobs 2026
Metro pay by role, BLS OEWS - The Tech Job Market in 2026
Openings, quits, hires, layoffs - IT Salaries by State 2026
Pay matrix for four IT roles - IT and Cybersecurity Jobs Outlook 2026
BLS employment projections
MSP market and spending
- Cyber Insurance Statistics
Cyber insurance market, NAIC 2015-2024 - IT Spending by Industry
IT investment by industry, BEA - IT Services Industry Growth 2026
Census revenue by service industry - IT Hourly Rates 2026
Hourly IT labor rates, GSA contracts - VoIP Statistics 2026
Business VoIP vs landlines, FCC - MSP Industry Statistics 2026
Jobs, wages, and firms, BLS QCEW - Federal IT Spending 2026
IT services contracts, USAspending - IT Services Firms by State
Census business patterns atlas
Leave a Reply