Microsoft — Security Activity Report

Windows + Azure + Office (MSRC advisories)

Generated Jul 29, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 23,163 CVEs with Microsoft advisories. Source: NVD CVE records joined with vendor advisory publish dates.

2,25420222,10220233,40920243,74920255,7032026

Severity Composition

↑ +3.5 pp

56.1% of Microsoft's 23,163 CVEs are CRITICAL or HIGH severity. Industry median: 52.6%. Source: NVD CVSS v3.1.

CRITICAL 1,073 (4.6%)HIGH 11,927 (51.5%)MEDIUM 8,974 (38.7%)LOW 478 (2.1%)NONE 501 (2.2%)

CISA KEV Listings

at industry median

133 of 13,659 Microsoft CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (1.0%). Industry median: 1.0%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↓ -4.3 days

Median time from CVE disclosure to Microsoft advisory: 6 days (p25 2 days – p75 48 days). Industry median: 11 days.

Sample size: 9,296 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across Microsoft's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

  • CWE-416Use After Free2,016 CVEs
  • CWE-476NULL Pointer Dereference907 CVEs
  • CWE-125Out-of-bounds Read861 CVEs
  • CWE-122Heap-based Buffer Overflow838 CVEs
  • CWE-20Improper Input Validation551 CVEs

Recent Security Advisories

Latest advisories published by Microsoft, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

  • CVE-2026-44210Medium
    Jul 27, 2026

    Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

    CVE-2026-44210
  • CVE-2026-16493HighCVSS 7.8
    Jul 27, 2026

    Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)

    CVE-2026-16493
  • CVE-2026-56852HighCVSS 7.5
    Jul 27, 2026

    Infinite loop on invalid input in golang.org/x/text

    CVE-2026-56852
  • CVE-2026-10822MediumCVSS 6.5
    Jul 27, 2026

    Key Record using PRIVATEDNS algorithm may lead to unexpected exit

    CVE-2026-10822
  • CVE-2026-13204MediumCVSS 7.5
    Jul 27, 2026

    Unexpected exit in certain situations with NSEC and NSEC3 both present

    CVE-2026-13204
  • CVE-2026-10723MediumCVSS 6.8
    Jul 27, 2026

    Incorrect acceptance of NSEC3 records

    CVE-2026-10723
  • CVE-2026-11605MediumCVSS 7.5
    Jul 27, 2026

    Unnecessary validation of DNSSEC signed records

    CVE-2026-11605
  • CVE-2026-11331MediumCVSS 7.5
    Jul 27, 2026

    Potential wildcard CNAME RPZ policy bypass

    CVE-2026-11331

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

  • NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
  • MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
  • CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
  • Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
  • MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Jul 29, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.

Spot a factual error in this report?

Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.