Microsoft — Security Activity Report

Windows + Azure + Office (MSRC advisories)

Generated Aug 27, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 24,515 CVEs with Microsoft advisories. Source: NVD CVE records joined with vendor advisory publish dates.

Severity Composition

↑ +4.8 pp

57.0% of Microsoft's 24,515 CVEs are CRITICAL or HIGH severity. Industry median: 52.2%. Source: NVD CVSS v3.1.

CRITICAL 1,243 (5.1%)HIGH 12,729 (51.9%)MEDIUM 9,411 (38.4%)LOW 509 (2.1%)NONE 494 (2.0%)

CISA KEV Listings

at industry median

135 of 14,814 Microsoft CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (0.9%). Industry median: 0.9%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↓ -2.9 days

Median time from CVE disclosure to Microsoft advisory: 5 days (p25 2 days – p75 40 days). Industry median: 8 days.

Sample size: 10,074 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across Microsoft's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

CWE-416Use After Free2,153 CVEs
CWE-122Heap-based Buffer Overflow952 CVEs
CWE-125Out-of-bounds Read937 CVEs
CWE-476NULL Pointer Dereference922 CVEs
CWE-20Improper Input Validation642 CVEs

Recent Security Advisories

Latest advisories published by Microsoft, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

CVE-2022-31631CriticalCVSS 9.1
Aug 14, 2026
PDO::quote() may return unquoted string
CVE-2022-31631 vendor source ↗
CVE-2021-47645MediumCVSS 5.5
Aug 14, 2026
media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com
CVE-2021-47645 vendor source ↗
CVE-2026-62701HighCVSS 7.8
Aug 14, 2026
Windows Telephony Service Elevation of Privilege Vulnerability
CVE-2026-62701 vendor source ↗
CVE-2026-62708HighCVSS 6.4
Aug 14, 2026
Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-62708 vendor source ↗
CVE-2026-69152HighCVSS 7.5
Aug 14, 2026
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
CVE-2026-69152 vendor source ↗
CVE-2026-64676MediumCVSS 5.7
Aug 14, 2026
Kata Containers: Unauthorized mem-agent ttRPC methods let an untrusted host tamper with confidential-guest memory
CVE-2026-64676 vendor source ↗
CVE-2026-47243Critical
Aug 14, 2026
Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs
CVE-2026-47243 vendor source ↗
CVE-2025-49506HighCVSS 7.5
Aug 14, 2026
Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack
CVE-2025-49506 vendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Aug 27, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.

Spot a factual error in this report?

Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.