Microsoft — Security Activity Report
Windows + Azure + Office (MSRC advisories)
Generated Oct 11, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗
CVE Disclosure Volume
Total all-time: 29,930 CVEs with Microsoft advisories. Source: NVD CVE records joined with vendor advisory publish dates.
Severity Composition
↑ +3.0 pp56.0% of Microsoft's 29,930 CVEs are CRITICAL or HIGH severity. Industry median: 53.0%. Source: NVD CVSS v3.1.
CISA KEV Listings
at industry median134 of 19,124 Microsoft CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (0.7%). Industry median: 0.7%.
Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.
Vendor Patch Velocity
↓ -24.7 daysMedian time from CVE disclosure to Microsoft advisory: 3 days (p25 1 day – p75 33 days). Industry median: 28 days.
Sample size: 13,403 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.
Top Recurring Weakness Classes
Most-frequently mapped CWEs across Microsoft's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.
Recent Security Advisories
Latest advisories published by Microsoft, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.
- CVE-2026-98379MediumCVSS 5.5Oct 10, 2026
netfilter: ip6t_rpfilter: reject routes without inet6_dev
- CVE-2026-98384LowCVSS 3.3Oct 10, 2026
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
- CVE-2026-98381HighCVSS 7.8Oct 10, 2026
veth: manage XDP program pointers during channel resize
- CVE-2026-98380MediumCVSS 5.5Oct 10, 2026
net/sched: reject IDR error pointers when deleting actions
- CVE-2026-98378HighCVSS 7.8Oct 10, 2026
bpf: Skip unsettled links in link iterator
- CVE-2026-98382MediumCVSS 5.5Oct 10, 2026
bpf: Reject dev-bound-only programs on other devices
- CVE-2026-98383HighCVSS 7.1Oct 10, 2026
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
- CVE-2026-98377MediumCVSS 5.5Oct 10, 2026
vlan: require the MAC header to be present in __vlan_insert_inner_tag()
Full advisory archive: /pulse/vendor-advisories →
Data sources & corrections
- NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
- MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
- CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
- Vendor security advisories (Red Hat RHSA, Ubuntu USN, Microsoft MSRC, Cisco PSIRT and other per-vendor feeds; the GitHub and OSV advisory databases are not used) — published_at timestamps
- MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings
Snapshot generated Oct 11, 2026: when these counts and industry medians were computed. Vendors in the index are recomputed every 6 hours.
Spot a factual error in this report?
Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.