More updates, less time: the 2026 patch numbers for Intune teams

Microsoft fixed 1,411 security flaws in its October 2026 Patch Tuesday, by BleepingComputer's count. In September it fixed 966. Both were records, one month apart.

Counts for the same release differ between outlets depending on whether third-party CVEs and Edge are included, so every number below is cited to the source it came from.

The volume is rising, and not only at Microsoft

Across all vendors, 48,185 CVEs were published in 2025. The first half of 2026 produced 35,364 — an increase of 49.5% on the same six months of 2025, which produced 23,656.

Each one can mean another update to test, schedule and prove.

Microsoft has said why

The rise is not accidental, and Microsoft has been direct about the cause. Pavan Davuluri, who runs Windows:

As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release.

That was said alongside July's release, which fixed 570 flaws and was a record at the time. Three months later the figure was 1,411.

The same effect is visible outside Microsoft. Anthropic's Project Glasswing scanned more than 1,000 open-source projects and flagged 23,019 potential vulnerabilities, of which 6,202 were estimated as high or critical severity. That severity split is the model's own estimate, not a confirmed count. Of 1,752 high or critical findings that were independently assessed, 90.6% were valid and 62.4% were confirmed at that severity.

Finding flaws faster is good. It also means more fixes arriving, more often, for software that is already installed.

The time to respond has shortened

Volume alone would be manageable if the time to respond had held. It has not.

Attackers move earlier than they did. Mandiant measures the average gap between a vendor shipping a fix and attackers exploiting the flaw. In 2018 it was 63 days after the fix. By 2024 it was one day before. The 2025 figure is estimated at seven days before. On that estimate, exploitation often begins before a patch exists, which makes every day after release count.

The regulatory deadline is shorter. CISA's Binding Operational Directive 26-04 requires US federal agencies to remediate the highest-risk, publicly exposed, known-exploited vulnerabilities within 72 hours. It replaces the fixed remediation timelines of BOD 22-01, which has been revoked. Agencies are bound by it. Everyone else is being measured against it.

Vendors have changed their own cadence. Since 14 July 2026, Adobe publishes security bulletins on the second and fourth Tuesday of each month rather than the second alone. Adobe's stated reason: "the window between public vulnerability disclosure and active exploitation is compressing from days to hours."

What this means for teams running Intune

More versions to keep current, in less time, with evidence expected on a shorter cycle.

None of this is a criticism of any platform. Intune does what it is designed to do. What has changed is the operating load around it: the packaging, the testing, the rollout rings, and the evidence that a fix reached the devices it was meant to reach. On these numbers that load is closer to continuous than monthly.

The figures and where they come from