Only ten days into November, Microsoft has published fixes for 1,094 flaws in its own products. That is more than in all of September (993), and more than July and August combined (1,035).
November so far, in 51 seconds.| Month, 2026 | Microsoft products | |
|---|---|---|
| July | 598 | |
| August | 437 | |
| September | 993 | |
| October | 1,462 | Highest month on record |
| November 1 to 10 | 1,094 | Already second-highest |
Source: Microsoft Security Update Guide, retrieved November 10, 2026. CVEs counted by the date Microsoft first published them, for Microsoft products only. Chromium fixes republished for Edge and Azure Linux CVEs are excluded.
Until this July, no month in the Security Update Guide, which goes back to 2016, had passed 250. The highest was June 2026, at 221. Every month since has. October set the record at 1,462, and November is already three-quarters of the way there.
November probably won’t pass October. Microsoft publishes almost all of the fixes for its own products on Patch Tuesday: 1,093 of November’s 1,094 came on November 10. In the weeks between Patch Tuesdays since July, the count has run from 0 to 23. Unless Microsoft ships an out-of-band release, November will finish close to where it stands now, as the second-highest month on record.
One of November’s fixes, for Microsoft Outlook (CVE-2026-124194), is marked by Microsoft as exploited. According to Microsoft, a crafted message file, once opened, can make Outlook connect to a location the attacker controls without the usual warning, and disclose sign-in information that could be used to impersonate the user.
Edge works to a different schedule. Microsoft republishes Chromium’s fixes as Edge picks them up, and they arrived in 15 of the 19 weeks since July 6, between 7 and 417 a week (Security Update Guide). Most of those weeks were not Patch Tuesday weeks.
A fix can be published without being installed. Between the two sit the policy that sends it, the app version that carries it and the report that says whether it arrived. The question this month is the same as last month: did every device take the fixes, and can you show that it did?
(Last month’s version of this question: Black October: what it means for your devices.)
Devicie works on the device side, inside Microsoft Intune. It checks your Intune policies every hour, corrects drift when it finds it and tells your team what it changed. It prepares and tests new versions of supported apps, and your team controls the rollout. It reports both states for each device: ready for deployment, and installed.
Devicie doesn’t identify or prioritize vulnerabilities, and it doesn’t run your Windows update rings. Those stay with your security and infrastructure teams.
A free Intune Health Assessment shows where your Intune environment stands today.
Request your free Intune Health Assessment
Corey McCarthy is Chief Marketing Officer of Devicie.