Patch Tuesday tracker

Microsoft's monthly security updates for the last year: how many flaws each fixed, how severe, and which ones Microsoft says were already exploited or publicly disclosed.

Microsoft's last 12 monthly security updates, from the MSRC Security Update Guide (CVRF API, read 4 November 2026). We count the CVEs Microsoft itself assigned in each month's document, at the highest severity Microsoft gives any affected product. Third-party CVEs that Microsoft republishes (Chrome, Linux and other vendors) are left out. A month's document also takes in CVEs Microsoft publishes later that month, so our count can differ from the figure in the release note, shown under it. "Exploited" and "Publicly disclosed" are Microsoft's own flags as the document stands now, not only on release day. Severity is Microsoft's rating, not a CVSS score.