This month's Microsoft Security Update Guide release: severity and exploitation dashboards, a searchable CVE browser, and a downloadable brief.
Microsoft only, non-Microsoft, or both. Everything below follows the choice.
This month's Microsoft Security Update Guide release. CVEs Microsoft republishes from third parties are excluded by default.
Off by default: Microsoft's feed republishes CVEs it did not author (the Chromium engine behind Edge, Azure Linux package rebuilds). Rapid7 and Tenable exclude most of these from their own counts, so EVULNABLE does too unless you turn this on.
Microsoft's feed for this release contains 1,640 total records: 448 are Microsoft-authored Patch Tuesday CVEs, and 1,192 are CVEs Microsoft republishes from third parties it ships or packages — the Chromium engine behind Microsoft Edge, and Azure Linux open-source package rebuilds, being the two largest categories. Rapid7 and Tenable report smaller headline counts for the same release because they apply their own (not fully published) methodology to exclude most of these. EVULNABLE's Microsoft-only figure is intended to land in the same ballpark, not to match exactly. All counts on this page reflect the scope selected above.
1 CVE(s) are already being exploited in the wild, 1 are CISA KEV-listed, and 3 were publicly disclosed before this patch shipped — prioritize these regardless of severity.
Ranked by EVULNABLE Risk Score v1.1 — CVSS, FIRST EPSS, CISA KEV, confirmed active exploitation, pre-patch public disclosure, and Microsoft's Exploitability Index. Known active exploitation is floored regardless of CVSS alone.
Severity · CVEs
Select a bar to filter the CVE browser below to that severity.
CVE · EVRS Score
Select a bar to open that CVE in the browser below.
Impact type · CVEs
1 CVE(s) have no impact classification stated by Microsoft and are excluded from this chart so they don't crowd out the categories that are known.
Product · CVEs
Hardware-architecture and Server Core installation variants of the same product are grouped into one bar. Distinct OS versions and Office LTSC years are kept separate, since they matter for what still needs to be patched.
Microsoft's severity rating (Critical / Important / Moderate / Low) is a technical-impact call: how bad this vulnerability could be if exploited, independent of whether anyone is actually exploiting it — which is why most CVEs in a typical release land in Critical or Important.
EVULNABLE Risk asks a different question: how urgently should this actually be remediated right now? It weights real-world exploitation signals — CISA KEV listing, confirmed active exploitation, FIRST EPSS, and pre-patch public disclosure — far more heavily than CVSS. Since most CVEs in any release are not yet known-exploited, most score Low or Informational under EVRS even when Microsoft calls them Critical. That is the point of a separate score, not a bug.
Any CVE that is CISA KEV-listed or confirmed actively exploited is floored regardless of the weighted total, so it can never get buried. A CVE that is KEV-listed and confirmed exploited and scores CVSS ≥ 9.0 — with a real urgency signal behind it — carries the Exigent flag and is escalated within Critical.
| Band | Score |
|---|---|
| Immediate | 85-100 |
| Urgent | 65-84 |
| Elevated | 10-64 |
| Routine | 4-9 |
| Informational | 0-3 |