By Alex Smith |
Microsoft's October 2026 monthly security update addressed more than 1,100 Common Vulnerabilities and Exposures (CVEs) for Windows, as the company warned that slow update deployment is leaving enterprise devices exposed to known security risks.
Diagnostic data from August 2026 showed that fewer than half of devices in a measured Windows enterprise sample had installed the latest security update two weeks after its release. About one in four devices had still not received the update after four weeks.
“AI is accelerating vulnerability discovery on both sides,” said Nuno Costa, partner director of Windows servicing and delivery at Microsoft. “It can help defenders find and fix vulnerabilities earlier. It can also help attackers search for vulnerabilities before fixes are available and analyze published fixes after release. All of this increases the importance of timely protection.”
Microsoft is expanding its use of AI across Windows vulnerability management to identify security issues, support remediation and strengthen update validation. Its MDASH agentic code scanner uses multiple AI models and specialised agents to find and validate potential vulnerabilities, with security and engineering teams reviewing findings and determining the appropriate response.
AI-assisted capabilities are also being used to help engineers assess the impact of vulnerabilities, identify affected Windows versions, evaluate remediation options and develop security and regression tests. Engineers remain responsible for reviewing findings and making final decisions.
“A higher number of CVEs does not mean Windows has become less secure,” said Costa. “It means more vulnerabilities have been discovered and closed, reducing the opportunities attackers have to exploit them.”
Microsoft publishes information about vulnerabilities addressed through its Security Update Guide, including details of severity, impact and exploitability. It also provides machine-readable information through Common Security Advisory Framework advisories, Vulnerability Exploitability eXchange documents and an application programming interface, allowing security teams to integrate the data into vulnerability management and compliance tools.
To reduce exposure, Microsoft recommends that organisations remain on supported Windows versions, install updates promptly, apply security baselines and maintain endpoint detection and recovery capabilities.
The company highlighted Windows Autopatch, which provides update management through Microsoft Intune, including staged deployments and reporting. Eligible Windows 11 devices can also use hotpatching to apply monthly security updates without requiring a restart, although standard cumulative baseline updates are still required periodically.
Windows Server 2025 also supports hotpatching across eligible Azure, Azure Local and Azure Arc-connected environments, with Azure Update Manager providing patch orchestration.
“The goal is simple: turn an available fix into deployed protection as quickly as possible,” Costa said. “Reduce the update deployment window wherever possible instead of treating security updates as a task that can routinely wait.”