By Jiong Lu
Disclaimer: This personal blog analyzes public data from vendor and NIST websites to examine the recent rise in Windows 11 CVEs and its implications for patching. It explores several possible AI-related explanations, but these hypotheses are not official vendor statements and are not presented as proven causes. The views are my own and do not represent Microsoft or any other vendor mentioned in the article.
Windows 11 CVEs Surges
Let us look into the counts of CVEs for Windows 11 Security Updates released in the past 12 months.
(data source: https://api.msrc.microsoft.com/sug/v2.0/en-US . with filters applied to include Windows 11 only).
The number of CVEs that recent Windows 11 security updates resolve are surging, from around 100 to now over 600. And there is no sign that this number will decrease in coming months. People may ask: Why?
There are 3 possible explanations:
These explanations all relate to AI usages.
- More findings are reported to Microsoft by external security experts and enthusiasts
- More findings come from Microsoft internal code analysis against legacy codes
- Capability of fixing reported vulnerabilities has increased (and is still increasing)
More findings are reported to Microsoft by external security experts and enthusiasts
For external security experts and enthusiasts, the tool to detect operating system’s defections are much stronger when AI enhanced. The AI enhanced fuzzing tools can submit better test inputs, compose better file test contents, generate strange enough test network packets to “crack” Windows than ever before. AI enhanced tools can also analyze API parameters of dll or exe from their public debug files and create test pattern accordingly. The same thing could be done by human beings in the past but with AI assist, this becomes faster, more accurate and reusable. Whitehat security experts will then report findings to software vendors more frequently. We just do not have an official statistic number from Microsoft (usually MSRC) since it is confidential.
More findings come from Microsoft internal code analysis against legacy codes
At the same time, it is also possible that Microsoft starts to use AI to scan its legacy codes written/tested by human in the past and find more vulnerabilities. I found that there might be a way to tell if a CVE is Microsoft internally found or externally reported: by checking the Report Source or the name listed in Acknowledgement. And after the check here is what I got, among 634 CVEs of September:
- 29 CVEs have reporters (or among all the reporters, some) coming from Microsoft Internal
- 34 CVEs didn’t mention reporters, nor in Acknowledgement (blank)
- 74 CVEs have reporters named as “Anonymous” only
- Remaining 497 CVEs have reporter names.
With the above analysis, it seems that most patched CVEs come from externally reported source, unless Microsoft also uses strange names in the reporter sources. Microsoft may start to use AI to analyze legacy codes, but it either gets fixes without any announcements, or the numbers are not increasing to the same level as of external reported issues.
Capability of fixing reported vulnerabilities has increased
I personally believe this is the most relevant explanation among the three. Like most OS vendors or even open-source communities, when bugs are reported, the capacity of fixing them has a cap which usually leads to a backlog of unfixed bugs in a queue. When AI assist comes into helping the developers to fix the backlogs, it could speed up not only the defection fix itself but also its testing and its quality assurance. This may be the primary reason for the latest CVE count surge in the security patches.
This (fixing backlogged bugs) may last for another several months. We could possibly see the number of fixed CVEs keep at high level for some time longer until most backlogs are cleared and then a new balance of findings vs fixes come into place. We do not yet know how big (or small) of the total monthly amount will be. But that number will be higher than the old normal (before June 2026) but lower than the new normal (Sept 2026).
User Impact
What do all these mean towards end users?
Exploits will increase, especially zero-days
As mentioned above, while it is “easier” for Whitehat security experts to detect vulnerabilities, it is also “easier” for bad guys to find them and create exploits. This does not yet show in the official numbers but yes they will come for sure. And for the same reason, we will possibly face more zero-days.
Reverse engineering from patches to exploits will increase
Recent trends of exploits are also telling one more story: malicious users (attackers) are now analyzing vendors’ monthly updates and use them to create exploits. They are able to do so because they can compare the 2 versions of the same file: before and after the patch and then find the difference. It is also not only the binaries they are comparing, but the official debug files of the correspondent binaries. In the past, these analyses required in-depth machine code understanding and system level architecture knowledge, so the barrier was high. But it may no longer be so as AI assist is now in place.
As a result, if you do not patch your system quicker than malicious users create their exploits, you are definitely taking risks.
Patch compatibility tests are taking longer
For a lot of companies, patches cannot be applied directly into productions. They need to go through a test environment first to confirm their compatibility with existing systems. Because the total number of CVEs from a monthly update has now increased to a very high amount, it takes longer for this compatibility test to complete. And because Microsoft no longer releases patches for individual CVEs, the decision has to be made to either patch everything or patch nothing for that month. It will be a difficult choice unless compatibility tests also speed up.
As users, we need to speed up compatibility tests with AI assist. Or we will be left in cold in the new era.
Conclusion
Not every reported CVE will be exploited, and not every exploit will lead to a successful attack. Even so, timely patching generally reduces exposure to known vulnerabilities. Individuals and organizations should balance security urgency with compatibility testing, staged deployment, backups, and documented mitigations when immediate installation is not possible.
Patch your systems faster! please!
9/14/2026