Cisco Talos says the sharp rise in Microsoft vulnerability advisories is being driven partly by frontier AI models mining technical debt in older libraries and tools. In a new analysis published October 20, Talos reported 1,415 Microsoft advisories for October, compared with 975 in September and a pre-June average of about 100 per month. Talos’s analysis
For defenders, the disclosure count is not a direct measure of active attack risk. Talos said Known Exploited Vulnerabilities grew by 37% year over year, compared with a 105% rise in CVEs, and noted that only three of September’s 975 Microsoft advisories were exploited in the wild. The analysis attributes much of the increase to systematic examination of older code rather than the emergence of a new vulnerability class.
The October release still contains high-priority issues. Talos’s October Patch Tuesday coverage says Microsoft classified 85 vulnerabilities as critical, including 67 remote-code-execution flaws, and reported that one vulnerability had been exploited in the wild. The affected products include Windows, Exchange Server, Active Directory Domain Services, Hyper-V, Microsoft Office and Microsoft QUIC.
Examples include CVE-2026-100202, a remote-code-execution vulnerability in Windows Message Queuing Queue Manager with a CVSS base score of 9.8, and CVE-2026-70229, a remote-code-execution flaw in Windows Active Directory Domain Services with a CVSS base score of 8.1. Talos also lists CVE-2026-70571 in Microsoft Exchange Server as a remote-code-execution vulnerability considered more likely to be exploited.
Talos says the longer-term trajectory is uncertain: discovery may level off as the historical backlog is reviewed, while AI-assisted analysis could also help attackers parse patches faster. The sources do not establish how many of the October disclosures are exploitable in a specific environment, so administrators still need product-level exposure and exploitation checks rather than relying on the headline count alone.