Windows patching when disclosure moves at AI speed

Windows and Office CVEs rose 159.1% in the latest complete year, to 2,438, while browsers and developer tools moved to faster release cycles. A 36-month descriptive study of what that means for patching and packaging teams.

Windows and Office CVE volume and severity
AI-assisted vulnerability discovery
Application release cadence
Remediation timing
Work lanes for packaging teams
Automation and human ownership

Research paper. 36 pages. Reviewed 29 October 2026.

Research by Ryan Mangan from EfficientEther.

What this paper helps you decide

Decide how your team keeps up with more disclosures, faster application releases and proof that each fix is running.

Cumulative Windows updates still arrive on the second Tuesday, but the work around them no longer follows a monthly calendar. In the latest complete year, October 2025 to September 2026, the study counts 2,438 distinct Windows and Office CVEs, up 159.1% on the 941 of the year before and the 679 the year before that, with the surge concentrated in mid to late 2026. Over the same period Chrome and Edge moved to two-week major release cycles, Firefox announced the same, and Visual Studio Code moved to weekly releases. Patch volume is no longer a monthly event, and packaging and endpoint teams feel it first.

The paper measures what changed and is careful about what it cannot show. Mean CVSS v3 severity was broadly unchanged (7.43, 7.37, 7.28), yet CVEs scored 9.0 or above rose from 11 to 60. Eighteen Windows CVEs carry documented AI-assisted discovery credit, a source-verified set of examples and not an estimate of the AI share. Across 4,058 CVEs in 36 months there were no usable structured repair-time date pairs, so a whole-cohort average repair time cannot be estimated; dated cases are reported under their own clocks instead.

For application packaging teams it turns the numbers into an operating model. A panel of six release streams (Chrome, Edge, Firefox, Visual Studio Code, Notepad++ and 7-Zip) ranges from 4 release days in a year for 7-Zip to 69 for Edge, with Chrome at 64 and Visual Studio Code at 61. The paper proposes five work lanes for those streams, a nine-gate pipeline from trusted source to verified protection, and a clear split: automation carries build, deployment and test execution, while people own the test criteria, what counts as a pass and which exceptions are acceptable.

Who it is for

Patch-management, endpoint and application packaging teams, security and vulnerability managers, end-user computing leads and MSPs. Chapter 5 includes a planning equation and a worked table with deliberately invented inputs, so you can replace them with your own release and effort figures.

Cite as Mangan, R. (2026). Windows Patching, AI-Assisted Discovery and Application Assurance. Zenodo. https://doi.org/10.5281/zenodo.23780566

Get the paper

What you leave with

How Windows and Office CVE volume changed over 36 months (679, then 941, then 2,438 a year), and why a stable average score still means many more serious disclosures.
What the evidence does and does not show about AI: 18 documented Windows examples and no measured AI share.
How often six common application release streams ship, from 4 release days a year for 7-Zip to 69 for Microsoft Edge.
Why a vendor release is not necessarily a new package, and the five quantities to count separately: releases observed, versions selected, qualification runs, central artefacts built and endpoint installations.
Why Microsoft's structured data cannot give a whole-cohort repair time, and how separate clocks give honest numbers for dated cases.
A nine-gate pipeline that automates execution while people own test criteria and exceptions, with time to verified protection as the measure.

What you get

36 pages, published October 2026 with an evidence cutoff of 26 October 2026, 18 tables, six figures, two appendices and 113 numbered references.
The method in full: 37 monthly Microsoft Security Response Center CVRF documents from October 2023 to October 2026, joined to the CISA Known Exploited Vulnerabilities catalogue.
The designed EtherApps Forge edition of EfficientEther's open-access preprint, which is also published on Zenodo under CC BY 4.0 with its analytical supplement. The data, tables and wording follow the preprint; the figures are redrawn from the same outputs.
Company-authored research that has not been peer reviewed. It declares that EfficientEther develops and sells EtherApps Forge, and that the study does not evaluate EtherApps Forge or any other commercial product.