Combined view

Both datasets on one timeline

The global CVE firehose and Microsoft's Patch Tuesday, together. They measure different things at different scales — all published CVEs (tens of thousands a year) versus one vendor's monthly Windows releases (hundreds) — so this uses two axes. What matters is that both are climbing, and both broke pattern in 2026.

Global CVEs vs Microsoft Patch Tuesday, per year

Left axis (amber): all CVEs published worldwide. Right axis (teal, dashed): Microsoft Patch Tuesday CVEs summed by calendar year. 2026 (7 months) is partial.

Both series now run 2018→2026. They rise together but not in lockstep — Microsoft's annual Patch Tuesday volume drifted up modestly (≈700 in 2018 to ≈1,150 in 2025) while the global count multiplied several times over, because most CVE growth came from outside Microsoft. The teal line's 2026 jump is July's 569-CVE record landing in a partial year. CVE.org / NVD + Zero Day Initiative

How the two relate

2.4%

Microsoft's slice of the whole

Microsoft's 1,146 Patch Tuesday CVEs in 2025 were about 2.4% of the 48,185 published worldwide. One major vendor is a small fraction of the global firehose — most CVE volume comes from the sprawling third-party ecosystem (WordPress plugins, the Linux kernel, thousands of smaller projects).

Both

rose, then broke pattern

Global CVEs jumped 38% in 2024 and 21% in 2025. Microsoft's monthly range held flat for eighteen months, then spiked in 2026 (April 163, June 200, July 569). The two datasets broke their baselines at roughly the same time — mid-2025 into 2026.

≠

but they aren't the same signal

The global rise is dominated by more issuers (CNAs) and disclosure completeness. Microsoft's rise is a single vendor's own release cadence. Reading them as one "AI is causing more bugs" trend conflates two very different mechanisms — which is exactly the mistake this site exists to avoid.

The honest combined read

Put together, the two datasets say the same careful thing: disclosure volume is rising fast and broke pattern in 2026, across both the global count and Microsoft's own releases. That correlation is real and worth watching. What neither dataset shows — separately or combined — is that AI is the cause. The confounders (CNA expansion, the NVD enrichment collapse, Microsoft's internal tooling) are large, documented, and unquantified. The combined view sharpens the question; it doesn't answer it. The full reasoning is on the AI Question page →