He noted that the volume of CVEs isn’t the real story anymore. “What matters is that discovery is scaling faster than exploitation, so teams that triage by sheer CVE count instead of exploitability are burning cycles on the wrong bugs,” he said. “Patch what’s proven, prioritized, and public, and treat everything else as this month’s new normal.”
Jack Bicer, director of vulnerability research at Action1, drew attention to several critical vulnerabilities that present substantial risks to externally accessible systems and enterprise infrastructure. Windows Message Queuing Queue Manager Remote Code Execution Vulnerability (CVE-2026-100202), Microsoft PostScript Printer Driver Remote Code Execution Vulnerability (CVE-2026-70147 and CVE-2026-70153), and Microsoft QUIC Remote Code Execution Vulnerability (CVE-2026-105016 and CVE-2026-100219) each carry CVSS scores of 9.8 and could allow attackers to execute malicious code remotely without authentication or user interaction. Although active exploitation has not been confirmed for these vulnerabilities, he said, their low attack complexity and potential for severe system compromise make them significant enterprise risks.
While one commentator called the number of Microsoft vulnerabilities listed this month as “monster,” Tyler Reguly, Fortra’s associate director of security R&D, disagreed: “I’ve argued that [vulnerability] numbers are meaningless. This month’s number, 1,413, is no different.”
