Yesterday Microsoft published fixes for 974 vulnerabilities — more than double July’s previous record of 664. That number is doing a lot of work in headlines this morning, and almost none of it is useful to you.
Here’s the claim worth pressure-testing: a record-breaking CVE count is a record-breaking emergency. It isn’t. Let me show you why, and then what actually deserves your morning.
Does 974 mean the sky fell overnight?
Think of a smoke detector that now samples the air a thousand times a second instead of once. You will get more alarms. That does not mean your house is a thousand times more on fire — it means the sensor got better. Microsoft attributes the surge to AI-assisted vulnerability discovery: fuzzers and code-analysis models finding classes of bugs faster than humans ever triaged them. Krebs and others reported the same explanation from Redmond.
So the count went up because finding got cheap, not because exploiting got easy. Those are different curves. Of the 974, roughly 58 carry Microsoft’s “exploitation more likely” rating. Everything else is background radiation — real, worth patching on your normal cadence, not worth cancelling standup over.
The old instinct was to sort by CVSS and grind top-down. That approach is dead when the list is 974 long. Sort by evidence of exploitation and exposure instead. That’s the whole game now.
So what’s actually burning?
Two, and only two, are under active exploitation in the wild:
- CVE-2026-62694 — Windows Installer, use-after-free, elevation of privilege. A local attacker who already has a foothold uses a freed-then-reused memory object in the Installer service to climb to SYSTEM. This is the post-exploitation escalation step in a ransomware chain — the move between “phished one user” and “owns the domain.”
- CVE-2026-62706 — Windows Media Foundation, out-of-bounds read, remote code execution. A malformed media file, opened or previewed, lets code read past its buffer and run. Media Foundation sits behind a lot of things that touch untrusted files — browsers, mail previews, chat clients — so the delivery surface is wide.
Both span the full modern fleet: Windows 10, Windows 11, and Server 2019, 2022, and 2025. Check the MSRC pages for the exact build-specific KB matching your images before you deploy — don’t trust a summary table, mine included.
These two are especially dangerous in combination. Media Foundation delivers initial code execution as a normal user; Windows Installer escalates that to SYSTEM. An attacker with both has a full compromise from a single opened file—which is why “it’s only an EoP” misses the threat from 62694.
What does triage look like before your second coffee?
Three tiers, in order:
- Immediate — today: the two exploited zero-days, everywhere they apply. Emergency-change them if you have to.
- This week: the ~58 “exploitation more likely” CVEs, weighted by exposure — internet-facing and multi-user hosts first, then the RCEs that need no authentication.
- Next cycle: the remaining ~900. Normal ring deployment. The big number lives here. Let it.
First, find out where you actually stand. This is read-only — it reports, it changes nothing:
For fleet-scale truth, pull the same signal from Defender’s exposure data rather than trusting Get-HotFix on every box — Get-MgSecurity / the Defender vulnerability management APIs will tell you which machines are missing a given CVE without you touching each host.
The compensating control while patches roll: EoP zero-days like 62694 need a local foothold, so anything that blocks initial access — attack surface reduction rules, application control, tightened mail and browser file handling for the Media Foundation vector — buys you time. It does not replace the patch.
Ignore the 974. It’s a measurement of how fast Microsoft’s tooling now reads its own code. Patch two things today, fifty-eight this week, and let the rest ride the rings. The record isn’t the story — your exposure is.
