Microsoft’s vulnerability landscape just sent a mixed signal that every security team needs to understand. According to the newly released Microsoft Vulnerabilities Report 2026 — the 13th annual edition published by BeyondTrust — the total number of disclosed Microsoft vulnerabilities actually fell 6% year-over-year, from 1,360 in 2024 to 1,273 in 2025. On the surface, that looks like good news.
It isn’t. Buried inside that modest decline is a statistic that should worry every CISO, sys admin, and identity architect running a Microsoft estate: critical vulnerabilities more than doubled, jumping from 78 to 157 in a single year. Fewer bugs, but far more of them capable of full system compromise.
That is the central paradox of the Microsoft Vulnerabilities Report 2026, and it is the reason this year’s data deserves a deeper technical read than the topline numbers suggest.
This article breaks down the report’s key CVE data by category and product, explains the technical mechanics behind the Elevation of Privilege and Remote Code Execution trend driving risk, and looks at how BeyondTrust’s identity security platform is purpose-built to close the exposure window these vulnerabilities create.
For the complete dataset, five-year historical trending, and expert commentary from Microsoft MVPs and BeyondTrust’s own research team, download the full 2026 Microsoft Vulnerabilities Report from BeyondTrust.
Why the Microsoft Vulnerabilities Report 2026 Matters
For thirteen years running, BeyondTrust has aggregated and analyzed every security bulletin Microsoft publishes, sorting CVEs by product, severity, and vulnerability category (Elevation of Privilege, Remote Code Execution, Information Disclosure, Denial of Service, Spoofing, Tampering, and Security Feature Bypass).
That longitudinal dataset makes the Microsoft Vulnerabilities Report 2026 one of the few sources that lets defenders see structural change in Microsoft’s attack surface rather than a single noisy year.
The headline trend over the last decade had been reassuring: critical vulnerabilities as a share of the total fell from 44% in 2013 to just 5.74% in 2024, reflecting Microsoft’s investments in secure-by-design engineering, Patch Tuesday cadence, and exploit mitigation work.
The 2026 report breaks that streak. Critical severity’s share of total vulnerabilities jumped back above 12% in 2025 — a reversal that Microsoft MVP and Senior Technical Fellow at Adminize, Sami Laiho, and other contributing experts flag as a genuine shift in risk concentration, not statistical noise.
Figure 1: Total Microsoft CVE volume has stayed in a relatively narrow band since 2022, but volume alone no longer tells the risk story.
Critical Vulnerabilities Doubled: The Numbers Behind the Headline
The most important figure in the Microsoft Vulnerabilities Report 2026 is the critical vulnerability count: 157 in 2025, up from 78 in 2024. That’s not a marginal increase — it’s a 101% jump in the class of bugs most likely to enable remote, unauthenticated, or low-complexity full compromise.
One methodological note worth surfacing: the 157 figure comes from Microsoft’s Security Update Severity Rating System, which weighs real-world exploitability.
Under the National Vulnerability Database’s CVSS v4 scoring, just 42 Microsoft vulnerabilities crossed the critical threshold in 2025 (up from 39 in 2024).
The report is explicit that organizations prioritizing patches on CVSS alone may materially underestimate their exposure — Microsoft’s own severity rating is the more useful signal for defenders.
Two products drove the bulk of that surge:
Microsoft Azure and Dynamics 365 saw critical vulnerabilities rise 9x, from just 4 in 2024 to 37 in 2025. Azure is now the infrastructure layer hosting Copilot integrations, AI agents, and machine-identity workloads that authenticate and act with elevated permissions.
A near-tenfold increase in critical flaws in that exact layer — combined with the rise of autonomous non-human identities — is a compounding risk rather than an isolated data point, a concern independently raised by security researcher Jane Frankland MBE in the full report.
The most striking single vulnerability of the year was CVE-2025-55241, a critical Entra ID token-forgery flaw (CVSS 10.0) that could have allowed an attacker to impersonate any identity — including a Global Administrator — across any tenant, with no user interaction and no logs generated in the victim tenant.
Microsoft patched it in July 2025 with no confirmed exploitation in the wild, but it illustrates how a single cloud-identity flaw can collapse trust boundaries at machine speed.
Microsoft Office vulnerabilities more than tripled year-over-year, jumping from 47 in 2024 to 157 in 2025, with critical Office vulnerabilities rising from 3 to 31 — roughly a 10x increase.
Given that Office remains one of the most common initial-access vectors — via malicious macros, OLE objects, and document-based exploit chains — this spike materially changes phishing and document-based attack calculus for defenders.
Notable examples include CVE-2025-62557 and CVE-2025-62554, a memory-corruption and type-confusion pair combined to enable remote code execution through the file preview pane with no user interaction required.
Not every product moved in the wrong direction. Microsoft Edge was the standout improvement, dropping to just 50 vulnerabilities in 2025 — zero of which were critical — an 83% year-over-year decline that reflects the maturity of Chromium-based hardening work.
That’s the kind of secure-by-design progress the industry wants to see replicated elsewhere in the Microsoft ecosystem.
Figure 2: Critical vulnerabilities nearly doubled overall, with Azure/Dynamics 365 seeing the steepest year-over-year increase.
→ Get access to the full report for the complete technical appendix and patch-prioritization data →
Elevation of Privilege Still Owns the Vulnerability Landscape
If there’s one category that defines the modern Microsoft vulnerability landscape, it’s Elevation of Privilege (EoP). In 2025, EoP vulnerabilities accounted for 509 CVEs — 40% of every vulnerability Microsoft disclosed across its entire product portfolio.
That makes it the single largest vulnerability category for yet another consecutive year, continuing a multi-year pattern the report has tracked since its earliest editions.
Technically, EoP vulnerabilities matter more than raw counts suggest because of how modern attack chains are constructed. Initial access rarely requires a sophisticated zero-day; attackers increasingly rely on phishing, credential theft, token replay, or misconfigured service accounts to get a low-privilege foothold.
From there, an EoP vulnerability — in the Windows kernel, in a driver, in an Active Directory service, or in an Azure control-plane component — is what converts that limited foothold into domain admin, root, or full cloud-tenant control.
Remote Code Execution (RCE) vulnerabilities, the second-largest category with 373 disclosures in 2025, often serve as the second half of that same chain: get code execution, then escalate.
Information Disclosure was the only category to move in the wrong direction, jumping 73% from 101 to 175 CVEs — the quiet precursor that helps attackers map an environment before the next stage.
Windows and Windows Server — the two platforms where identity, authentication, and privilege boundaries are actually enforced — remain the largest sources of raw CVE volume. In 2025, Windows itself accounted for 612 disclosed vulnerabilities (36 critical), while Windows Server logged 780 vulnerabilities (50 critical).
Together, these two platforms represent the operating system layer where privileged access management controls have to do the heaviest lifting. (Note: some CVEs affect both Windows and Windows Server and are counted in each product tally, so the two figures should not be added together as a distinct total.)
Figure 3: Elevation of Privilege accounts for 40% of all 2025 Microsoft CVEs; Windows Server and Windows remain the largest sources of vulnerability volume.
As BeyondTrust CTO Marc Maiffret notes in the report, CVE counts alone are an incomplete picture: identity misconfigurations, over-privileged machine accounts, and AI agents with unconstrained access don’t get CVE numbers assigned to them, but they carry the same consequences as a critical vulnerability once exploited.
That’s the analytical lens this report pushes security leaders toward — thinking about Paths to Privilege™, not just patch counts.
The Technical Case for Least Privilege and Zero Trust
Every edition of the Microsoft Vulnerabilities Report reinforces the same architectural conclusion, and 2026 is no exception: vulnerabilities are unavoidable, but their blast radius is not. As Sami Laiho puts it in this year’s report, the true risk in modern environments isn’t the presence of vulnerabilities — it’s the presence of unnecessary privilege.
Organizations that treat least privilege as a foundational design principle won’t eliminate CVEs, but they dramatically shrink what any single exploit can actually accomplish.
That principle translates into concrete technical controls:
- Removing local administrator rights and standing privileged access on endpoints so that an EoP exploit has nothing meaningful to escalate into.
- Enforcing just-in-time, just-enough access for both human admins and service accounts across Windows, Windows Server, and Azure/Entra ID environments.
- Continuously discovering and governing non-human identities — service principals, API keys, and AI agent credentials — that increasingly operate with standing, unmonitored privilege in cloud environments.
- Segmenting and monitoring remote access pathways, since compromised remote sessions remain one of the most common ways attackers reach systems with unpatched Elevation of Privilege or Remote Code Execution flaws in the first place.
David (DJ) Morimanno, Field CTO at Xalient, frames it in Zero Trust terms in the report: modern defense isn’t about assuming trust and reacting after the fact, it’s about continuously validating trust and constraining privilege for every identity, human and non-human.
That’s precisely the operating model the 2025 data is pushing organizations toward.
How BeyondTrust Helps Close the Identity Privilege Gap
This is where the report’s findings connect directly to BeyondTrust’s own platform strategy. Trusted by 20,000+ customers, including 75 of the Fortune 100, and recognized as a Leader in the 2025 Gartner® Magic Quadrant™ for Privileged Access Management, the 2025 Forrester Wave™ for Privileged Identity Management, and the 2025 KuppingerCole Leadership Compass for ITDR, BeyondTrust treats vulnerability management and identity security as one connected discipline rather than two separate ones.
The BeyondTrust Pathfinder Platform unifies privilege-centric identity security capabilities — Privileged Access Management (PAM), Identity Threat Detection and Response (ITDR), Cloud Infrastructure Entitlement Management (CIEM), and Secrets Management — into a single console built around the exact attack chain the 2026 report describes. A few concrete ways BeyondTrust addresses the specific risks this year’s data surfaces:
- Endpoint Privilege Management removes standing local admin rights from Windows and Windows Server endpoints — the two platforms responsible for the majority of 2025 CVE volume. Removing local admin rights alone has historically mitigated approximately 75% of Microsoft’s critical vulnerabilities, and does so before any patch is deployed — a compensating control that directly blunts the impact of the 509 Elevation of Privilege vulnerabilities disclosed this year.
- Password Safe and Total PASM manage, rotate, and monitor privileged credentials across on-premises and Azure environments, directly countering the risk created by the 9x jump in critical Azure and Dynamics 365 vulnerabilities and the ungoverned machine identities operating inside that infrastructure layer.
- Identity Security Insights continuously discovers privileged accounts, stale entitlements, and risky identity relationships across hybrid Microsoft and multi-cloud environments — mapping True Privilege™ to reveal the actual attack graph rather than the org chart, and giving security teams visibility into the “invisible” privilege risk that never receives a CVE number but carries equivalent consequences.
- Privileged Remote Access secures and audits every remote session into Windows Server and critical infrastructure, closing off one of the most common paths attackers use to reach systems still vulnerable to this year’s Remote Code Execution and Elevation of Privilege disclosures.
Combined, these capabilities implement the least-privilege and Zero Trust recommendations that the report’s own contributing experts — from Microsoft MVPs to BeyondTrust’s Phantom Labs™ research team — say are now essential rather than optional. For the full technical breakdown of every product category, the complete five-year vulnerability trendlines, and detailed guidance from Microsoft security researchers and BeyondTrust’s own threat intelligence team, access the 2026 Microsoft Vulnerabilities Report here.
Key Takeaways from the Microsoft Vulnerabilities Report 2026
- Total Microsoft vulnerabilities dipped 6% to 1,273 in 2025, but critical vulnerabilities doubled to 157, reversing more than a decade of steady improvement.
- Elevation of Privilege remains the single largest vulnerability category at 40% of all CVEs, confirming that identity and privilege — not raw patch counts — are the real attack surface to defend.
- Azure and Dynamics 365 critical vulnerabilities rose 9x, a direct concern for any organization running AI agents or Copilot workloads on that infrastructure.
- Windows (612 CVEs) and Windows Server (780 CVEs) remain the largest sources of vulnerability volume, underscoring why endpoint and server privilege controls matter more than patching speed alone.
- Microsoft Edge’s 83% year-over-year drop shows that secure-by-design investment measurably reduces vulnerability counts over time.
Final Thoughts
The Microsoft Vulnerabilities Report 2026 makes one thing clear: patch management alone is no longer sufficient defense against a Microsoft vulnerability landscape where critical flaws are concentrating in cloud infrastructure and identity boundaries.
Organizations that pair disciplined patching with least-privilege enforcement, continuous identity governance, and Zero Trust access controls are the ones best positioned to withstand a year where fewer vulnerabilities somehow added up to more risk.
To see the complete dataset — including five-year historical trends, category-by-category CVE breakdowns, and expert commentary from Microsoft MVPs Sami Laiho and Paula Januszkiewicz, security researcher Katie Moussouris, and BeyondTrust’s own security leadership — download the 2026 Microsoft Vulnerabilities Report now and see how BeyondTrust’s Pathfinder Platform can help your organization close the privilege gap before attackers find it.
→ Download the 2026 Microsoft Vulnerabilities Report (13th Edition) →
→ Have questions about your identity security posture? Speak with a BeyondTrust expert →
