← All stories

Threat intel

Cisco Talos Examines Sharp Rise in Monthly Vulnerability Disclosures

Cisco Talos highlights a dramatic jump in monthly vulnerability disclosures, noting that Microsoft's latest Patch Tuesday release included 1,415 vulnerabilities compared with a pre-June average of around 100 per month. The blog post examines where the surge is coming from and what it means for the future.

Cover for a threat-intel story

Cisco Talos has drawn attention to a sharp rise in the number of vulnerabilities being published each month, raising questions about what is driving the surge and what it means for defenders going forward.

According to the Cisco Talos blog, Microsoft's September Patch Tuesday release included 975 vulnerability advisories, a figure that would once have seemed extraordinary. This month, the company says, 1,415 vulnerabilities were disclosed in a single release. By comparison, Talos notes that the monthly average before June was around 100 vulnerabilities, making the scale of the increase, in its words, staggering.

The blog post sets out to answer two questions: where all of these newly disclosed vulnerabilities have come from, and what the trend suggests about the future of vulnerability discovery and disclosure. As the post's title puts it, there is only so much code, yet the volume of flaws being identified continues to climb, pointing to a structural shift rather than a one-off anomaly.

For security teams, the numbers underscore growing pressure on patch management and prioritization. When monthly disclosures rise from roughly one hundred to well over a thousand, risk-based triage becomes essential, since few organizations can remediate every issue at once.

The figures and observations here come from Cisco Talos's blog post, which examines the causes behind the increase and considers how the vulnerability landscape may evolve.

Source: Cisco Talos Blog

How to read this

Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.