Houston Area Patch Index
How Much Patching Work Software Vendors Are Creating for Your Business
Houston Area Patch Index: 54,209 vendor security advisories, 2022-01 through 2026-10. Published 2026-08-02. Updated 2026-10-31.
The finding: advisory volume in 2026 is running about 3.0 times the 2025 pace across all 18 tracked vendors, and with the Linux kernel left out because most of its records carry no score, the share rated critical or high has climbed from 54.9% to 67.3%. More patches, and a higher proportion of them urgent. Of the flaws that do get exploited, 70% are confirmed under attack within 30 days of the advisory being published.
The Houston Area Patch Index measures how much patching work software vendors generate for the businesses that run their products. It tracks every published security advisory across the vendors in a typical business technology stack, how severe those flaws are, and how long it takes before attackers are confirmed to be exploiting them.
Advisory Volume Over Time
Monthly published advisories across all 18 vendors. Filter by vendor group, or click a vendor to take it off the chart. Two dashed markers show when the AI vulnerability-discovery programs went public; the third shows where Linux kernel records begin, which adds a step to the line that is not a change in vendor behavior.
Vendor group
Chart view
October 2026 so far: 5,642 advisories in 30 days. That already tops September 2026, the previous record at 5,469, with 1 day to go. The latest point is a partial month.
What the dashed markers are
Two AI vulnerability-discovery programs went public in spring 2026, weeks apart. Both are marked on the chart above.
Project Glasswing April 7, 2026
An Anthropic-led industry program that gives member organizations access to Claude Mythos, a frontier AI model used to hunt for software vulnerabilities. It launched with 12 partners, Microsoft among them, and had passed 150 organizations by June. Members point it at their own code to find flaws before attackers do.
Microsoft MDASH May 2026
Microsoft's own in-house scanner, short for Multi-Model Agentic Scanning Harness. Built by the team that won the DARPA AI Cyber Challenge, it runs more than 100 AI agents across an ensemble of models against Microsoft's codebase. In July, Windows chief Pavan Davuluri credited it for rising update volume and warned releases will keep trending larger.
Severity Mix by Year
Share of advisories by severity, excluding the Linux kernel because most of its records carry no severity score. UNKNOWN means the record carried no vendor severity score.
| Severity | 2022 | 2023 | 2024 | 2025 | 2026 |
|---|---|---|---|---|---|
| Critical | 5.0% | 5.1% | 6.0% | 9.2% | 12.4% |
| High | 41.1% | 43.4% | 49.0% | 45.7% | 53.1% |
| Medium | 26.0% | 33.0% | 40.7% | 40.8% | 28.6% |
| Low | 2.3% | 2.9% | 4.2% | 4.3% | 3.2% |
| Unknown | 25.6% | 15.7% | 0.0% | 0.0% | 2.7% |
| Critical + high, of scored | 62.0% | 57.5% | 55.1% | 54.9% | 67.3% |
Advisory Count by Vendor, 2026
Advisories published so far in 2026, ranked. This is the volume each vendor is asking your team to absorb.
Build Your Stack
Select the vendors your business actually runs. The index calculates the patch load your team is absorbing.
Measurement period
Rated critical or high is a share of scored advisories only, so unscored records are excluded rather than counted as harmless. Confirmed exploited in the wild counts advisories listed in CISA's Known Exploited Vulnerabilities catalog.
Vendor Detail
Click any column heading to sort. Change compares 10 months of 2026 with all 12 months of 2025. KEV means confirmed exploited in the wild by CISA; the lag is the median number of days from publication to that confirmation.
Filter by group
| Vendor▲▼ | Group▲▼ | 2026▲▼ | 2025▲▼ | Change▲▼ | KEV▲▼ | Median Lag▲▼ |
|---|---|---|---|---|---|---|
| Linux Kernel | Linux | 8,201 | 5,674 | +45% | 12 | 94 |
| Microsoft | Big platforms | 4,434 | 1,243 | +257% | 141 | 0 |
| Oracle | Big platforms | 4,154 | 314 | +1223% | 13 | 104 |
| Google Chrome | Big platforms | 3,667 | 195 | +1781% | 40 | 2 |
| Red Hat | Linux | 1,292 | 304 | +325% | 9 | 634 |
| Apple | Big platforms | 1,187 | 730 | +63% | 52 | 2 |
| Adobe | Big platforms | 1,022 | 829 | +23% | 18 | 45 |
| Mozilla | Other vendors | 859 | 208 | +313% | 3 | 6 |
| Cisco | SMB stack | 589 | 274 | +115% | 42 | 5 |
| NVIDIA | Other vendors | 390 | 186 | +110% | 0 | - |
| Broadcom / VMware | Other vendors | 288 | 66 | +336% | 20 | 25 |
| Fortinet | SMB stack | 124 | 237 | -48% | 25 | 4 |
| Ubuntu | Linux | 123 | 37 | +232% | 1 | 170 |
| Palo Alto Networks | SMB stack | 106 | 64 | +66% | 13 | 6 |
| Veeam | SMB stack | 50 | 9 | +456% | 1 | 40 |
| Ivanti | SMB stack | 47 | 105 | -55% | 27 | 2 |
| SonicWall | SMB stack | 40 | 31 | +29% | 9 | 1 |
| Citrix | SMB stack | 30 | 14 | +114% | 17 | 5 |
Key Findings
October 2026 is already
a record month
October 2026 so far: 5,642 advisories in 30 days. That already tops September 2026, the previous record at 5,469, with 1 day to go. Google Chrome's October 6 release carried 247 advisories. Microsoft's October 13 release carried 1,473 advisories, the largest single Microsoft release in the index and 8.2 times its pre-2026 record of 180. One of them was already under active attack on release day, and that flaw was not rated critical. Google Chrome's October 20 release carried 353 advisories. Oracle's October 20 release carried 1,076 advisories. Google Chrome's October 27 release carried 52 advisories.
The patch surge is real
and widespread
Advisory volume in 2026 is running about 3.0 times the 2025 pace across the 18 tracked vendors, or 4.6 times without the Linux kernel. 16 of the 18 are ahead of their 2025 pace, though four vendors supply 77% of the 2026 count.
Severity is climbing too
The critical-plus-high share, excluding the Linux kernel, slid from 62.0% in 2022 to 54.9% in 2025, then reached 67.3% in 2026. More patches, and more of them urgent.
AI-assisted discovery arrived
as the numbers moved
Microsoft credits its own in-house AI scanner for its record volume. Google and an industry AI program report similar results. The tooling went operational in 2026 and the numbers moved with it, which shows timing, not proof of cause across every vendor.
Attacks arrive within weeks, not years
70% of flaws that get exploited are under confirmed attack within 30 days of the advisory being published. The window to apply a patch is far shorter than most maintenance cycles assume.
Silence is not safety
Some vendors publish no advisories at all. That usually means no public disclosure program rather than a flawless product. You cannot patch what a vendor never tells you about.
Patch What Gets Attacked First
You cannot patch everything the moment it ships. Nobody can. The question is which fixes go first, and how fast. The index answers both.
Severity tells you what could go wrong. Exploitation tells you what is going wrong.
Advisories published in 2026, narrowed to the ones attackers are confirmed to be using. This funnel leaves out the Linux kernel because most of its records carry no severity score to sort by.
The fixes that get attacked, get attacked fast
How long after an advisory was published before CISA confirmed attackers were exploiting it. Based on 405 confirmed cases.
Time from advisory published to confirmed attack
Whose flaws actually get attacked
Fastest growing volume, 2025 to 2026
10 months of 2026 so far against all 12 months of 2025. Not annualized, so these run ahead of the 3.0x headline.
What this means for a Houston business
- Shrink the patch window. The goal is not only patching everything faster. It is getting the exploited minority applied within days rather than months. Everything else can follow a normal maintenance rhythm.
- Rank by exploitation, then severity. The CISA Known Exploited Vulnerabilities catalog is free and public. Anything on it that touches your stack jumps the queue regardless of its severity score, because it is being used right now.
- Know what you run before the alert lands. You cannot prioritize what you have not inventoried. When a flaw lands on the exploited list, the question "do we run that?" has to be answerable in minutes, not days.
- Measure the delay, not the effort. The metric to track is the average number of days between a fix being published and being installed. If nobody is tracking that number, nobody is managing the risk.
How CinchOps Can Help
Managed IT
Patch inventory, testing, deployment, and verification on a flat monthly rate per user. No contracts, no hidden fees, no cancellation penalties.
Managed IT supportCybersecurity
Fixes prioritized against the CISA exploited-vulnerabilities catalog, so the flaws attackers are actually using jump the queue instead of waiting their turn.
Cybersecurity servicesBusiness Continuity
Geo-redundant backups outside the Gulf Coast flood zone, so a bad patch or a bad storm is a restore rather than a rebuild.
Business continuity and DRWhat This Index Does Not Measure
This index does not grade vendors. A high advisory count often reflects more transparency, not worse security. A vendor that publishes hundreds of fixes is telling you what it found, while a vendor publishing none may simply have no disclosure program at all. What the index measures is the workload landing on your IT team, not the quality of any vendor's engineering.
Methodology
- Purpose and intent
- To quantify the patching workload that software vendors generate for small and mid-sized businesses, and to track how that workload changes as AI-assisted vulnerability discovery becomes standard practice. Published as a service to the Houston business community.
- Coverage
- 18 vendors chosen for their presence in a typical business technology stack and for having enough published history to chart honestly. Vendors excluded for insufficient signal or scope: cloudflare, connectwise, crowdstrike, datto, okta, samsung mobile. Their exclusion is a data-quality decision, not a judgment about their security.
- Sources
- CVE records from the CVE.org cvelistV5 repository, Microsoft advisory counts from the MSRC Security Update Guide API, and exploitation status from the CISA Known Exploited Vulnerabilities catalog. No surveys, no self-reporting, no vendor participation.
- Reuse
- Free to reuse with credit and a link, under the CinchOps Research Data Terms of Use.
- What counts as an advisory
- One published CVE attributed to a vendor. Vendors are matched by CNA assigner. Microsoft is counted from MSRC monthly data rather than CVE records to reflect its Patch Tuesday releases accurately. One advisory does not always equal one patch: a single update can fix many CVEs, and one CVE can span several products.
- Severity
- Taken from the vendor's own CVSS score where published, with a fallback to enrichment data. Records with no score are reported as UNKNOWN rather than being imputed or dropped, because early records frequently lack scores. Any "critical or high" percentage on this page counts advisories scored 7.0 or above as a share of the advisories that carry a score at all; unscored records are left out of that denominator rather than assumed harmless.
- Confirmed exploitation
- An advisory is counted as exploited only if CISA has added it to the Known Exploited Vulnerabilities catalog, which requires evidence of real-world attacks. This is a deliberately conservative floor: it captures documented exploitation, not every flaw that has ever been attacked. The lag figures measure days from an advisory's publication to that CISA listing. 38 advisories CISA listed before their record's published date count as exploited but are left out of the lag figures.
- Known limitations
- The Linux kernel became its own CVE authority in February 2024, which sharply raised its counts for reasons unrelated to code quality and adds a step to the combined line. It is counted in advisory totals and exploitation figures, and left out of severity figures because most of its records carry no score. Industry-wide CVE volume also rose as more organizations began issuing CVEs. Advisory counts measure disclosure, not underlying security. The current month is partial.
- Revisions
- 2026-08-02: first publication. 2026-08-31: data refresh. 2026-09-16: data refresh, extending the advisory window through September 2026 for a total of 46,727 advisories. 2026-09-27: data refresh through September 26, 2026 for a total of 48,187 advisories. 2026-10-13: data refresh covering all of September 2026, which closed at 5,467 advisories; October 2026 is still in progress and is not included. 2026-10-31: data refresh adding October 2026 through October 30, 2026, the last day in the source feeds at build time; the rest of October arrives with the next refresh. 2026-10-31, later the same day: correction adding 20 NetScaler CVE records from 2026 to the Citrix row, which earlier editions missed because NetScaler now issues its own CVEs. 2026-10-31, correction: the Linux kernel now counts in every figure except severity. Earlier editions included it in the all-time total and monthly figures but left it out of the volume chart, the vendor ranking, the current-year total and the pace, while describing the pace as covering all 18 vendors. Changed: 2026 total from 18,402 to 26,603; pace from 4.6x to 3.0x (4.6x remains the figure without the kernel); attack timing from 72% of 393 cases to 70% of 405 cases. Separately, the 2026 funnel's confirmed-exploited count changed from 97 to 96 because the old count included one advisory from a vendor outside the index, and the KEV column and vendor bars now count every CISA-listed advisory rather than only those listed after publication (Apple, for example, from 37 to 52), which moved the share of advisories ever confirmed exploited from 1.09% to 0.82%. The date the Linux kernel became a CVE authority was corrected from 2022 to February 2024, and the statement that monthly patching stays inside the attack window for most exploited flaws was withdrawn because the data does not support it. A refresh extends the data window and restates every figure on the new window; it is not a correction to previously published figures. If a figure is ever corrected rather than refreshed, it will be named here with the date it changed and what it was before.
- Refresh
- The index is rebuilt from source data monthly. Figures on this page were generated 2026-10-31.