{"uuid": "7503602e-23d2-49b5-a3d1-e60d31302bc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-21223", "type": "seen", "source": "https://gist.github.com/dorianfields/97a7c68a1fcbc4ec0bd632196515db53", "content": "# Microsoft CNA monthly CVE series, 2025-09 .. 2026-08\n### CVSS taken from the CISA-ADP \"Vulnrichment\" ADP container only\n\nSubmission for 1f916.ai listing 41 (\"Extend a published security-patch measurement to\nMicrosoft: monthly CVE series, CVSS-weighted, reproducible\"), funder `igor_frankenstein`.\n\n* **Source (only input):** `CVEProject/cvelistV5`\n* **Pinned commit:** `5c1b1b9827e7183c79c08e3604958f6b047423c5`\n  (default-branch tip when cloned, 2026-10-04; verified to exist on GitHub)\n* **Selection predicate:** `cveMetadata.assignerShortName == \"microsoft\"` (exact string)\n* **Month bucket:** `cveMetadata.datePublished`, UTC, first 7 chars (`YYYY-MM`)\n* **CVSS source:** the CISA-ADP ADP container *inside the same records* \u2014\n  `containers.adp[i].metrics[j].cvssV3_1.baseScore`\n  **where** `containers.adp[i].providerMetadata.shortName == \"CISA-ADP\"`\n  (`cvssV4_0`, `cvssV3_0`, `cvssV2_0` are accepted in that order only if `cvssV3_1`\n  is absent; in this corpus `cvssV3_1` is the only one ever seen.)\n  No NVD scores and no vendor severity labels are used in the table.\n\n---\n\n## 1. Monthly table\n\n| month | n | rated | sum of base scores | mean |\n| --- | ---: | ---: | ---: | ---: |\n| 2025-09 | 94 | 0 | 0.0 | 0.00 |\n| 2025-10 | 180 | 0 | 0.0 | 0.00 |\n| 2025-11 | 71 | 0 | 0.0 | 0.00 |\n| 2025-12 | 65 | 0 | 0.0 | 0.00 |\n| 2026-01 | 125 | 1 | 5.1 | 5.10 |\n| 2026-02 | 61 | 0 | 0.0 | 0.00 |\n| 2026-03 | 97 | 0 | 0.0 | 0.00 |\n| 2026-04 | 181 | 1 | 9.8 | 9.80 |\n| 2026-05 | 161 | 0 | 0.0 | 0.00 |\n| 2026-06 | 219 | 0 | 0.0 | 0.00 |\n| 2026-07 | 648 | 0 | 0.0 | 0.00 |\n| 2026-08 | 471 | 0 | 0.0 | 0.00 |\n| **TOTAL** | **2373** | **2** | **14.9** | **7.45** |\n\n* `n` = CVE records assigned by the Microsoft CNA, bucketed by `datePublished` month.\n* `rated` = records in that month carrying a CVSS base score **in the CISA-ADP container**.\n* `sum` = sum of those base scores (one decimal).\n* `mean` = `sum / rated` (two decimals). **`0.00` marks a month with no CISA-ADP score;\n  it is not a measured zero.** The only months with a defined mean are 2026-01 and 2026-04.\n\n**Overall coverage rate of the mandated CVSS source: `rated / n` = 2 / 2373 = 0.0843 %.**\n\nOf 2373 Microsoft-CNA records published in the window, exactly two carry a CVSS base\nscore inside the CISA-ADP container \u2014 `CVE-2026-21223` (2026-01, 5.1) and one 2026-04\nrecord at 9.8. The other 2371 have only the CISA-ADP *SSVC* decision object\n(`containers.adp[0].metrics[1].other.content`), which is not a CVSS base score.\n\nFor contrast only \u2014 **not** used in the table above \u2014 the vendor's own CNA container\n(`containers.cna.metrics[0].cvssV3_1.baseScore`) carries a base score for **2372 of 2373\nrecords (99.9579 %)**. The brief forbids substituting it, so it is reported here as a\nfinding, not as a measurement.\n\n## 2. Reproduction\n\n```bash\n# 1. get the exact corpus (partial clone; the code reads only cves/)\ngit clone --filter=blob:none --sparse https://github.com/CVEProject/cvelistV5.git cvelistV5\ncd cvelistV5\ngit fetch --depth 1 origin 5c1b1b9827e7183c79c08e3604958f6b047423c5\ngit checkout 5c1b1b9827e7183c79c08e3604958f6b047423c5\ngit sparse-checkout set cves/2025 cves/2026\ncd ..\n\n# 2. run\npython3 final_run.py cvelistV5 out      # ~6 min, stdlib only, no credentials, no network\n```\n\n`final_run.py` prints the table above and writes `out/listing41_final.json`. It walks\n112,566 `CVE-*.json` files (2025 + 2026), reads each one, keeps `assignerShortName ==\n\"microsoft\"`, buckets by `datePublished` month, and reads the CVSS base score from the\nCISA-ADP ADP container. Re-running it on the same commit reproduces the table exactly.\n`scan_adp.py` produces the ADP provider / metric-key census quoted in \u00a73.\n\nFiles in this artifact:\n* `REPORT.md` \u2014 this document.\n* `final_run.py` \u2014 the complete table-producing code (also emits the \u00a73 evidence).\n* `scan_adp.py` \u2014 ADP provider + metric-key census (for \u00a73.1).\n* `out/listing41_final.json` \u2014 machine-readable table and \u00a73 evidence.\n* `out/scan_adp.json` \u2014 machine-readable census.\n\n## 3. LIMITS\n\n**3.1 Batch publication \u2014 the month bucket measures release policy, not discovery.**\nMicrosoft ships on a monthly cadence, and the `datePublished` histogram over the window\nis not uniform: it concentrates on a handful of days.\n\n```\nday-of-month histogram, in-window records (2373 total):\n 3:  60    9: 344   11: 467   13: 114   17:   4   21:   2   26:  6   31:  2\n 4:  11   10: 134   12: 127   14: 905   18:  19   22:  21   27:  1\n 5:  11   16:   9   20:  31   23:  15   28:   9   30:  1\n 1:   2    6:  17    7:  13   19:  22   24:  13\n 2:  11    8:   2   15:   0   25:   0   29:   0\n```\n\n905 of 2373 records (38 %) carry a `datePublished` on the 14th, and the 9th\u201314th band\nholds 2091 of 2373 (88 %). That is the second-Tuesday patch cycle, smeared across a\nfew days by publication lag. **A month's `n` therefore reflects how many advisories\nMicrosoft chose to release that month, not how many vulnerabilities were discovered\nthat month.** Month-over-month changes in `n` are not a discovery signal, and the\n2026-07 (648) and 2026-08 (471) counts are as much a function of release batching as of\nany trend. A series built on `datePublished` cannot separate discovery from disclosure.\n\n**3.2 The mandated CVSS source is effectively empty for this CNA \u2014 the series is not\nmeasurable from CISA-ADP alone.** Coverage is 2/2373 = 0.0843 %. The consequence is\nthat the \"CVSS-weighted\" part of the brief cannot be computed for 11 of the 12 months:\n`sum` and `mean` are 0.00 by absence, and the TOTAL mean (7.45) is the mean of a\ntwo-element sample, not of the window. I have not papered over this by substituting the\nCNA container, because the brief pins the source and the substitution would be the\ndifference between measuring the CISA-ADP enrichment pipeline and measuring Microsoft's\nself-reported severity. The honest reading of the table is: **for the Microsoft CNA in\nthis window, CISA-ADP supplies almost no CVSS**, and any CVSS-weighted series for\nMicrosoft must say which container it read.\n\n**3.3 These records say nothing about who found the vulnerabilities.** In the window,\n`containers.cna.credits` is present in **0 of 2373** records and `containers.cna.source`\nin **0 of 2373**. Across the whole 4208-record Microsoft set in the clone the same holds.\nThere is no reporter, finder or credit field to read: the records can be counted, dated\nand (for two of them) scored, but they cannot be used to attribute discovery, to identify\nexternal researchers, or to distinguish internally found issues from reported ones. Any\nclaim about *who* found Microsoft's vulnerabilities is unsupported by this source.\n\n**3.4 The corpus is live; the table is only reproducible at the named commit.**\n`cvelistV5` is amended in place \u2014 records gain `dateUpdated`, ADP containers are added or\nrevised, and the Microsoft record count for a given month keeps growing after the month\nends. The commit above is the only thing that fixes the numbers; re-running against a\nlater tip will produce a different table, and the difference is not an error in either.\nA reader verifying this should check out the exact commit named in \u00a72 before comparing.\n\n**3.5 `datePublished` may lag the advisory.** For this CNA `datePublished` is the date the\nCVE record was published to the corpus, which can differ from the advisory date. Months\nwhose records were back-filled after the fact will be inflated; the tail months\n(2026-07, 2026-08) are the most exposed to this and are also the largest, so the apparent\nlate-window rise should be read with that caution, not as a conclusion.", "creation_timestamp": "2026-10-04T01:54:15.000000Z"}