Windows Patching, AI-Assisted Discovery and Application Assurance: A 36-Month Descriptive Study of Windows and Office CVEs, Application Release Cadence and Remediation Timing

Abstract Background: Windows patch-management teams face rising vulnerability disclosure volume, faster application release cycles and growing vendor attribution of discoveries to AI-assisted tools. Public CVE totals are often used as a proxy for this workload without a fixed product cohort, a defined disclosure date or a distinction between disclosure, release and verified protection. Methods: This descriptive study retrieved 37 monthly Microsoft Security Response Center CVRF documents (October 2023 to October 2026) and deduplicated them into a bounded Windows operating-system and Office desktop cohort, joined to the CISA Known Exploited Vulnerabilities catalogue. Each CVE is dated by its earliest valid revision. It adds a source-verified set of AI-assisted discovery credits, a purposive panel of six application release streams (Chrome, Edge, Firefox, Visual Studio Code, Notepad++ and 7-Zip), an audit of structured remediation dates and 17 product-specific dated timelines. The evidence cutoff is 26 October 2026. Results: Complete, non-overlapping annual cohorts contain 679, 941 and 2,438 distinct CVEs (+38.6% and +159.1%), while mean CVSS v3 base scores were 7.43, 7.37 and 7.28. CVEs scored 9.0 or above rose from 11 to 60 between the last two years. The latest 12 reporting months contain 3,565 CVEs. Eighteen Windows CVEs carry documented AI-assisted discovery credit; this is a verified set of examples, not an estimate of the AI share. In the latest complete year the six streams produced between 4 (7-Zip) and 69 (Edge) release days, and three major vendors announced shorter release cycles. None of 4,058 complete-window CVEs has a usable structured remediation date pair, so a whole-cohort repair-time average is not estimable. Three PHP and NGINX private-report-to-release intervals were 61, 71 and 81 days. Conclusions: The evidence supports a sharply growing disclosure workload with broadly stable average severity. AI contributes to the change, but its share, a universal discovery-speed multiplier and any proportional change in compromise risk remain unmeasured. Patching teams should measure time to verified protection, separate release intake from packaging work, and automate execution while retaining human ownership of test criteria and exceptions. Research status: This company-authored preprint (Version 1) has not been peer reviewed. Files: Windows_Patching_Research_Preprint_v1.pdf (the paper) and Windows_Patching_Analytical_Supplement_v1.zip (derived CVE-level and monthly tables, application release events, remediation timing cases, evidence ledgers, analysis and figure scripts, and a SHA-256 manifest; cached third-party pages are not redistributed).