Microsoft also used today's updates to launch its "Exploitability Index," a new effort announced in August. The index, which can be found in October's summary, lists each vulnerability along with the company's exploit rating. Microsoft settled on a three-step system that, in descending order of severity, predicts that researchers or hackers will come up with a consistently working exploit, develop an exploit that works only some of the time, or fail to craft attack code at all.

The inaugural index pegged eight of the month's 20 vulnerabilities with "Consistent exploit code likely" label, seven with the "Inconsistent exploit code likely" tag and four with "Functioning exploit code unlikely."

One of the bugs in the six-patch IE collection was not given a rating because exploit code is already out in the wild. The vulnerability had gone public nearly four months ago, and could have been used by identity thieves to launch cross-site scripting attacks. Microsoft, however, claimed it has no evidence that the bug had actually been exploited.

Microsoft said its predictions were for a limited period, rather than open-ended. "The Exploitability Index makes an assessment on the likelihood that code will be released that exploits the vulnerability or vulnerabilities addressed in a security bulletin within the first 30 days after that bulletin's release," said a Microsoft spokesman, who quoted a technical description of the index posted on the company's site.

"I think they put together a pretty good and consistent view into the future, based on the data they had," said Storms. He saw the new information as far more important to corporate security professionals than to consumers. "But while they have a new data set [with the index], it doesn't mean that the enterprise can do less work," he cautioned.

Previously, Microsoft said that it expects customers to add the exploitability predictions to the already available threat rankings to fine-tune how they prioritize patching.

Storms also noted that another initiative announced in August, the Microsoft Active Protections Program, which gives select security vendors an early look at technical details of vulnerabilities before patches are posted, provides a way for outside researchers to toss in their two cents. "We now have a conduit to give a difference of opinion on exploitability," he said.

nCircle is one of the security vendors that has been accepted into the MAPP.

For the fourth time in the last six months, Microsoft also set the "kill bits" of several third-party ActiveX controls in a separate update that it described in detail in a new security advisory. The last time that Microsoft disabled other vendors' ActiveX controls was in August, when it shut down buggy software from Hewlett-Packard Co. and a Washington state developer. Microsoft will only set kill bits when the ActiveX control's developer asks the company to do so.