Sharing some personal experience with MSRC: First upfront disclaimer: I've not reported many vulnerabilities to them so far, but some high profile ones like CVE-2025-53773 and CVE-2020-16875. Mainly because I was never very active in Windows specific security research, only as a code reviewer for proprietary software. So I can't claim I'm an expert in dealing with MSRC. The few times I have dealt with them though showed one pattern: There was always a political and corporate communication angle to any conversation and interaction. and that was much stronger than with any other of the many corporations I had to deal with over the years. Where for other vendors the technical details and impact was always first, it felt like there was a filter in my interactions that delayed communication. I didn't even get an update for when something was fixed. On top of it it was never transparent who is actually looking at the vulnerabilities. In case of CVE-2020-16875 the bug was not patched correctly at least two times, despite me proposing a patch and offering help looking at theirs. I've met a few MSRC folks at conferences over the past last years and everyone was super nice and skilled! So what we can conclude: "A fish rots from the head down" Microsoft should just hand over the process to people who manage it well and own their mistakes as a corporation in a proper way. Others have successfully done it before!
Post summary
The author shares negative experiences with MSRC regarding CVE handling, noting mispatched issues, but provides no technical details, PoC, or evidence of active exploitation.
