As part of a security project I'm involved in, I get reports on what vulnerabilities are on our network connected workstations etc. 

One of those vulnerabilities appearing is on EVERY workstation, and every single Windows machine I've touched in the past year, regardless if its business or consumer owned.

Now, this vulnerability (it is a minor one) is part of Windows, and NOT 3rd party related.

Microsoft knows about it, as they even have the registry fix for it in their knowledge base. 

So, why do they not add it to an update to be pushed out to everyone ? Would save people like me some time in having to eliminate it.