The VBScript update will affect all versions of Windows, but was rated critical on the client editions such as Windows XP, Vista, Windows 7, Windows 8 and Windows 8.1. On the server side, it was tagged as "moderate," two steps below critical on Microsoft's four-level scoring system.
The new Bulletin 2 means that there will be a critical update for Windows XP tomorrow. That's notable because Microsoft plans to stop publicly patching the nearly-13-year-old operating system after April 8.
Storms believes the IE and VBScript updates are connected.
"I suspect the IE and VBScript [updates] are related, because they may have both been delayed together in their testing," Storms said. "Maybe it's just a coincidence. But two bulletins released at the last minute? That seems related in some way to me."
As Storms pointed out, it's rare that Microsoft adds updates at the last minute, although the company has done the opposite a handful of times, yanking one or more just before Patch Tuesday because its engineers found a glitch.
"I suppose this is better than proactively putting them in the [advanced notification] and then having to pull them a few days later," Storms said.
Microsoft will release this month's security updates on Tuesday around 1 p.m. ET.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed. His email address is email@example.com.
Read more about endpoint security in Computerworld's Endpoint Security Topic Center.