1,411 Patches and One Real Fire: My Take on Microsoft's October 2026 Patch Tuesday

I opened the Microsoft Security Update Guide on Tuesday expecting a heavy month. I was not expecting this.

Microsoft's October release fixes roughly 1,411 vulnerabilities in a single drop.

That is BleepingComputer's count. SecurityWeek puts it at 1,413 and SecurityOnline at 1,414. Whichever number you go with, it is the biggest Patch Tuesday on record, well ahead of September's 966.

SecurityWeek also pointed out that this one month alone patches more CVEs than Microsoft did in the whole of 2025.

So instead of repeating the headline, I want to look at what actually matters this month, what can wait, and where I think Microsoft could do better.

The numbers, quickly

Here is how the release breaks down by impact:

And that is not even everything. Another 348 flaws, mostly in Azure services, Mariner, Exchange and Dataverse, were quietly fixed earlier in the month, and BleepingComputer left them out of its total. If you pull Microsoft's own machine readable CVRF file for October, you will find more than 1,700 entries once advisories and third party open source components are counted.

That is my first complaint. Three well known outlets read the same Microsoft data and came up with three different totals. If journalists who do this every month cannot agree on a number, what chance does a small IT team have? The count is not trivia. It is what people use to plan their patch windows and staffing.

Microsoft's new risk cohorts

October is also the first release where Microsoft has grouped CVEs into what it calls risk cohorts. A risk cohort is a set of CVEs that need the same question answered about your environment. Instead of reading 1,400 advisories one by one, you answer something like "Can untrusted content reach this component?" or "Is this role even deployed here?" once, and use that answer as the starting point for every CVE in the group. Cohorts are not built on severity, CVSS score or root cause.

Microsoft split this release into 15 cohorts:

The suggested workflow is simple. Find the cohorts that matter to you, answer the shared question once and write the answer down, then still rank the individual CVEs inside each group by active exploitation, severity, attack vector, privileges required and user interaction. Microsoft's own worked example is RDP. If RD Gateway or Session Host is reachable from the internet, the server side vulnerabilities come first. If your users mostly connect out to other machines, the client side ones matter more. If RDP only sits behind a VPN or Zero Trust access, part of the cohort can wait.

Microsoft is careful to call all of this exploratory. Cohorts are not an official classification, they do not change any update guidance, the Security Update Guide does not show them yet, and a cohort on its own does not set priority. The counts also add up to 1,118 rather than 1,411, and two of them disagree with the worked examples in the same post (RDP is listed as 65 and later described as 64, Office as 135 and later as 119). Treat the numbers as a rough map, not an exact inventory.

With the use of AI to discover vulnerabilities in code faster than ever, a high number of CVEs is more likely to become the new normal. Enterprises will need more guidance on which patch to prioritize first and will need more both external and internal context. Prateek Bhajanka, CEO at Field CISO Advisory, former Gartner Analyst and Magic Quadrant recommends:

Before jumping onto Patching, you need intelligence data points:

Patch reliability whether the patch has defects, what's the rollback rate across the industry, etc.
Internal context in terms of attack path analysis and active exposure validation to assess the exposure of crown jewels against the CVE being patched by vulnerability, to decide the urgency
Patch ROI- Which patch can bring down the exposure score of the organization by a large number or in most critical assets/ crown jewels.

Categorize the patches into zero-touch patches, low risk patches and high risk patches. Assets with high, medium and low business dependency
Zero-touch and low risk patches should be deployed right away but for high risk patches or patching on high business dependent assets , take the Mitigation First and Patch Fast approach.
For high business dependent assets, apply mitigation controls at the network layer or push IOCs/IOA, create a detection rule, reduce the attack surface of the vulnerability application, etc.

Patch this one first: CVE-2026-96951

If you patch only one thing this week, make it this one.

CVE-2026-96951 is a security feature bypass in Windows Shell, scored 8.8 on CVSS, and attackers are already using it. Microsoft says the root cause is a command injection issue that lets a crafted file slip past Mark of the Web. Mark of the Web is the tag Windows attaches to anything that came from the internet, and it is the reason you see SmartScreen warnings or Office's Protected View banner.

CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog the same day and gave US federal agencies until October 16 to patch. That is three days. Microsoft credits two researchers from Fujitsu, Benoit Sevens (working with Anthropic's Claude), and an independent researcher for reporting it

Here is where I disagree with Microsoft. The vulnerability is rated Important rather than Critical because a user has to open the file. I get the reasoning, but phishing is still how most breaches begin, and Mark of the Web bypasses keep turning up in real attacks precisely because they work.

We saw the same pattern with the SmartScreen and internet shortcut bypasses in 2023 and 2024. Once a vulnerability is being exploited, its severity label should not decide where it sits in your queue. The exploited flag and the KEV listing should.

The two publicly disclosed vulnerabilities are less urgent.

CVE-2026-108398 is a .NET Framework flaw that gets around Windows Defender Application Control. It scores 8.8 and was found by James Forshaw of Google Project Zero, but an attacker needs local access first. If your organisation treats application control as a hard security boundary, patch it soon.
CVE-2026-92707 is a denial of service vulnerability in the MessagePack library for C#, scored 5.3. Developers should update their packages, and most infrastructure teams can leave it for the normal cycle.

Spotlight: Owais Lone of Hive Pro and four Windows CVEs

In a release this size it is easy to forget that real people found these vulnerabilities, so I want to call one out. Microsoft's acknowledgements page for October credits Owais Lone, a Senior Threat Researcher at Hive Pro, as a finder on four CVEs.

Three of the four are in OpenSSH for Windows, and that is what caught my eye. The OpenSSH client comes built into modern Windows, and admins and developers run ssh, scp and sftp all day without a second thought. Microsoft's own description of the attack is simple. The attacker runs a malicious server, a user connects to it, and the client is compromised while it reads the server's reply.

This flips the usual way we think about SSH. We put a lot of work into protecting servers from clients, but very few teams ask what happens when a client connects to a server it should not trust. Think of a typosquatted Git host, a jump box that has been compromised, or a lab VM someone built from an image they found online.

The fourth vulnerability sits in libarchive, the library Windows now uses to open tar, 7z and rar files natively. A path traversal vulnerability in an archive handler is a quiet way to drop files somewhere they should never be.

Other researchers reported two of the OpenSSH vulnerabilities and the libarchive vulnerability independently as well. I see that as a good sign for defenders, but also a warning.

“When several people find the same vulnerability, it was findable, and anything findable can be found by an attacker too.”

What I like and what I don't

Credit where it is due. The risk cohorts are the first time Microsoft has openly admitted that reading every CVE no longer scales. And if AI assisted discovery really is behind this volume, as SecurityWeek reports, then every one of these patched vulnerabilities is one less zero day waiting to happen. I would much rather see 1,411 fixes than 1,411 unknown holes.

Now the criticism. Microsoft itself calls risk cohorts experimental and says they do not tell you which vulnerabilities are most dangerous, so the one tool meant to help with the flood arrives with a disclaimer attached. Severity labels are also drifting away from real world risk. An exploited vulnerability marked Important sits right next to dozens of Critical vulnerabilities that nobody is attacking, and any team that sorts by severity alone will patch in the wrong order.

The sheer volume is becoming a risk in itself. A cumulative update that touches over a thousand code paths takes real effort to test, and readers on BleepingComputer are already reporting install failures with error 0x800F0922 on Server 2019. Every failed rollout keeps the window open for attackers that much longer.

Finally, there is the support cliff. This is the last update for Windows 11 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016, and Windows 11 23H2 Enterprise and Education stop getting security fixes next month. Any of those machines still running after this will stay exposed to whatever comes next.