Microsoft Risk Cohorts: How to Triage a 1,400-Flaw Patch Tuesday

By Jaspal Singh October 14, 2026 Updated: October 14, 2026

Microsoft's October 2026 Patch Tuesday fixed more than 1,400 security flaws, a record, and with it Microsoft proposed "risk cohorts": groups of related bugs that share one question about your own network. Instead of judging every CVE from scratch, an IT team answers each shared question once, then patches the exceptions first, starting with the one bug already under attack.

What Happened

On Tuesday, October 13, 2026, Microsoft shipped its monthly security updates, and the count broke every previous record. The Hacker News tallied 1,413 vulnerabilities, including 1,102 in Windows, 134 in Office, 61 in developer tools, 36 in SharePoint Server and 22 in SQL Server. BleepingComputer, which counts only fixes released on Patch Tuesday itself, put the figure at 1,411 and noted that a further 348 flaws in Azure services, Exchange Server and other products had been fixed earlier in the month.

Brian Krebs wrote that the batch dwarfs September's record of nearly 1,000 fixes, itself roughly ten times Microsoft's normal monthly load. Tenable's Satnam Narang told him the total beats the whole of 2020, when Microsoft patched 1,261 CVEs, and that Microsoft has now passed 4,000 CVEs for 2026 with two months still to go.

By BleepingComputer's breakdown, the release includes 677 elevation-of-privilege bugs, 317 remote code execution bugs, 254 information disclosure bugs, 73 denial-of-service bugs, 40 security feature bypasses and 28 spoofing flaws. Counts of "Critical" ratings differ by outlet, from 70 to at least 78, depending on what each one includes.

Only one flaw was already being exploited. CVE-2026-96951 is a command-injection bug in the Windows Shell, scored 8.8 on CVSS, that lets an attacker slip a file past Mark of the Web, the label Windows puts on downloads so Office and SmartScreen treat them with suspicion. The U.S. Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog, giving federal agencies until October 16 to patch. Two more were publicly disclosed before a fix existed: a .NET Framework flaw (CVE-2026-108398) that can bypass Windows Defender Application Control, found by James Forshaw of Google Project Zero, and a denial-of-service bug in the MessagePack-CSharp library (CVE-2026-92707).

Alongside the patches, Microsoft's Security Response Center published a post titled "Using risk cohorts to prioritize security updates", sorting the month's CVEs into 15 groups. The same day, Windows 11 version 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 received their final update.

Why It Matters

Patch volume is no longer a one-off. Microsoft has said publicly that AI-driven bug hunting, including an internal multi-model scanning system it calls MDASH, will push more fixes into every monthly release. Dustin Childs of the Zero Day Initiative put it bluntly to The Hacker News: hundreds of CVEs in one release used to be the exception, and now they are the baseline.

That matters because most organisations do not install updates blind. A hospital, bank or factory usually tests patches on a small group of machines first, checks that line-of-business software still works, and then rolls out in waves. Each CVE in a release has traditionally been read on its own: how severe is it, is anyone exploiting it, which of our systems run the affected component? At 1,400 CVEs, a small team cannot finish before the next release lands.

The real risk is spending limited attention on the wrong bugs, or delaying the whole bundle while working through an impossible list. Fortra's Tyler Reguly pointed out to Krebs that only 26 Microsoft vulnerabilities have entered CISA's exploited-bugs catalog so far this year. Out of more than 4,000 CVEs, that is the short list attackers have actually used.

For home users, little changes: Windows Update installs the cumulative package as a single unit. For anyone who decides what gets patched first across hundreds of machines, risk cohorts are Microsoft's first public attempt to make the new volume manageable.

How It Works

A risk cohort is a group of CVEs that prompt the same question about your environment. The bugs in a cohort do not need to share a root cause, a severity score or even a product. What they share is the thing you would have to check before you could rank them.

Microsoft's example is remote access. Its "Remote-access and RDP deployments" cohort covers RDP client, gateway and server bugs. Rather than reading each one separately, an analyst asks a few questions once:

Do we run RD Gateway or RD Session Host roles that are reachable from outside the network? If yes, the server-side bugs move up, because those roles receive traffic from untrusted sources.
Do our staff use RDP to connect out to third-party or internal hosts? If yes, the client-side bugs matter more, since a compromised remote host could attack the connecting client.
Is RDP reachable only through a VPN or Zero Trust gateway? If so, some bugs in the cohort may drop in urgency, because the attacker would first need access you already restrict.

Answer those once, write the answers down, and you have context for every CVE in the cohort without repeating the same investigation dozens of times.

The other 14 cohorts follow the same pattern. The largest are Windows filesystems, storage and backup (136 CVEs); Office document and mail clients (135); Windows graphics, media and content processing (131); Windows core and kernel privilege boundaries (109); and Windows installation, deployment and update services (103). Smaller ones cover DNS and DHCP, virtualization, certificate services, SMB and NFS sharing, and management agents. Each comes with a shared question, such as "Which Office applications and versions are installed, what untrusted content reaches them, and how are Office updates deployed?"

Microsoft is explicit that a cohort only sets the stage. Within the Office group, it notes, the bugs range from remote code execution to information disclosure, with 23 rated Critical and 17 needing no user interaction at all. So the suggested workflow has two passes:

Answer each cohort's environment question once and record the result.
Rank the individual CVEs inside it by active exploitation, severity, attack vector, privileges required and whether a user has to click anything.

In practice, exploited bugs still jump the queue regardless of cohort. CVE-2026-96951, the Mark of the Web bypass, needs a user to open a crafted file sent by email or chat, but because attackers are already using it, it belongs at the top of any list. One non-Microsoft fix in the same release, a 9.8-rated flaw in the Raw Image Extension (CVE-2026-21413), can trigger when Windows merely draws a thumbnail of a malicious RAW photo, so a shared answer like "do users browse untrusted images?" would push it up too.

Microsoft also published a PDF mapping October's CVEs to their cohorts. Security teams can load that list into their own tracking tools today; the official Security Update Guide does not display the groupings yet.

What's Still Unknown

Microsoft calls the approach exploratory. Its post says the cohorts "are not official Microsoft vulnerability categories", do not change its update guidance and do not replace per-CVE review. It is not committing to keep publishing them, to build them into the Security Update Guide, or to any product integration. It is asking for feedback at [email protected], and whether cohorts return in November depends on that response.

Coverage is incomplete. The 15 cohorts listed in the post add up to 1,118 CVEs, roughly 300 short of the month's total, and Microsoft has not said how the rest should be grouped. The post's own figures are also not fully consistent: the RDP cohort is listed at 65 CVEs in the table and 64 in the worked example, and the Office cohort at 135 in the table and 119 in the text. Microsoft warns that some broad groups may be split further.

Details of the active attack are thin. Microsoft has not said who is exploiting CVE-2026-96951, against whom, or how widely. Its advisory credits researchers from Fujitsu and Anthropic, among others, with reporting the flaw, but not how it was first seen in the wild.

Frequently Asked Questions

What is a risk cohort in Microsoft Patch Tuesday?

A risk cohort is a group of vulnerabilities that raise the same question about your environment, such as whether RDP servers are reachable from the internet or which Office versions open untrusted mail. Microsoft introduced 15 of them in October 2026 so teams can answer one shared question instead of investigating each of 1,400 CVEs separately, then rank individual bugs within each group.

How many flaws did the October 2026 Patch Tuesday fix?

Reports put it between 1,411 and 1,413, the largest Microsoft release on record. The difference comes from counting method: BleepingComputer counts only fixes published on Patch Tuesday itself, while other tallies include a few more. Either way it exceeds September's record of nearly 1,000 and the entire year of 2020, when Microsoft patched 1,261 CVEs.

Which October 2026 vulnerability should be patched first?

CVE-2026-96951, the Windows Shell bug that bypasses Mark of the Web, because it is already being exploited. CISA added it to its Known Exploited Vulnerabilities catalog with an October 16 deadline for federal agencies. After that, look at the publicly disclosed .NET Framework flaw CVE-2026-108398 and any critical bugs that need no user interaction on systems you expose.

Do home users need to do anything about risk cohorts?

No. Risk cohorts are a planning aid for organisations that test and stage updates across many machines. On a personal PC, Windows Update installs the whole cumulative update at once, so the practical step is simply to let it install and restart. Make sure Windows Update is not paused, especially with an actively exploited bug in this release.

Why are Microsoft patch numbers so much higher in 2026?

Microsoft says AI tools are finding bugs faster. It runs an internal multi-model scanning system called MDASH over critical Windows binaries, then validates findings before engineers fix them, and it has warned customers to expect more updates per release. Researchers note AI is not creating new bugs; it is shortening the time between a flaw existing and someone noticing it.

Do risk cohorts replace CVSS scores and severity ratings?

No. Microsoft says cohorts do not change its update guidance, are not official vulnerability categories and do not replace assessment of individual CVEs. CVSS scores, Critical or Important ratings, exploitation status and user-interaction requirements still decide the order of fixes inside each group. A cohort only removes repeated environment checks that would otherwise be done once per bug.

Is Windows 10 still getting security updates after October 2026?

Mostly yes. Microsoft had extended free Windows 10 security updates by a year after pushback, and according to Krebs on Security it has quietly extended them again to October 2027. Some specific editions differ, though: Windows 10 Enterprise LTSB 2016 received its final update this month, as did Windows 11 version 24H2 Home and Pro.

Where can I find the list of CVEs in each risk cohort?

Microsoft's Security Response Center blog post on risk cohorts links to a PDF that maps every October 2026 CVE included in the groups to its cohort. The official Security Update Guide does not show the groupings yet, because Microsoft describes the approach as provisional. Teams can import the PDF's list into their own vulnerability management or ticketing tools.