Microsoft's October release went out on the 13th with 1,410 CVEs by the count in its own Security Update Guide, the largest Patch Tuesday on record, with 69 rated Critical. Counted the same way, September's release came to 993 and July's to 569, so October added roughly 420 more than last month and about two and a half times July. The public trackers landed within a few of Microsoft's figure: Tenable counted 1,407, BleepingComputer 1,411, and the Zero Day Initiative 1,415, the small differences coming from how each handles republished third-party CVEs. Eight more Microsoft CVEs shipped earlier in the month, seven of them cloud fixes that need no customer action. Separately, Microsoft published 492 Azure Linux advisories over the first two weeks of October, almost all upstream Linux kernel and open-source package fixes, and none of the totals above include them.
If you have been reading this series, you already know we do not think the count is the story, and this month Microsoft appears to agree. Alongside the release, it published something new: CVEs sorted into one of 15 "risk cohorts." A cohort is not a severity tier and not a product family. It is a group of vulnerabilities that require the same question to be asked about your environment. Answer the question once and the answer applies to every CVE in the group, whether those CVEs share a root cause, a CVSS score, or nothing at all.
The fifteen cohorts
The groupings and their sizes in Microsoft's cohort document:
- Windows filesystems, storage and backup: 136
- Office document and mail clients: 135
- Windows graphics, media and content processing: 131
- Windows core and kernel privilege boundaries: 109
- Windows installation, deployment and update services: 103
- Windows device, peripheral and print surfaces: 76
- DNS, DHCP and network-address infrastructure: 76
- Remote-access and RDP deployments: 65
- Windows authentication, credentials and cryptography: 61
- Windows networking and protocol stack: 53
- Virtualization, container and isolation hosts: 45
- Network file and resource sharing: 39
- Endpoint management and security controls: 38
- Windows web, RPC and messaging services: 27
- Directory, federation and certificate infrastructure: 24
Microsoft is careful to call this exploratory. The cohorts are provisional, they are not official vulnerability categories, and they do not change patching instructions or set urgency on their own. They also do not replace checking for active exploitation, user interaction requirements, attack paths, or product-specific guidance. The CVE-to-cohort mapping ships as a separate PDF. It groups 1,118 entries, fewer than the published release totals, so it does not appear to cover every CVE in the month.
Why this matters more than the number
For four months this series has made one argument from different directions. In June and July it was volume outrunning monthly remediation. In August it was ranking: the only exploited flaw was rated Important at 7.0 and sat below every severity cutoff in common use. In September it was state: a rolled-back update quietly removed two zero-day fixes. Running through all of them was the same practical point. The unit of exposure is the role a machine plays and the services it runs, not the OS version and not the vendor's severity label.
Cohorts are Microsoft saying that out loud. "DNS, DHCP and network-address infrastructure" is not a severity, it is a question: which of my machines run those roles? "Remote-access and RDP deployments" asks where RDP is actually listening. "Virtualization, container and isolation hosts" asks which machines are hosts. At more than a thousand CVEs a month, sorting by CVSS gives you a list that is longer than your maintenance window and ordered by the wrong thing. Sorting by question gives you fifteen things to answer about your estate, most of which you can answer once and reuse.
The catch: you have to be able to answer the question
A cohort is only useful if your inventory can answer it. "Which machines run the DNS Server role" sounds trivial until you try to get a current, complete answer across on-premises servers, cloud VMs, and things somebody stood up in a lab two years ago. "Where is RDP exposed" is harder, because the answer depends on configuration and network position, not just on what is installed. "Which machines are virtualization hosts" depends on whether you count developer laptops running Hyper-V for WSL, which September's Plan9 regression suggested a lot of people forgot to.
Most patch tooling is built around OS version and update state, because that is the data that is easy to collect. Cohorts move the hard part of prioritization from the vendor to the customer's inventory. That is the right place for it, and it will expose how many environments cannot answer role and service questions with confidence.
Two of the cohorts are worth a second look given the last few months. "Windows installation, deployment and update services" holds 103 CVEs this month, in the same area where September's exploited Windows Update Stack flaw lived. "Endpoint management and security controls" holds 38. The infrastructure that delivers and verifies patches is, again, a large share of what needs patching.
The zero-days go after the controls
One flaw this month is confirmed exploited in the wild. CVE-2026-96951 is a security feature bypass in Windows Shell that defeats Mark of the Web, the tag Windows attaches to files that arrive from the internet. Microsoft describes it as a command injection flaw. An attacker sends a malicious file by email or instant message, the victim opens it, and the warnings and SmartScreen checks that Mark of the Web is supposed to trigger do not appear. Microsoft has not said who is using it or who reported it.
Two more were publicly disclosed before a fix existed. CVE-2026-108398, reported by James Forshaw of Google Project Zero, is an untrusted search path flaw in the .NET Framework, rated Important at 8.8. A local attacker who can place a crafted .NET assembly on the machine can bypass Windows Defender Application Control and run unauthorized code inside a protected process. CVE-2026-92707 is a denial of service in the MessagePack-CSharp library, rated Moderate.
Look at what the two Windows flaws actually break. Neither is a path to SYSTEM or a remote code execution bug in its own right. One defeats the check that warns a user about an untrusted file. The other defeats the allowlist that decides which code is allowed to run. These are the controls an organization deploys precisely so that it does not have to win every patching race, and they are exactly what the Endpoint management and security controls cohort is asking about. An environment that answered "we have WDAC and Mark of the Web, so untrusted code is contained" was wrong this month until the update landed, and a severity filter would not have told it so: a security feature bypass rarely reads as urgent next to 70 Critical RCEs.
Among those Critical items, the ones to look at first are again role-scoped. Ten remote code execution flaws hit the DHCP Server, five of them Critical. CVE-2026-70229 is a Critical RCE in Active Directory Domain Services, and two Critical spoofing bugs land in AD FS, the same week AD FS key container hardening moves to enforcement. On the client side, Outlook carries four Critical 9.8 RCEs and PowerPoint and Word one each, and Exchange Server takes CVE-2026-70571, an 8.1 RCE triggered by a crafted email.
Everything else under attack this week
The third-party picture this month is unusually active. Fortinet patched FortiMail CVE-2026-104286, exploited as a zero-day. Citrix fixed NetScaler ADC and Gateway, including CVE-2026-88779, exploited before a patch existed. Ivanti shipped a fix for an actively exploited Connect Secure zero-day. SonicWall's SMA1000 SSRF flaw was exploited within two days of disclosure, and Atlassian's critical CVE-2026-21589 in self-hosted Confluence, Jira, and Bitbucket Data Center was exploited after a proof of concept was published. Four of those five are edge appliances: remote access gateways, mail gateways, and application delivery controllers that sit on the internet by design and rarely share a patch process with the Windows estate.
Cisco patched critical NX-OS flaws on Nexus switches that allow code execution as root. SAP fixed 20 issues, led by a maximum-severity OAuth2 SSRF in the Cloud SDK for Python. Adobe shipped updates for Commerce, ColdFusion, Photoshop, and others. GitLab, Dell, Docker, Progress, and Kiteworks, which fixed 126 vulnerabilities including a maximum-severity flaw in its Email Protection Gateway, rounded out the week.
Changes that turn on by themselves
Two behavior changes ride along with this month's update and deserve a place in your test plan, because neither requires anyone to approve anything.
AD FS Distributed Key Manager container ACL hardening moves to enforcement. With the October update, supported versions of Windows Server run the remediation by default unless an administrator has explicitly opted out. Windows Server 2012 and 2012 R2 are not remediated automatically and still need manual work. If you run AD FS and have not tested this, test it before the update reaches your federation servers.
Windows quality updates also begin turning on memory integrity on more eligible devices, and on some of those devices that also enables virtualization-based security. The rollout is gradual, and devices where memory integrity was previously disabled are left alone. This is a good security change. It is also the kind of change that finds old kernel drivers, and the devices most likely to carry those are the ones least likely to be in a test ring.
Six days to the Secure Boot deadline
The date that matters most this month is not the 13th. It is the 19th. That is when the Microsoft Windows Production PCA 2011 certificate, which signs the Windows boot manager, expires. It is the last of the three 2011 Secure Boot certificates still in use; the other two expired in June. Microsoft's guidance is that once these certificates expire, security updates for boot components will no longer be possible on devices that have not moved to the 2023 certificates. Devices are not expected to stop booting. They simply stop being fixable at the layer below the operating system, which is where bootkits live.
The transition is not a single install. It runs as a scheduled task every 12 hours, the boot manager step waits for a restart, and Microsoft estimates 48 hours and one or more restarts per device. A machine that took October's update today but does not reboot until the weekend has not finished the change. The question to answer for every device is the same one this series keeps coming back to, applied one layer lower: does it actually carry the Windows UEFI CA 2023 and a boot manager signed by it, as verified on the device, not as recorded in a deployment log.
Deployment and lifecycle notes
KB5127648 covers Windows 11 26H2, 25H2, and 24H2, producing builds 26300.9711, 26200.9711, and 26100.9711, and KB5126653 shipped alongside it. KB5127648 is the first cumulative update for 26H2. It is also the last update Windows 11 24H2 Home and Pro will receive. Enterprise and Education editions of 24H2 continue to October 12, 2027.
Microsoft says it is not aware of new issues with this release, but it is still warning that some USB Audio Class 1.0 devices may have audio problems, a carryover from the September regression. It had also said ahead of the release that it planned to fix the Excel cut-and-paste failure and the File History and Windows Backup problems introduced by September's update. Given how September went, confirm those on your own hardware before assuming they are fixed.
October 13 is also one of the heaviest lifecycle days of the year, with 33 Microsoft lifecycle entries ending or changing. Windows Server 2022 leaves mainstream support, and this month's update is its last mainstream update; it continues to receive security updates in extended support through October 14, 2031, and hotpatch support for Datacenter: Azure Edition runs through October 2027. Office LTSC 2021 reaches end of support, and the retail Office 2021 products retire the same day. Year three of Extended Security Updates for Windows Server 2012 and 2012 R2 ends. Windows 10 Enterprise LTSB 2016 and IoT Enterprise LTSB 2016 reach end of support. Any of those still in your estate became a permanent exception today, whether or not anyone has written it down as one.
What October actually says
The useful news this month is not the record. It is that the vendor shipping more than a thousand fixes a month has conceded that a flat list ranked by severity no longer works, and has started organizing the release around questions about the customer's environment. That shifts the burden to a place many organizations are not ready for: knowing, accurately and currently, which machines run which roles and services, where those services are exposed, and whether each of those machines actually has the fix. Cohorts tell you which questions to ask. They do not answer them, and they do not tell you whether the answer you got last month is still true. Neither does a deployment log tell you which of your machines will still be able to take a boot manager fix after Monday.