Microsoft Patched More CVEs in October Than in All of 2025 — Its New Triage Tool Missed the One Zero-Day Under Attack
1,413 CVEs in a single Patch Tuesday, a 45% jump over September's then-record. Microsoft's new "risk cohorts" framework was built to help triage that volume — and left out all 146 uncategorized Windows CVEs, including CVE-2026-96951, the only one actually being exploited.
On October 13, 2026, Microsoft shipped its largest Patch Tuesday ever — reported at 1,413 CVEs by SecurityWeek, with other trackers landing anywhere from 1,407 to 1,415 depending on how revised and multi-product advisories get counted. By any count, it beat September's then-record of 974 by roughly 45%, and September had already beaten July's 621-CVE record by 57%. One bug in the release is confirmed exploited in the wild. Buried inside Microsoft's own new triage framework, that bug doesn't appear in any priority group at all.
The one bug that's actually being exploited
Scores as of 2026-10-19live record →
CVE-2026-96951 is a Windows Shell security-feature-bypass flaw (CWE-77) that lets an attacker evade Mark of the Web (MOTW) — the tag Windows attaches to files downloaded from the internet, which is what triggers SmartScreen and Office Protected View warnings. Per Microsoft's own advisory, exploitation requires getting a user to open a specially crafted file sent by email or chat; there's no network-reachable, zero-click path here. Microsoft credits the discovery to independent reports from researchers at Fujitsu, Anthropic, and an unnamed independent expert, and confirmed exploitation in the wild without naming an actor or campaign.
CVE-2026-96951 — disclosure to deadline
- Patch and advisory publishedMicrosoft ships the fix as part of the October Patch Tuesday release and confirms active exploitation.
- Added to CISA's KEV catalogSame-day addition, reflecting confirmed in-the-wild exploitation rather than a public PoC.
- Federal remediation deadlineCISA's BOD-driven deadline for federal civilian agencies — already passed as of this article.
Two more zero-days, neither one patched the same way
October also carried two vulnerabilities that were publicly disclosed without a patch ready at release — the inverse problem of CVE-2026-96951's silent, unpatched exploitation. Our own database confirms both had no solution on file as of publication.
| CVE-2026-108398 | CVE-2026-92707 | |
|---|---|---|
| What it is | .NET Framework security-feature bypass (CWE-426, untrusted search path) | MessagePack-CSharp denial-of-service (CWE-1325) |
| CVSS | 8.8 (High) | 5.3 (Medium) |
| Impact | Lets a locally authenticated attacker load a malicious assembly into a protected process, bypassing Windows Defender Application Control (WDAC) enforcement | Deserializing attacker-controlled data via PrimitiveObjectFormatter can exhaust the managed heap and crash the process — e.g. through a reachable SignalR hub with AddMessagePackProtocol() enabled |
| Exploitability assessment | Microsoft rates it "Exploitation Less Likely" despite being publicly disclosed pre-patch | Not yet assessed at disclosure |
| Fix status at disclosure | No official patch yet; Microsoft advisory published without one | Fixed upstream in MessagePack-CSharp 2.5.303 and 3.1.9 — a library update, not a Windows patch |
| Credited to | James Forshaw, Google Project Zero | Not specified in Microsoft's advisory |
Microsoft's answer to 1,400 CVEs a month: "risk cohorts"
To help customers triage a release this size, Microsoft's Security Response Center introduced an experimental concept this month: risk cohorts. Instead of grouping CVEs by root cause or CVSS score, a cohort groups vulnerabilities that share the same underlying question an IT team needs to answer — for example, whether untrusted files can reach a given Windows component, or whether a particular server role is installed and network-reachable. Answer the question once, and it applies across every CVE in that cohort.
We call these provisional groupings risk cohorts. This is an exploratory approach intended to help customers organize their own analysis. These are not official Microsoft vulnerability categories, they do not change Microsoft's update guidance, and they do not replace per-CVE assessment.
| Cohort | CVEs |
|---|---|
| Windows filesystems, storage, and backup | 136 |
| Office document and mail clients | 135 |
| Windows graphics, media, and content processing | 131 |
| Windows core and kernel privilege boundaries | 109 |
| Windows installation, deployment, and update services | 103 |
| DNS, DHCP, and network-address infrastructure | 76 |
| Remote access and RDP deployments | 65 |
| Windows authentication, credentials, and cryptography | 61 |
| Label | Value |
|---|---|
| July 2026 | 621 |
| September 2026 | 974 |
| October 2026 | 1413 |
What to actually do with this release
- Patch CVE-2026-96951 first, regardless of what cohort it's in (it isn't in one) — it's the only confirmed-exploited bug this month, and the KEV deadline has already passed.
- Don't lean on risk cohorts for Exchange, SharePoint, or SQL Server — coverage there is 0–3%. Review those advisories individually, the same way you would have before cohorts existed.
- Treat CVE-2026-108398 as higher priority than its 'Exploitation Less Likely' label suggests: it's publicly disclosed, unpatched, and directly undermines WDAC, a control many environments rely on.
- Use KEV status and EPSS together, not CVSS alone — CVE-2026-96951 is proof that an 8.8 with modest EPSS can still be the most urgent bug in a 1,400-CVE release.
Vulnerability data as of 2026-10-19