Microsoft's record patch load prompts a new idea: sorting fixes into 'risk cohorts'

Microsoft's October Patch Tuesday release (Wednesday in Australia) covered 1417 vulnerabilities that it assigned identifiers to, according to an analysis of its machine-readable update data. That is 42 percent more than September's 998, which was itself a record, and nearly eight times the 180 fixed in October 2025. Of the 1417, 76 were rated critical. Microsoft marked one, CVE-2026-96951, a Windows Shell security feature bypass, as exploited in the wild.

Alongside the release, the Microsoft Security Response Center proposed a new way to triage fixes, which it calls risk cohorts. Each cohort groups vulnerabilities that call for the same assessment of a customer's environment, even if the flaws share no root cause or severity score. Instead of asking 65 separate times whether a remote desktop gateway is reachable from the internet, an analyst would answer once and apply the result across every remote access flaw in the group. Microsoft's illustrative list has 15 cohorts, from Windows filesystems, storage and backup (136 CVEs) to directory, federation and certificate infrastructure (24 CVEs).

Microsoft was careful not to oversell the idea. The groupings are provisional and will not appear in its Security Update Guide for now, and it said it is not announcing a new classification or prioritisation framework. Customers should still weigh each CVE on exploitation, severity, attack vector and user interaction. Microsoft linked the proposal to the growing role of AI-assisted research in finding vulnerabilities, and is seeking feedback.