Microsoft's record October 2026 Patch Tuesday: how to triage 1,400 CVEs with exploit status, risk cohorts and VEX

Microsoft's October 2026 security release, shipped on 13 October, fixed somewhere between 1,407 and 1,417 CVEs depending on who counts. That is more than Microsoft fixed in any whole year before this one: the previous annual record was 1,261 CVEs in 2020 (CyberScoop). One bug, a Windows Shell flaw that strips Mark of the Web from downloaded files, is already being exploited, and CISA has given US federal agencies until 16 October to patch it (Daybreak Wire).

Alongside the patches, Microsoft published two things meant to make volume like this manageable: provisional risk cohorts that group CVEs by the question you have to answer about your own environment, and machine-readable VEX statements for every Microsoft-assigned CVE. This article sets out a triage order for the month, shows what the cohorts cover and what they miss, and gives you a script that pulls the release from the MSRC API and sorts it into buckets for the products you actually run.

Why the count is 1,407 or 1,413 depending on who you read

Every outlet agrees on what shipped; they disagree on what counts as "Patch Tuesday". The spread comes mostly from whether cloud-service and Exchange fixes published before the Tuesday are included (Daybreak Wire). The 1,118 figure that also circulated is not a release total at all: it is the sum of Microsoft's 15 cohort sizes (CyberSecurityNews).

Tenable's breakdown is the most useful for planning: 69 Critical, 1,337 Important and one Low, across 301 products and components. Elevation of privilege makes up 47.9% of the fixes and remote code execution 22.3% (Tenable). The growth is the real story. Tenable's monthly counts went from double digits in the spring to four figures in two steps:

Dustin Childs of the Zero Day Initiative puts the volume down partly to AI-assisted research, which he says is "just shortening the time between a vulnerability existing and someone noticing it" (CyberScoop). The exploited bug this month is itself partly credited to Anthropic's Benoit Sevens "using Claude", alongside Fujitsu researchers Riku Bamba and Yuya Chudo and a researcher listed as yhw (CyberInsider). Attackers are speeding up too: VulnCheck reports the average time from CVE publication to exploitation falling from 120 days in 2025 to 80 days in the first half of 2026 (Daybreak Wire).

Patch the exploited Windows Shell bug first

CVE-2026-96951 is a security feature bypass in Windows Shell, CVSS 8.8, rated Important. Microsoft confirms exploitation in the wild (CrowdStrike, Tenable). Mark of the Web is the tag Windows puts on files that arrive from the internet; it is what makes SmartScreen and Office's Protected View look twice. A file that loses it opens as if it were local. The attack still needs a person: the target has to open a crafted attachment or follow an attacker's link sent by email or instant message (CyberInsider).

It is the third Windows Shell flaw exploited in the wild this year, after CVE-2026-21510 in February and CVE-2026-32202 in April (Tenable). Tenable's Satnam Narang counts 26 Windows Shell vulnerabilities patched in 2026 so far, against three in all of 2025 (CyberScoop). For Windows 11 24H2, 25H2 and 26H2 the fix is in KB5127648; 26H1 gets KB5127646 (CyberInsider).

What else belongs at the top of the list

After the exploited bug, sort by how little an attacker needs. Four groups stand out this month:

• Publicly disclosed: CVE-2026-108398, a .NET Framework bypass of Windows Defender Application Control (WDAC) enforcement, CVSS 8.8, which needs local authenticated access (CrowdStrike); it is credited to James Forshaw of Google Project Zero (CyberInsider). If WDAC is one of your controls, this matters more than its rating suggests.
• Unauthenticated, network-reachable RCE: CrowdStrike counts 15 CVEs across DHCP Server, QUIC, the PostScript printer driver and PDF components, several at CVSS 9.8 (CrowdStrike). Anything reachable from an untrusted network goes next.
• No click needed in Office: 23 CVEs across Excel, PowerPoint and Visio can be triggered from the Preview Pane, and five Outlook RCEs are rated 9.8 (CrowdStrike).
• Exchange and Active Directory: CVE-2026-70571 (Exchange RCE, 8.1, Critical), CVE-2026-70279 (Exchange spoofing, 9.3) and CVE-2026-70229 (AD DS RCE, 8.1, Critical) are all marked "Exploitation More Likely" (Tenable).

What risk cohorts are, and what they leave out

Microsoft's risk cohort post defines a cohort as "a group of CVEs that require a similar customer assessment". The CVEs in a cohort need not share a root cause or a CVSS score. The idea is that you answer an environment question once ("which hosts accept untrusted guest code?") and reuse the answer across dozens of CVEs, rather than rediscovering it for each one. Microsoft is explicit that a cohort "does not determine priority by itself" and that you still review each CVE for exploitation, severity, attack vector and user interaction.

The mapping of CVEs to cohorts is a PDF; the Security Update Guide does not show cohorts, and Microsoft says it is not committing to any product integration yet (MSRC). The coverage gap is the bigger problem. Daybreak Wire counts roughly 299 CVEs outside every cohort, including the exploited Shell bug, the disclosed .NET bypass, all 36 SharePoint fixes, all 22 SQL Server fixes and seven Exchange fixes (Daybreak Wire). The post itself is not fully consistent either: the Office cohort is 135 in its table and 119 in its text.

So treat cohorts as a second step. They are good for batching the long tail once the urgent items are handled, and for turning a one-off question ("do we expose DHCP to guest Wi-Fi?") into a recorded answer you reuse next month. They are not a first-pass filter.

Pull the month into your own triage list

The MSRC CVRF API returns the whole release as one document: every CVE, its affected product IDs, its CVSS vectors and a threat list that includes the exploit status string (for example Publicly Disclosed:No;Exploited:Yes). The script below fetches a month, keeps only CVEs that touch products matching your regex, and sorts them into the buckets above. It uses only the Python standard library.

"""Sort a month of Microsoft CVEs into triage buckets from the MSRC CVRF API."""import csvimport jsonimport reimport sysimport urllib.request MONTH = sys.argv[1] if len(sys.argv) > 1 else "2026-Oct"# Only products you run, e.g. "Windows 11|Windows Server 2022|Exchange|Office"ESTATE = re.compile(sys.argv[2] if len(sys.argv) > 2 else ".", re.I)  def load(month):    if month.endswith(".json"):  # a saved copy        with open(month, encoding="utf-8") as f:            return json.load(f)    req = urllib.request.Request(        f"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/{month}",        headers={"Accept": "application/json"},    )    with urllib.request.urlopen(req, timeout=120) as r:        return json.load(r)  doc = load(MONTH)names = {p["ProductID"]: p["Value"] for p in doc["ProductTree"]["FullProductName"]}  def threat(v, kind):    # Threat types in CVRF: 0 = impact, 1 = exploit status, 3 = severity    return [t["Description"]["Value"] for t in v.get("Threats", []) if t["Type"] == kind]  def bucket(v):    status = ";".join(threat(v, 1))    severity = threat(v, 3)    vector = max((s.get("Vector", "") for s in v.get("CVSSScoreSets", [])), default="")    if "Exploited:Yes" in status:        return 1, "exploited"    if "Publicly Disclosed:Yes" in status:        return 2, "publicly disclosed"    if all(x in vector for x in ("AV:N", "PR:N", "UI:N")):        return 3, "network, no auth, no click"    if "Critical" in severity:        return 4, "critical"    if "Exploitation More Likely" in status:        return 5, "exploitation more likely"    return 6, "the rest"  rows = []for v in doc["Vulnerability"]:    products = {names.get(pid, pid) for t in v.get("Threats", []) for pid in t.get("ProductID", [])}    mine = sorted(p for p in products if ESTATE.search(p))    if not mine:        continue    rank, label = bucket(v)    score = max((s.get("BaseScore", 0) for s in v.get("CVSSScoreSets", [])), default=0)    rows.append((rank, -score, v["CVE"], label, score, v["Title"]["Value"], "; ".join(mine[:3]))) rows.sort()out = csv.writer(sys.stdout)out.writerow(["cve", "bucket", "cvss", "title", "products (first 3)"])for _, _, cve, label, score, title, prods in rows:    out.writerow([cve, label, score, title, prods])print(f"{len(rows)} CVEs touch your estate", file=sys.stderr)

# Everything that touches Windows 11, Server 2022, Exchange or Officepython3 triage_cvrf.py 2026-Oct "Windows 11|Windows Server 2022|Exchange|Office" > october.csv # Or work from a saved copycurl -sS -H "Accept: application/json" https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Oct -o 2026-Oct.jsonpython3 triage_cvrf.py 2026-Oct.json "Exchange"

Product names in CVRF are long ("Windows 11 Version 24H2 for x64-based Systems"), so a loose regex works better than exact names. A CVE whose impact is scoped to a product you do not run drops out, which is usually most of a month like this one.

VEX: tell your scanner what is not affected

Since 8 September 2026, Microsoft has published VEX (Vulnerability Exploitability eXchange) statements for every Microsoft-assigned CVE, in the OASIS CSAF 2.0 VEX profile (MSRC, AICybr). Each statement puts products into known_affected, known_not_affected, fixed or under_investigation. The documents live under https://msrc.microsoft.com/csaf/vex/, with advisories under https://msrc.microsoft.com/csaf/advisories/. Microsoft says the extra VEX data does not add any updates you have to deploy.

The practical gain is for scanners and SBOM tooling: a known_not_affected statement lets a tool drop a finding instead of raising a ticket someone has to close by hand. If your scanner reads CSAF, point it at the feed. If not, jq will show you what a single document says:

# Count products in each VEX status for every CVE in one CSAF VEX documentjq -r '.vulnerabilities[]  | [ .cve,      (.product_status.known_affected     // [] | length),      (.product_status.known_not_affected // [] | length),      (.product_status.fixed              // [] | length) ]  | @tsv' vex-document.json

The field names come from the CSAF 2.0 specification, so the same query works on VEX from other vendors that follow it.

Lifecycle changes that shipped with this release

October also closed several support windows. Windows Server 2012 and 2012 R2 finished their last paid ESU year on 13 October and will receive no more security updates; extended support also ended for Windows 10 Enterprise 2016 LTSB, and Windows Server 2022 moved from mainstream to extended support (Tenable). This is the last monthly security update for Windows 11 24H2 Home and Pro (CyberInsider), so those machines need to move to a later release before November.