Overview
Microsoft has shattered its own Patch Tuesday record, releasing fixes for 1,413 vulnerabilities across Windows, Office, Developer Tools, SharePoint Server and SQL Server. More than 670 vulnerabilities involve privilege escalation, over 300 involve remote code execution and more than 250 involve information disclosure. More than 70 are rated Critical. But the sheer number is no longer the most important part of the story. The challenge is determining which vulnerabilities create the greatest real-world risk and which require immediate action.
One Exploited Vulnerability Changes the Priority
Among the October updates is CVE-2026-96951, a Windows Shell command injection vulnerability rated CVSS 8.8. Microsoft confirmed that the vulnerability is being exploited in the wild, while CISA has added it to the Known Exploited Vulnerabilities catalogue. The vulnerability can allow an attacker to bypass Mark of the Web (MOTW) protections. An attack could involve convincing a user to interact with a specially crafted file, link or other attacker-controlled content. The important distinction is that this is not simply another CVE in a list of more than a thousand. There is evidence that attackers are already using it. That immediately changes its operational priority.
Not Every CVE Represents the Same Risk
Another vulnerability highlighted in the release, CVE-2026-108398, affects the .NET Framework and can potentially allow an authenticated attacker to bypass Windows Defender Application Control (WDAC). The significance here is different. An attacker already possessing local access could potentially use the vulnerability to circumvent application-control restrictions and execute unauthorised code within a protected process, without requiring user interaction. This makes the vulnerability particularly relevant as a post-compromise technique. A third issue, CVE-2026-92707, affects MessagePack-CSharp and can result in denial of service over a network. All three are vulnerabilities, but their attack conditions, impact and position within an attack chain differ considerably. That is precisely why CVSS scores alone cannot provide a complete patching strategy.
The Volume Problem Is Becoming the New Normal
Microsoft patched nearly 1,000 vulnerabilities in September. According to the reporting, more than 4,000 CVEs have now been addressed by Microsoft during 2026. Artificial intelligence is contributing to this changing environment by accelerating vulnerability discovery and remediation. AI is not creating the underlying software defects, but it can reduce the time required to identify them. The result is a security landscape in which vulnerability discovery is scaling rapidly. Organisations therefore face a different problem from traditional patch management. The question is no longer simply: “How many vulnerabilities need to be patched?”
It becomes:
“Which vulnerabilities create an exploitable path to the systems and data that matter most?”
Microsoft Introduces Risk Cohorts
Microsoft has introduced a new prioritisation concept called risk cohorts, grouping related CVEs that require similar customer assessment. The approach recognises that organisations cannot realistically treat more than a thousand vulnerabilities as identical operational priorities. Risk cohorts are intended as a starting point rather than a replacement for individual assessment. Factors including active exploitation, severity, attack vector, user interaction and product-specific guidance still need to be considered. This moves vulnerability management closer to an architectural risk model. A vulnerability affecting an isolated workstation is not necessarily equivalent to one affecting an identity server, management platform, internet-facing service or system controlling security policy.
Expert in the Cloud Insight
Microsoft’s October release demonstrates that vulnerability volume itself is becoming a security-management challenge. The traditional model of working through CVEs sequentially is increasingly impractical. Security teams need to understand where a vulnerability sits within the attack chain, whether exploitation has been observed, what privileges are required and what systems could be reached following compromise. The exploited Windows Shell vulnerability should therefore be treated differently from a vulnerability with no known exploitation and significantly different attack prerequisites. Patch management is becoming risk management. The organisations best positioned to handle this volume will not necessarily be those that patch the most CVEs first. They will be those that can rapidly identify the vulnerabilities that create the most credible path to compromise — and focus resources accordingly. As vulnerability discovery continues to accelerate, the ability to prioritise intelligently becomes just as important as the ability to patch quickly.
Leave a Reply