Microsoft Patches for October 2026
Before we get into this month’s Microsoft release, let’s talk about what they changed. Microsoft is introducing “risk cohorts”. According to Microsoft, “They are an exploratory way to help customers organize their own analysis. They are not official Microsoft vulnerability categories, do not change Microsoft update guidance, and do not replace the assessment of individual CVEs.” Back in my day, we called these security bulletins. One component could have multiple CVEs in a single bulletin. Microsoft is reintroducing this concept at the group level. I applaud this change as it mirrors my analysis from last month (and this month). Time will tell if enterprises can capitalize on these “cohorts”, but any move made to make the monthly release more manageable is a welcome one. You can read the full details on Microsoft’s site
here.
Now on to our regularly scheduled analysis.
Well, it’s a new record release from Microsoft, again. This is also the first four-digit volume we have ever seen and includes six-digit CVEs. As always, counting this load is tricky, but I see 1,415 new CVEs from Microsoft. That puts this month at a greater volume than any previous YEAR from Microsoft. I’m starting to think I don’t like this new normal. As for the products affected by this release, we have Windows and Windows components, Office and Office Components, Developer Tools and .NET, SharePoint, Linux kernel, Skype for Business and Microsoft Lync, SQL Server and Dynamics, Azure and cloud services, and Exchange server.
Still, if there’s solace to be had, it’s in the fact that only one of these bugs is under active attack. If you go back to the “Hot 0-day Summer” of 2023, there were 17 Microsoft 0-days between January and October as opposed to 15 this year during the same period. The total number of Microsoft CVEs in 2023? Just 914. So, AI is certainly helping in bug discovery (and likely in bug patching), but we haven’t seen the same increase in the exploitation of 0-days – yet. As witnessed at the last Pwn2Own, AI-assisted exploitation is most certainly a thing. It just hasn’t hit the mainstream yet, even though other incidents are on the rise.
Hundreds of CVEs in a single release used to be the exception; now it’s the baseline. Is AI to blame? Partly. It’s accelerating bug-hunting on both sides of the fence, so vendors are finding (and fixing) more flaws, and researchers are finding them faster too. But AI isn’t creating these bugs out of thin air. It’s just shortening the time between a vulnerability existing and someone noticing it. What matters is that discovery is scaling faster than exploitation, so teams that triage by sheer CVE count instead of exploitability are burning cycles on the wrong bugs. Patch what’s proven, prioritized, and public, and treat everything else as this month’s new normal.
Two bugs in this release are listed as publicly known: CVE-2026-108398, a .NET Framework security feature bypass that could let an attacker evade Windows Defender Application Control (WDAC) enforcement, and CVE-2026-92707, a denial-of-service bug in MessagePack-CSharp that was released by a third party and is now included in Microsoft’s release. Neither is listed as under active attack.
