Microsoft's New 'Risk Cohorts' Leave Out October's One Exploited Bug
Of the 1,417 Microsoft-assigned CVEs in October's release, only a Windows Shell bug that silences download warnings is under attack, and CISA wants it fixed by Oct. 16. Microsoft's new triage groups leave it out, which shows why exploitation has to come first.
Microsoft's newest triage aid is a 45-page PDF titled "October 2026 - CVEs in each cohort." Its 1,119 rows sort this month's security bugs by the question an administrator should ask about their own network, such as whether a remote desktop gateway can be reached from the internet. Search it for CVE-2026-96951, the one flaw attackers are actually using, and you come up empty.
That gap sits inside the largest monthly security release Microsoft has ever shipped. On Tuesday, Oct. 13, 2026, the company published fixes for 1,409 vulnerabilities it had assigned. Its data for the month lists 1,417 once eight cloud and Exchange fixes from earlier in October are counted. Exactly one is being exploited: a Windows Shell bug that strips away the "this came from the internet" warning on downloaded files. The Cybersecurity and Infrastructure Security Agency (CISA) gave federal agencies until Friday, Oct. 16, to fix it.
October's 1,400-plus fixes measure how fast AI is finding old bugs, not how fast attackers use them. What decides this week's patching is still what is exploited and what is exposed. Microsoft's own new triage groups prove the order matters, because they skip the one bug under attack.
On Windows 11 version 24H2, 25H2 or 26H2, open Windows Update and install the October cumulative update, KB5127648, which carries the fix for the Shell bug. Windows 10 21H2 and 22H2 get KB5126657; Krebs on Security reports Microsoft quietly extended free Windows 10 security updates until October 2027. Microsoft said this is the last update for Windows 11 24H2 Home and Pro, so those owners should plan a move to the 26H2 update. Until a PC is patched, treat any file you weren't expecting with extra suspicion. The bug's entire effect is to suppress the warning you would normally see.
A small IT shop without a security team needs an order of work, not a list of 1,417 items:
- CVE-2026-96951 on every Windows endpoint and server, using CISA's Oct. 16 federal deadline as the benchmark.
- Anything internet-facing or identity-critical: Exchange (CVE-2026-70571), SharePoint (CVE-2026-102866) and Active Directory (CVE-2026-70229), plus DNS, DHCP and RD Gateway roles, where many of the 59 bugs the Zero Day Initiative (ZDI) calls wormable sit. SharePoint and Exchange are among the products Microsoft's cohort list leaves out.
- Outlook's CVE-2026-70242, rated CVSS 9.8, which fires when a crafted email appears in the Reading Pane, without a click.
- Only then, cohort-style questions to batch the rest.
Housekeeping: Windows Server 2012 and 2012 R2 are past their final paid Extended Security Updates year, which ended Oct. 13, Tenable noted. The five BitLocker fixes deserve proportion. None is exploited. The one bypass, CVE-2026-83500, needs physical access or administrator privileges, Microsoft said, though another of the five, CVE-2026-96909, is a network code-execution bug scored 9.8 and rated Important. Give traveling laptops a startup PIN alongside TPM protection, as CyberSecurityNews suggested.
One bug under attack, and a three-day clock
Mark of the Web (MOTW) is quiet Windows plumbing. A downloaded file gets tagged as coming from the internet, and that tag tells Defender SmartScreen and Office Protected View to restrict what it can do automatically, SecurityWeek explained. Strip the tag and a malicious file can launch without the warnings that make a careful user pause.
That is what CVE-2026-96951 does. Microsoft classes it as command injection in Windows Shell, letting an unauthorized attacker bypass a security feature over a network. It scores 8.8 on the CVSS severity scale and is rated Important; someone has to open the booby-trapped file, which Help Net Security said can arrive through email or chat apps such as Teams and Slack. Nearly every supported version of Windows and Windows Server is affected; per-version fixes are in Microsoft's advisory for CVE-2026-96951.
Nobody has disclosed who is exploiting it or against whom, but the pattern is familiar. This is the third Windows Shell flaw exploited in the wild in 2026, after CVE-2026-21510 in February and CVE-2026-32202 in April. Tenable's Satnam Narang, quoted by Help Net Security, said the February bug was linked to APT28, the Russian group also known as Fancy Bear, and that the April fix closed an incomplete patch for it. Whether October's bug belongs to that lineage is unclear, he said.
CISA added it to its Known Exploited Vulnerabilities catalog on Oct. 13 with a due date three days later. February's six zero-days, added Feb. 10, got 21 days. The federal clock has tightened since winter: since March, CISA has given several Microsoft entries, this one included, just three days.
Microsoft's acknowledgments credit a researcher listed as "yhw," Riku Bamba and Yuya Chudo of Fujitsu Limited, and "Benoit Sevens using Claude with Anthropic." AI is inflating the monthly count, and it also helped find the bug that actually matters.
A discovery boom, not an attack boom
Microsoft's own feed shows a quiet first half of 2026, then a break in July.
October's 1,409 is 12.6 times January's 112. It is also up 44.8% on September, which Krebs noted was already about 10 times Microsoft's normal monthly load. A single October now carries more Microsoft fixes than all of 2025, when Tenable counted 1,130. Tenable's Narang told Krebs the year passed 4,000 with two months still to go.
In a July 9 blog post, executive vice president Pavan Davuluri warned that Windows users would see more security updates because AI is aiding vulnerability discovery. Part of that is Microsoft's own MDASH, a "multi-model agentic scanning harness" that orchestrates more than 100 specialized AI agents and found 16 of May's fixed bugs, SecurityWeek reported. CVE numbers now run to six digits, and Excel alone took 69 fixes.
"But AI isn't creating these bugs out of thin air. It's just shortening the time between a vulnerability existing and someone noticing it."
Dustin Childs, head of threat awareness at the Zero Day Initiative
These bugs were already in the code; what changed is how fast someone, or something, writes them down. For a home user, that is reassuring. Of 1,417 fixes, one is known to be exploited, about 0.07%, and the same Windows Update click covers them all.
The wider data agrees. Fortra's Tyler Reguly counted 26 Microsoft 2026 CVEs in CISA's catalog before this month, fewer than in either of the two previous years. ZDI counts 15 Microsoft zero-days from January through October, against 17 in the same months of 2023. That whole year had only 914 Microsoft CVEs. VulnCheck found that 1.3% of bugs attributed to AI-assisted discovery in the first half of 2026 were exploited, in line with vulnerabilities overall.
"What matters is that discovery is scaling faster than exploitation, so teams that triage by sheer CVE count instead of exploitability are burning cycles on the wrong bugs. Patch what's proven, prioritized, and public, and treat everything else as this month's new normal."
Dustin Childs, Zero Day Initiative
None of this makes the volume free. VulnCheck also found that the average time from CVE publication to exploitation fell from 120 days in 2025 to 80 in the first half of this year. And Socura research cited by Infosecurity Magazine found 22% of UK CISOs have called in sick or booked holiday to avoid Patch Tuesday. The danger isn't that Windows got weaker. It is that the one bug that matters gets lost among the other 1,416.
Seven totals for one release
Outlets printed seven totals, and most are right on their own terms.
| Reported total | Who | What it counts |
|---|---|---|
| 1,407 | Tenable | Patch Tuesday CVEs it tallied (69 Critical) |
| 1,409 | Microsoft data; Action1 | Microsoft-assigned CVEs first published Oct. 13 |
| 1,411 | BleepingComputer, Infosecurity | Only flaws released on Patch Tuesday itself (BleepingComputer's stated rule) |
| 1,413 | SecurityWeek, The Hacker News, Hackread | Figure SecurityWeek attributes to Microsoft |
| 1,415 | Zero Day Initiative, Cisco Talos | "New CVEs from Microsoft" (ZDI) |
| 1,417 | Microsoft data; iTnews | All Microsoft-assigned CVEs in the October document, incl. 8 published earlier |
| 1,118 | CyberSecurityNews | Sum of Microsoft's 15 risk cohorts, not the release |
Every serious count lands between 1,407 and 1,417. The spread comes from counting rules, chiefly whether cloud fixes published before Tuesday belong to Patch Tuesday, not from any dispute about what shipped. Even "zero-day" splits: BleepingComputer counts three by including publicly disclosed bugs such as the .NET bypass CVE-2026-108398, while Krebs counts one exploited.
"Recently, I've argued that numbers are meaningless. This month's number, 1413, is no different."
Tyler Reguly, associate director of security research and development at Fortra, to Hackread
The outlier, 1,118, is the sum of the cohort sizes in Microsoft's new proposal, which is where the better story sits.
What the cohorts leave out
The Microsoft Security Response Center (MSRC) published Microsoft's risk-cohort proposal alongside the release.
"A risk cohort is a group of CVEs that require a similar customer assessment. The CVEs may not share a root cause or a CVSS score. What they share is a question about the customer environment that can inform prioritization."
Microsoft Security Response Center, blog post, Oct. 13
The worked example is remote access. If RD Gateway or RD Session Host roles are reachable from outside the corporate network, prioritize the server-side CVEs; if RDP sits only behind a VPN or Zero Trust path, some can wait. As iTnews put it, an analyst answers the gateway question once rather than 65 times. Microsoft lists 15 illustrative cohorts and says they are not official categories, do not change its update guidance and do not replace assessing individual CVEs.
The idea is sound. The coverage is not. Checking the cohort list Microsoft published against its update data shows 1,118 of 1,417 CVEs, or 78.9%, inside a cohort. The 299 outside include the exploited Shell bug and the disclosed .NET bypass. They also include the only Critical SharePoint flaw, exploitable without authentication, and a Critical Exchange remote-code-execution bug rated "Exploitation More Likely." All 36 SharePoint fixes are missing, as are all 22 SQL Server fixes and seven for Exchange. The Outlook Reading Pane bug and the Active Directory flaw did make it in.
This is not a scandal. Microsoft calls the cohorts illustrative and says they do not replace review of actively exploited bugs. But the omissions show what cohorts are: a second-step tool for batching environment questions once the urgent work is done.
Microsoft built its cohort list to help admins answer hundreds of questions about their own networks. This week's most important question already has an answer: one bug, under attack, fixed by an update most PCs will offer on their own.
