- Microsoft reports 1,413 CVEs across its products in the October 2026 security release, including 1,102 Windows vulnerabilities.
- Windows Shell vulnerability CVE-2026-96951 is flagged as having exploitation detected.
- Microsoft also flags a publicly disclosed .NET Framework vulnerability (CVE-2026-108398).
- A new risk cohorts approach aims to help organizations assess vulnerabilities more efficiently.
Microsoft has released its October 2026 security updates, addressing 1,102 Windows vulnerabilities as part of a release covering 1,413 Microsoft CVEs. The October 13 release also flags a Windows Shell security feature bypass vulnerability with exploitation detected.
According to Microsoft’s October 2026 Security Update Guide, Windows accounts for most vulnerabilities. Office follows with 134, while Developer Tools accounts for 61 and SharePoint Server for 36.
October’s release surpasses September’s already record-breaking Patch Tuesday. Last month, the company addressed 974 vulnerabilities across its products, including 723 Windows vulnerabilities. October raises those figures to 1,413 Microsoft CVEs and 1,102 Windows vulnerabilities, making this month’s release substantially larger.
Microsoft is also exploring a new approach called “risk cohorts” to help organizations prioritize security updates.
October’s Patch Tuesday covers more than 1,400 Microsoft CVEs
Windows accounts for the largest share of the October security release, with 1,102 vulnerabilities listed. The remaining product families include Office, Developer Tools, SharePoint Server, SQL Server, Azure, Exchange Server, Defender, and other products.
These figures highlight the workload of keeping Microsoft’s software secure. Windows alone accounts for more than three-quarters of the vulnerabilities listed in the release, making the monthly cumulative updates particularly important for supported Windows 11, Windows 10, and Windows Server installations.
System updates are cumulative, meaning the monthly security release includes security fixes for supported operating system versions, along with other changes.
Microsoft flags two notable vulnerabilities
One of the most important entries in the October release is CVE-2026-96951, a Windows Shell security feature bypass vulnerability that the company lists under “Exploitation Detected.”
This designation makes the vulnerability a priority for review, although the release summary alone does not establish the scope of attacks or the number of affected devices.
The release also identifies CVE-2026-108398, a .NET Framework security feature bypass vulnerability that Microsoft lists as publicly disclosed.
Public disclosure does not necessarily mean a vulnerability is being exploited in attacks. However, it gives organizations another reason to assess affected systems and apply the appropriate security updates.
New risk cohorts to simplify vulnerability assessments
The company is also introducing risk cohorts, an approach intended to help organizations prioritize security updates more efficiently.
Traditionally, security teams review each CVE individually, examining affected products, attack requirements, severity, and exploitation status. However, that process becomes difficult to manage when a release contains more than 1,000 vulnerabilities.
Risk cohorts group vulnerabilities around shared assessment questions. For example, admins may need to determine which systems process untrusted files, which services are exposed to networks, or whether lower-privileged users can interact with privileged Windows components.
Instead of repeating the same initial checks for every vulnerability, teams can assess their environments against these shared questions and use the findings to support multiple reviews.
The approach does not replace Microsoft’s existing vulnerability guidance. Vulnerabilities in the same group can have different attack requirements, affected products, and exploitation status, so admins must still evaluate each applicable CVE before deciding how urgently to deploy its fix.
Pureinfotech’s Take
Microsoft’s October release reinforces what I’ve been watching all year. Security teams are dealing with a large volume of vulnerability fixes, and reviewing every issue individually can become a substantial workload.
Do you install Windows security updates as soon as they're available?
Voting closes: October 21, 2026 1:00 pm
I like the idea behind risk cohorts because it could help administrators avoid repeating the same assessment work across hundreds of vulnerabilities. However, grouping issues should make the process more efficient, not encourage organizations to treat every vulnerability as equally urgent.
For home users, I would install the October security update rather than postpone it unnecessarily. For businesses, prioritizing vulnerabilities that affect their systems, especially those flagged for exploitation, remains the most practical approach.
Mauro Huculak is a Windows How-To Expert and founder of Pureinfotech in 2010. With over 23 years as a technology writer and IT Specialist, Mauro specializes in Windows, software, and cross-platform systems such as Linux, Android, and macOS.
Certifications: Microsoft Certified Solutions Associate (MCSA), Cisco Certified Network Professional (CCNP), VMware Certified Professional (VCP), and CompTIA A+ and Network+.
Mauro is a recognized Microsoft MVP and has also been a long-time contributor to Windows Central.
You can follow him on YouTube, Threads, BlueSky, X (Twitter), LinkedIn and About.me. Email him at [email protected].
