A Record-Sized Update Batch

Microsoft’s October 2026 Patch Tuesday release addressed 1,118 vulnerabilities, one of the company’s largest monthly security updates to date, continuing a trend of expanding update volumes seen in its September and August 2026 releases. For enterprise security teams already stretched thin by routine patching cycles, a release of this size can turn a monthly chore into a weeks-long undertaking.

Introducing “Risk Cohorts”

To help ease that burden, Microsoft is piloting a new organizational concept it calls risk cohorts: groupings of vulnerabilities that share the same underlying exposure questions, rather than groupings based purely on severity score or affected product. The idea is that many CVEs, even unrelated ones, ultimately require security teams to answer a similar handful of questions, such as whether untrusted files can reach a particular Windows component, or whether a lower-privileged user can execute code locally.

By grouping flaws this way, Microsoft says analysts can answer a shared question once for an entire cohort rather than repeating nearly identical investigative work across dozens or hundreds of individual CVEs. Crucially, Microsoft stresses that cohorts are explicitly exploratory and not official vulnerability categories: they do not replace the Security Update Guide, do not establish urgency on their own, and do not remove the need to check exploitation status, required user interaction, or available attack paths for each flaw individually.

Where the Vulnerabilities Are Concentrated

Fifteen cohorts were defined for October, and Windows- and Office-related issues dominate the list by volume. The largest, covering Windows filesystems, storage, and backup features, accounts for 136 CVEs and centers on which features handle untrusted local input, disk images, or media. Office document and mail clients follow closely with 135 CVEs, where the key question is which applications are installed, what untrusted content reaches them, and how updates are deployed. Windows graphics, media, and content-processing components make up a further 131 flaws.

• Windows core and kernel privilege boundaries: 109 CVEs
• Installation, deployment, and update services: 103 CVEs
• Device, peripheral, and print surfaces: 76 CVEs
• DNS, DHCP, and network-address infrastructure: 76 CVEs
• Remote-access and RDP deployments: 65 CVEs
• Authentication, credentials, and cryptography: 61 CVEs
• Windows networking and protocol stack: 53 CVEs
• Virtualization, container, and isolation hosts: 45 CVEs
• Network file and resource sharing: 39 CVEs
• Endpoint management and security controls: 38 CVEs
• Windows web, RPC, and messaging services: 27 CVEs
• Directory, federation, and certificate infrastructure: 24 CVEs

What Security Teams Should Actually Do

For each cohort, Microsoft provides a shared assessment question meant to streamline triage. For the remote-access and RDP group, for instance, the relevant question is which hosts function as clients, gateways, or servers, and which identities and access paths are permitted to reach them. For virtualization and isolation, the question is where untrusted guest or workload code is allowed to execute.

That framing can speed up the first pass of a large release, but Microsoft is careful to note its limits. Two vulnerabilities sitting in the same cohort can still carry very different severity ratings, exploitation requirements, or exposure levels, one might require authenticated local access while another is remotely exploitable with no user interaction at all. The company’s existing Security Update Guide remains the authoritative source for the specifics of any individual CVE, with risk cohorts meant to sit alongside that process rather than replace it.

A Response to Patching Fatigue

The experiment reflects a broader industry challenge: as vendors ship larger and more frequent security updates, the manual effort required to triage, prioritize, and deploy them is growing faster than most security teams’ capacity to keep up. Grouping related questions is a modest but practical step toward making huge releases more manageable, even if it does not reduce the underlying number of fixes that eventually need to be applied.

What To Do Now

Organizations should treat October’s release with the same urgency as any other Patch Tuesday: prioritize systems exposed to the internet or accessible to lower-privileged users, apply updates addressing actively exploited or publicly disclosed flaws first, and use Microsoft’s cohort mapping as a starting point for triage rather than a final verdict on priority. Teams unfamiliar with the new framework should review Microsoft’s published cohort documentation alongside the standard Security Update Guide before adjusting existing patch management workflows.