Risk-Based Patching: What a 1,400-Flaw Patch Tuesday Teaches

On Tuesday 13 October 2026, Microsoft released its October security updates, and the list was longer than any single month before it. BleepingComputer counted 1,411 flaws fixed on Patch Tuesday itself, and noted that this total leaves out 348 more that Microsoft fixed earlier in October. Tenable's Satnam Narang reported 1,407 for the month, and other outlets reported 1,413.

The totals differ because people count differently, so treat any one number as a counting method, not the answer. Whichever you pick, it is well above September's release, the previous record, at 973. Narang put it in context for The Record:

"This month, there were more CVEs patched (1,407) than in the previous record-setting year 2020, when Microsoft patched 1,261 CVEs. We've now crossed the 4,000 CVE mark with two months left to go."

Microsoft says the volume reflects AI-assisted discovery of flaws in its products, according to BleepingComputer. If that holds, big months will keep coming. For anyone running their own servers, the useful question is not how big the list was. It is what a list that size does to the way you patch.

Risk-based patching: severity belongs to the flaw, priority belongs to you

A CVSS score describes a flaw in general. It tells you how bad the bug could be on a typical system. It does not know whether the affected component runs on your box, whether that box faces the internet, or whether anyone is attacking it right now.

That gap matters when the list is this long. BleepingComputer says 70 of the October fixes were rated Critical. If you sort by CVSS and start at the top, you can spend your first evening on bugs nobody is known to be using, while the one flaw Microsoft marked as exploited sits further down. That flaw, CVE-2026-96951, carries an 8.8, not a 10.

Risk-based patching changes the order. You start from your own environment and ask two things: which of these flaws can actually reach me, and which are already being used against someone. The score is still useful, but as a tiebreaker, not as the plan. I made the broader case in why patch management is your job, not the vendor's. A record month is simply the clearest proof of it.

What the record release actually contains

The October fixes are mostly Windows. BleepingComputer's approximate breakdown:

• 677 elevation of privilege
• 317 remote code execution
• 254 information disclosure
• 73 denial of service
• 40 security feature bypass
• 28 spoofing

Elevation of privilege makes up about half. Those bugs usually matter after an attacker already has a foothold, which is one more reason the raw count says little about your own risk.

Three of the flaws were zero-days:

• CVE-2026-96951, a Windows Shell security feature bypass (CVSS 8.8) that Microsoft marked as exploited. Microsoft's advisory says an attacker could send a specially crafted file, but would have "no way to force a user to view attacker-controlled content". Someone has to be convinced to click a link or open an attachment. CISA added it to its Known Exploited Vulnerabilities catalogue and gave US federal civilian agencies until Friday 16 October 2026 to remediate.
• CVE-2026-108398, a .NET Framework security feature bypass that can be used to get around Windows Defender Application Control restrictions, discovered by James Forshaw of Google Project Zero. BleepingComputer reports it was publicly disclosed before a fix was available.
• CVE-2026-92707, a denial-of-service flaw in MessagePack-CSharp, also publicly disclosed before a fix.

In plain terms, a bypass like CVE-2026-96951 goes after the Mark of the Web, the tag Windows puts on files that came from the internet. The practical result is a downloaded file that no longer gets the internet-download warning, so the user loses the one prompt that might have made them stop.

How to triage a list this size on your own box

Here is the order I use for a homelab or a small fleet. It works for Windows hosts and for everything else you run.

1. Known exploited first. If a CVE in CISA's Known Exploited Vulnerabilities (KEV) catalogue touches something you run, it goes to the top, whatever its score. CVE-2026-96951 is October's example.
2. Reachable from the internet next. Anything that accepts connections or content from outside: VPN gateways, reverse proxies, mail, remote desktop, file shares, and any machine where people open downloads and attachments.
3. Hosts whose compromise would hurt most. The hypervisor, the backup server, a domain controller if you have one, and the machine that holds your SSH keys or password vault.
4. Everything else, on your normal schedule.

CISA publishes the KEV catalogue as a JSON feed, so step one can be a shell command. This lists the most recent Microsoft entries:

curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
| jq -r '.vulnerabilities[] | select(.vendorProject=="Microsoft") | "\(.dateAdded) \(.cveID) \(.vulnerabilityName)"' \
| sort -r | head -20

For step two, start with what is actually listening. On a Linux host, ss -tlnp shows open TCP ports and the process behind each one. Compare that with what your router or firewall forwards, because the honest answer to "what is exposed" is usually longer than the one in your head.

Microsoft is thinking along the same lines. Its MSRC blog on 13 October introduced "risk cohorts": provisional groups of CVEs that share the same question about your environment, such as which assets process untrusted content or which hosts act as remote-access servers. Microsoft is careful about what they are. It says the cohorts are exploratory, are "not official Microsoft vulnerability categories", do not change its update guidance and do not replace reviewing individual CVEs. Read them as Microsoft's own starting point for the questions above, not as a verdict. The blog closes: "As AI-assisted research contributes to vulnerability discovery, this kind of approach may become more useful."

The part patching cannot cover

In the same week, CISA warned that CVE-2026-104935 in Ivanti Connect Secure (CVSS 8.6) was being exploited, again with a 16 October deadline for federal agencies. The detail that matters comes from Volexity, as reported by The Record.

Volexity began investigating malicious activity on 5 October against an Ivanti VPN appliance that was fully patched and had been abused since 3 October. It found three zero-day exploits. Ivanti patched two of them on 13 October, and the third still had no fix when The Record reported it. The Record noted it was the sixth Ivanti vulnerability added to CISA's exploited list in 2026.

A fully patched appliance was abused anyway. Patch speed is necessary, and it is not sufficient. Three habits cover the gap:

• Reduce what is exposed. Every login page on the public internet is a bet that its vendor finds bugs before attackers do. Put admin panels and remote access behind a VPN or an IP allowlist wherever you can.
• Keep a way to see what your systems are doing. Send logs off the box to somewhere an attacker on that box cannot edit, and watch for outbound connections you did not expect.
• Know what you would switch off. For each exposed service, write down the answer to "what do I turn off if there is no fix yet" before you need it.

I covered the same idea for smart devices in how to isolate IoT devices on your network: waiting for a patch is not a plan.

When the patch list stops being your problem

The same release carried an end-of-support line that is easy to miss. According to Microsoft, via BleepingComputer, Windows 11 version 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 reached end of support on 13 October 2026. The October update is the last one they receive.

If an appliance or a VM in your stack runs one of those editions, the patch list is no longer your problem. The replacement date is. Find those machines now (winver on each Windows host tells you the edition and version), decide whether to upgrade or retire each one, and until then treat them like anything else without a fix: off the internet, on a restricted network segment, and with nothing important trusting them.

If you would rather hand this off

A month like October is a lot of reading for one person with a day job. If you would rather have someone triage the list against your own hosts, apply the patches and hand you a short report of what changed and what still needs a decision, that is what I do on the services page.

Fiverr: hiteshsaini459 · Upwork: hiteshsaini25