Microsoft floats "risk cohorts" as patch load hits record size

Microsoft has proposed grouping vulnerabilities by the questions they raise about a customer's environment, after shipping its largest-ever monthly batch of fixes for its own software.

The October Patch Tuesday (Wednesday Australian time) release covered 1417 common vulnerabilities and exposures (CVEs) for which Microsoft was the assigning authority, an analysis of the company's machine-readable security update data suggests. 

That was 42 percent more than September's 998, which itself was a high water mark and nearly eight times the 180 Microsoft fixed in October 2025.

Of the October 2026 total, 76 were rated critical.

Microsoft marked one, CVE-2026-96951, a Windows Shell security feature bypass, as exploited in the wild. 

Alongside the monthly patch release, Microsoft's Security Response Center (MSRC) published a blog post proposing a new form of triage that it called risk cohorts.

Under that idea, each cohort gathers CVEs that require the same assessment of a customer's environment, even where the flaws share no root cause or severity score.

In practice, rather than asking 65 times whether a remote desktop gateway is reachable from the internet, an analyst would answer the question once and carry the result across every remote access flaw in the group.

MSRC published an list to illustrate the approach that runs to 15 cohorts, from Windows filesystems, storage and backup, with 136 CVEs, down to directory, federation and certificate infrastructure, with 24 CVEs.

The company was careful not to oversell the risk cohorts idea, and described the groupings as provisional ones that would not appear in its Security Update Guide (SUG) for now.

"We are not announcing a new Microsoft vulnerability classification or prioritisation framework," MSRC said.

Customers should still weigh each CVE on exploitation, severity, attack vector and user interaction, the post said.

Microsoft also linked the proposal to where its bug reports are coming from, suggesting the approach could become more useful as artificial intelligence-assisted research plays a larger part in vulnerability discovery, and is seeking feedback on the proposal.