Threat reportVulnerabilityTL-2026-3435
Microsoft October 2026 Patch Tuesday: 1,118 Vulnerabilities Fixed, Grouped into 15 Risk Cohorts
Microsoft October 2026 Patch Tuesday (TL-2026-3435), also tracked as October 2026 Patch Tuesday, is a medium-severity software vulnerability, first published 2026-10-13. It has no confirmed attribution, affects Microsoft Windows (client and Server), maps to 3 MITRE ATT&CK techniques (T1021.001, T1133, T1203), and is covered by 9 detection rules and 4 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 4Indicators of compromise
Key facts for TL-2026-3435
- Threat ID
- TL-2026-3435
- Also known as
- October 2026 Patch Tuesday, Microsoft Risk Cohorts
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, energy
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 4
How Microsoft October 2026 Patch Tuesday works
Microsoft's October 2026 Patch Tuesday fixes 1,118 vulnerabilities and, for the first time in this series of releases, groups them into 15 'risk cohorts' built around shared assessment questions rather than root cause or CVSS. The largest cohorts are Windows filesystems/storage/backup (136 CVEs), Office document and mail clients (135) and Windows graphics/media/content processing (131).
On 2026-10-13 Microsoft published its October 2026 security update release, covering 1,118 CVEs. Alongside the patches, Microsoft introduced 'risk cohorts': groupings of vulnerabilities that raise similar questions about an organization's systems, users and exposure, so analysts can assess a common area once and reuse that assessment across several CVEs. Cohorts are defined by shared assessment requirements, not by common root cause or CVSS score, and are described as exploratory and not a replacement for per-vulnerability assessment in the Microsoft Security Update Guide.
The 15 cohorts and their CVE counts are: Windows filesystems, storage and backup (136); Office document and mail clients (135); Windows graphics, media and content processing (131); Windows core and kernel privilege boundaries (109); Windows installation, deployment and update services (103); Device, peripheral and print surfaces (76); DNS, DHCP and network-address infrastructure (76); Remote-access and RDP deployments (65); Windows authentication, credentials and cryptography (61); Windows networking and protocol stack (53); Virtualization, container and isolation hosts (45); Network file and resource sharing (39); Endpoint management and security controls (38); Windows web, RPC and messaging services (27); Directory, federation and certificate infrastructure (24).
The only source retrieved for this release (Cyber Security News) does not list individual CVE IDs, CVSS scores, zero-days, active exploitation, public PoCs or IOCs, so none are asserted here; cve_list is empty, cvss_score is null and severity MEDIUM is an analyst placeholder rather than a source-stated rating. The Microsoft Security Update Guide could not be retrieved (page returned no content) and the Action1 digest returned HTTP 403, so CVE-level detail remains to be confirmed from Microsoft's guide and the cohort PDF the article references but does not link.
Context from recent months shows a sharp rise in volume: July 2026 fixed 622 vulnerabilities, August 421, and September 2026 a then-record 973-974 (reporting differs by one; one aggregator reports 1,169 CVEs) including two exploited zero-days (CVE-2026-85880 Windows ALPC sandbox-escape/LPE and CVE-2026-81963 Windows Update stack LPE) and 20 wormable flaws concentrated in DNS, DHCP, Netlogon, SMB and NFS. Reporting attributes part of the growth to AI-assisted vulnerability discovery. These September facts are context only and are not claimed for the October release. Separately, October coverage notes non-Microsoft actively exploited zero-days released in the same period (Ivanti Connect Secure CVE-2026-104935, Citrix NetScaler CVE-2026-88771/CVE-2026-88772, Apple iOS/iPadOS CVE-2026-86950); these are not part of Microsoft's release.
Defender guidance: triage by cohort to reduce review overhead, but still check each CVE for exploitation status and attack prerequisites; prioritize cohorts matching internet-exposed or high-privilege assets (remote access/RDP, DNS/DHCP, authentication and directory infrastructure, Office/mail clients). MITRE mappings in this record are cohort-level exposure surfaces, not observed adversary behavior.
MITRE ATT&CK techniques used in TL-2026-3435
Lateral Movement
T1021.001 Remote Desktop Protocol
Initial Access
T1133 External Remote Services
Execution
Affected products and versions in Microsoft October 2026 Patch Tuesday
- Microsoft — Windows (client and Server)
Vulnerable versions: Supported versions prior to the October 2026 updates
Fixed in: October 2026 security updates - Microsoft — Microsoft Office document and mail clients
Vulnerable versions: Supported versions prior to the October 2026 updates
Fixed in: October 2026 security updates
Remediation for Microsoft October 2026 Patch Tuesday
Patches
- Apply the Microsoft October 2026 cumulative and security updates via Windows Update/WSUS/Intune
Immediate actions
- Review the Microsoft Security Update Guide for the October 2026 release and check each CVE for exploitation status
- Prioritize cohorts covering internet-exposed or high-privilege assets: remote access/RDP, DNS/DHCP, authentication and directory infrastructure, Office and mail clients
Workarounds
- Where patching is delayed, restrict exposure of RDP and other remote-access services and limit network reachability of DNS/DHCP and file-sharing services
Longer-term hardening
- Adopt cohort-based triage to assess shared exposure once per area while still evaluating each CVE individually
- Plan patch-pipeline capacity for sustained high monthly volumes (622 in July, 421 in August, 973-974 in September, 1,118 in October)
Timeline of Microsoft October 2026 Patch Tuesday
- July 2026 Patch Tuesday fixes 622 vulnerabilities, including exploited zero-days CVE-2026-56164 and CVE-2026-56155 (context; exact release day derived from the second-Tuesday cadence)
- August 2026 Patch Tuesday fixes 421 vulnerabilities (context; exact release day derived from the second-Tuesday cadence)
- September 2026 Patch Tuesday fixes 973-974 CVEs, then the largest ever, with two exploited zero-days (CVE-2026-85880, CVE-2026-81963) and 20 wormable flaws
- Cyber Security News publishes its analysis of the release; no individual CVE IDs, CVSS scores or exploitation status are listed
- Microsoft introduces 15 risk cohorts grouping CVEs by shared assessment questions; largest are filesystems/storage/backup (136), Office clients (135) and graphics/media (131)
- Microsoft releases October 2026 security updates fixing 1,118 vulnerabilities
Sources cited for Microsoft October 2026 Patch Tuesday
- Microsoft Fixes 1,118 Vulnerabilities in October Patch Tuesday and Introduces New Risk Cohorts
- Microsoft Security Response Center - Security Update Guide (October 2026 release notes)
- Vulnerability Digest October 2026 (Action1)
- Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days (SecurityWeek)
- Patch Tuesday septembre 2026 - récapitulatif (IT-Connect)
- Microsoft Patch Tuesday September 2026: 1,169 CVEs Ranked by Risk (Senserva)
- Ivanti warns of Connect Secure zero-day exploited in attacks (BleepingComputer)
- CISA Known Exploited Vulnerabilities Catalog
Detection coverage for TL-2026-3435
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3435 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.