# Microsoft October 2026 Patch Tuesday: 1,118 Vulnerabilities Fixed, Grouped into 15 Risk Cohorts

> Microsoft's October 2026 Patch Tuesday fixes 1,118 vulnerabilities and, for the first time in this series of releases, groups them into 15 'risk cohorts' built around shared assessment questions rather than root cause or CVSS. The largest cohorts are Windows filesystems/storage/backup (136 CVEs), Office document and mail clients (135) and Windows graphics/media/content processing (131).

- **Published:** 2026-10-13T18:46:51Z
- **Last reviewed:** 2026-10-13T18:46:51Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3435
- **ID:** TL-2026-3435
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 4 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-13 Microsoft published its October 2026 security update release, covering 1,118 CVEs. Alongside the patches, Microsoft introduced 'risk cohorts': groupings of vulnerabilities that raise similar questions about an organization's systems, users and exposure, so analysts can assess a common area once and reuse that assessment across several CVEs. Cohorts are defined by shared assessment requirements, not by common root cause or CVSS score, and are described as exploratory and not a replacement for per-vulnerability assessment in the Microsoft Security Update Guide.

The 15 cohorts and their CVE counts are: Windows filesystems, storage and backup (136); Office document and mail clients (135); Windows graphics, media and content processing (131); Windows core and kernel privilege boundaries (109); Windows installation, deployment and update services (103); Device, peripheral and print surfaces (76); DNS, DHCP and network-address infrastructure (76); Remote-access and RDP deployments (65); Windows authentication, credentials and cryptography (61); Windows networking and protocol stack (53); Virtualization, container and isolation hosts (45); Network file and resource sharing (39); Endpoint management and security controls (38); Windows web, RPC and messaging services (27); Directory, federation and certificate infrastructure (24).

The only source retrieved for this release (Cyber Security News) does not list individual CVE IDs, CVSS scores, zero-days, active exploitation, public PoCs or IOCs, so none are asserted here; cve_list is empty, cvss_score is null and severity MEDIUM is an analyst placeholder rather than a source-stated rating. The Microsoft Security Update Guide could not be retrieved (page returned no content) and the Action1 digest returned HTTP 403, so CVE-level detail remains to be confirmed from Microsoft's guide and the cohort PDF the article references but does not link.

Context from recent months shows a sharp rise in volume: July 2026 fixed 622 vulnerabilities, August 421, and September 2026 a then-record 973-974 (reporting differs by one; one aggregator reports 1,169 CVEs) including two exploited zero-days (CVE-2026-85880 Windows ALPC sandbox-escape/LPE and CVE-2026-81963 Windows Update stack LPE) and 20 wormable flaws concentrated in DNS, DHCP, Netlogon, SMB and NFS. Reporting attributes part of the growth to AI-assisted vulnerability discovery. These September facts are context only and are not claimed for the October release. Separately, October coverage notes non-Microsoft actively exploited zero-days released in the same period (Ivanti Connect Secure CVE-2026-104935, Citrix NetScaler CVE-2026-88771/CVE-2026-88772, Apple iOS/iPadOS CVE-2026-86950); these are not part of Microsoft's release.

Defender guidance: triage by cohort to reduce review overhead, but still check each CVE for exploitation status and attack prerequisites; prioritize cohorts matching internet-exposed or high-privilege assets (remote access/RDP, DNS/DHCP, authentication and directory infrastructure, Office/mail clients). MITRE mappings in this record are cohort-level exposure surfaces, not observed adversary behavior.

## MITRE ATT&CK

- T1133 External Remote Services
- T1203 Exploitation for Client Execution
- T1021.001 Remote Desktop Protocol

## Sources

- [Microsoft Fixes 1,118 Vulnerabilities in October Patch Tuesday and Introduces New Risk Cohorts](https://cybersecuritynews.com/microsoft-october-patch-tuesday-2026/)
- [Microsoft Security Response Center - Security Update Guide (October 2026 release notes)](https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct)
- [Vulnerability Digest October 2026 (Action1)](https://action1.com/patch-tuesday/vulnerability-digest-october-2026-third-party-updates)
- [Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days (SecurityWeek)](https://www.securityweek.com/microsoft-patches-record-974-vulnerabilities-including-two-exploited-zero-days/)
- [Patch Tuesday septembre 2026 - récapitulatif (IT-Connect)](https://www.it-connect.fr/patch-tuesday-septembre-2026-recapitulatif/)
- [Microsoft Patch Tuesday September 2026: 1,169 CVEs Ranked by Risk (Senserva)](https://senserva.com/patch-tuesday.html)
- [Ivanti warns of Connect Secure zero-day exploited in attacks (BleepingComputer)](https://bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3435