Microsoft Patch Tuesday Lists 1,411 Flaws and Floats Risk Cohorts

Microsoft's October 13 security release fixes a record 1,411 flaws, including CVE-2026-96951, a Windows Shell bug that is already being exploited to bypass Mark of the Web warnings, according to BleepingComputer's tally.

The same day, the Microsoft Security Response Center (MSRC) published a blog post on "risk cohorts", an experimental way to group CVEs that need the same question answered about a customer's environment. The post says it does not change Microsoft's update guidance.

The one exploited flaw and two disclosed ones

CVE-2026-96951 is a command injection in Windows Shell that lets an unauthorized attacker bypass Mark of the Web, the flag Windows attaches to files downloaded from the internet, over a network. BleepingComputer reports that Microsoft shared no details on how it is being used or who found it. Neither source gives it a CVSS score.

The two publicly disclosed flaws are not known to be exploited. CVE-2026-108398 is a .NET Framework bug that lets an authorized local attacker bypass Windows Defender Application Control (WDAC) and run unauthorized code inside a protected process. BleepingComputer credits James Forshaw of Google Project Zero with finding it and lists it as Important. CVE-2026-92707 is a denial of service in MessagePack-CSharp, rated Moderate, and Microsoft has not said who reported it.

Microsoft calls a flaw a zero-day when it is publicly disclosed or exploited before a fix exists, so all three qualify.

What 1,411 is made of

BleepingComputer counts only flaws released on Patch Tuesday itself. It excludes another 348 fixed earlier in the month. Seventy of the 1,411 are rated Critical: 57 remote code execution, 11 elevation of privilege and two spoofing.

The category counts in the article add up to 1,389, not 1,411, and the article calls its figures approximate without explaining the 22-flaw gap.

1. Elevation of privilege677 CVEs
2. Remote code execution317 CVEs
3. Information disclosure254 CVEs
4. Denial of service73 CVEs
5. Security feature bypass40 CVEs
6. Spoofing28 CVEs

Source: BleepingComputer, Oct. 13, 2026; categories sum to 1,389 against a 1,411 headline

Elevation of privilege flaws outnumber remote code execution by more than two to one. An attacker needs a foothold before using most of them, which is why the 317 remote code execution entries and the 70 Critical ratings are the numbers for internet-facing systems.

Why Microsoft published risk cohorts

MSRC defines a cohort as "a group of CVEs that require a similar customer assessment." The members need not share a root cause or a CVSS score. They share a question, such as whether untrusted content can reach a component or whether a server role is deployed. An analyst answers it once, then reviews each CVE for exploitation, severity and required privileges.

The post lists 15 illustrative cohorts totalling 1,118 CVE entries. It does not say whether cohorts overlap, so the sum may double-count. Its own text also disagrees with its table in two places.

Cohort	CVEs in table	Text of post
Windows filesystems, storage and backup	136	n/a
Office document and mail clients	135	119
Windows graphics, media and content processing	131	n/a
Remote-access and RDP deployments	65	64

Microsoft says cohorts are not official vulnerability categories, do not appear in the Security Update Guide, and do not replace CVE-by-CVE review of high-severity or exploited flaws. It is not committing to a product integration, and it asks for feedback at [email protected].

What to patch first

Start with CVE-2026-96951 on any machine where users open downloaded files, since Mark of the Web bypasses remove the prompt that warns about them. Then use the cohort of your own exposure: the 65 RDP entries on a host with Remote Desktop open, the 24 directory and certificate entries on a domain controller. The cohort counts are Microsoft's labelling, not a ranking by danger.

Support is also ending. October's update is the last for Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016. Windows 11 23H2 Enterprise, Education and IoT Enterprise stop receiving security updates in November 2026.

Operators patching more than Windows this week can read The Terminal's earlier coverage of CVE-2026-97229 in GitLab and of CERT-In's advisory CIAD-2026-0046.