Microsoft Fixes 1,118 Vulnerabilities in October Patch Tuesday and Introduces New Risk Cohorts

Microsoft’s October 2026 Patch Tuesday briefing outlines 1,118 vulnerabilities across 15 risk groups, alongside a new approach designed to help security teams review large update releases.

Called risk cohorts, these groups bring together flaws that require similar questions about an organization’s systems, users, and exposure. Microsoft’s accompanying document maps individual CVEs to these shared areas of assessment.

The goal is to reduce repeated work without removing the need to review each vulnerability. Instead of asking the same deployment questions hundreds of times, analysts can assess a common area once and use that information across several CVEs. Microsoft describes the approach as exploratory, not a replacement for its existing update guidance or individual vulnerability assessments.

The release follows other large update cycles covered in Cybersecuritynews.com’s September 2026 Patch Tuesday report and August 2026 Patch Tuesday coverage. Those reports show the broad range of Microsoft products that enterprise teams must consider when planning security updates.

Why Microsoft Is Exploring Risk Cohorts

Traditional vulnerability review starts with each CVE. Analysts check its severity, affected products, attack requirements, and exploitation status. They then decide how quickly their organization needs to respond. That process remains necessary, but a large release can force teams to repeat many of the same checks.

For example, several flaws may require analysts to establish whether untrusted files reach a Windows component. Others may depend on whether users with limited permissions can run code locally. Server vulnerabilities may require checking whether a particular role is installed and reachable.

A risk cohort groups vulnerabilities around those shared questions. The flaws do not need to have the same root cause or CVSS score. Their connection is the assessment needed to understand exposure in the customer’s environment.

Microsoft highlights that these provisional groups are not official vulnerability categories. They do not change patching instructions, determine urgency on their own, or replace checks for active exploitation, user interaction, attack paths, and product guidance.

Windows and Office Dominate the Groups

The largest listed cohort covers Windows filesystems, storage, and backup, with 136 CVEs. Its shared assessment focuses on features and backup paths that handle untrusted input, disk images, media, or workloads. Office document and mail clients follow with 135 CVEs, while Windows graphics, media, and content processing accounts for 131.

For Office, the useful questions concern installed applications and versions, incoming documents and messages, and how updates reach users. Graphics and media reviews focus on systems that process untrusted content and the permissions under which those components operate.

Windows core and kernel privilege boundaries contain 109 CVEs. Installation, deployment, and update services contain another 103. These groups focus attention on whether code running with limited permissions can interact with more privileged parts of Windows.

Device, peripheral, and print surfaces account for 76 CVEs, matching the 76 assigned to DNS, DHCP, and network address infrastructure. Remote access and RDP deployments contain 65, authentication and cryptography contain 61, and the Windows networking stack contains 53.

The remaining listed groups cover virtualization and isolation with 45 CVEs, network file sharing with 39, endpoint management and security controls with 38, web and messaging services with 27, and directory, federation, and certificate infrastructure with 24. Microsoft provides the individual mappings in its October cohort PDF.

The practical value lies in connecting vulnerability details to actual deployment. For remote access, teams need to identify clients, gateways, and servers, then examine permitted access paths and identities. For virtualization, the shared question is where untrusted guest or workload code is allowed to run.

Those answers can support several reviews, but they cannot settle every patching decision. Two flaws in the same cohort may have different attack requirements, affected versions, or exploitation status.

Microsoft’s Security Update Guide remains the reference for individual advisories. Teams should use cohort assessments alongside those records, not instead of them. The approach offers a way to organize a heavy workload while keeping each vulnerability’s specific risks visible throughout the patching process.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post Microsoft Fixes 1,118 Vulnerabilities in October Patch Tuesday and Introduces New Risk Cohorts appeared first on Cyber Security News.