Patch Tuesday: Microsoft Tests Risk Cohorts to Help Prioritize 1,400+ CVEs

How do you sort through more than 1,400 vulnerabilities landing all at once in a single Patch Tuesday? Microsoft knows it is not simple and is offering a lead: “risk cohorts.” These are groups of CVEs that raise the same question about your environment.

The October 2026 Patch Tuesday fixes 1,407 vulnerabilities, after 973 vulnerabilities were already patched in September. Analyzing each CVE one by one is no longer realistic... As part of the Patch Tuesday release, the MSRC (Microsoft Security Response Center) published a post on its blog to present a method intended to ease that workload: risk cohorts. This approach is mainly designed to simplify risk analysis when deciding the order and urgency of deploying new Windows updates.

A common question instead of a CVE-by-CVE analysis

A risk cohort is a group of CVEs that require a similar assessment from the IT team. Vulnerabilities in the same cohort do not necessarily share the same root cause or the same CVSS score. What they do share is a question about your environment, for example: is this role deployed in your environment? Can a malicious file or email reach the vulnerable component? Who can execute code on these machines?

"We call these provisional groupings risk cohorts. This is an exploratory approach intended to help customers organize their own analysis.", Microsoft explains. For October's Patch Tuesday, the U.S. vendor offers 15 cohorts as examples, including the following:

• Windows file systems, storage, and backup (136 CVEs) : "What file system or storage features, and what backup paths, process local inputs, images, media, or untrusted workloads?"
• Office clients, documents, and messaging (135 CVEs) : "Which Office apps and versions are installed, what untrusted content reaches them, and how are Office updates deployed?"
• Windows graphics, media, and content processing (131 CVEs) : "Which machines process untrusted content or allow untrusted local code to interact with graphics, multimedia, or text services, and in what execution context?"
• Windows kernel and privilege boundaries (109 CVEs) : "Can untrusted or less-privileged code run on these Windows machines, and which kernel and privilege boundaries need protection?"
• DNS, DHCP, and network addressing infrastructure (76 CVEs) : "Which name-resolution and addressing services and clients are enabled, and can untrusted devices or identities interact with them?"
• Remote access and RDP deployments (65 CVEs) : "Which machines act as a remote access client, gateway, or server, and which access paths and identities are allowed?"
• Directory, federation, and certificates (24 CVEs) : "Which domain, federation, or enrollment services are enabled and reachable, and what trust and identity rights do they confer?"

RDP is used as an example by Microsoft. If RD Gateway or RD Session Host roles are reachable from the Internet, server-side flaws become the priority. If your workstations connect over RDP to internal or third-party servers, then RDP client vulnerabilities deserve your attention, because a malicious or compromised server could target the client. Finally, if your RDP access goes only through a VPN or a Zero Trust solution, some flaws in the cohort can wait a bit.

The idea is this: answer the question once (which is not always easy), and save time across dozens of CVEs.

One caveat, however: an exploited flaw, a vulnerability accessible without authentication, or one that uses a different attack vector must always be handled separately.

What the cohorts do not cover

Microsoft has published the list of CVEs for each cohort in PDF format, which makes for a nice 45-page document. The problem is that this first draft of cohorts seems incomplete: 289 vulnerabilities out of the total 1,407 CVEs do not appear in any cohort. Some server products are missing, while some flaws are left out of certain categories. Here are a few examples:

• Exchange Server : none of the 6 CVEs is classified, including CVE-2026-70571, a critical remote code execution issue.
• SharePoint Server : 35 of 36 CVEs are outside any cohort, including CVE-2026-102866, also critical.
• SQL Server : none of the 22 CVEs is classified.
• .NET and Visual Studio : only 4 out of 60 CVEs are linked to a cohort.
• Windows : 146 CVEs are outside any cohort, including the only exploited zero-day of the month, CVE-2026-96951 in Windows Shell.

In other words, a team relying solely on these cohorts would miss the month’s exploited zero-day and critical flaws in Exchange and SharePoint.

Microsoft is also being careful. “These are not official Microsoft vulnerability categories, they do not change Microsoft’s update guidance, and they do not replace per-CVE assessment”, the company says. The Security Update Guide does not currently display these groupings. In addition, the Redmond-based company is not committing to publishing them every month either... Microsoft is asking for customer feedback (at CVE@microsoft.com) to decide what comes next.

I think the idea is interesting, but it will quickly reach its limits: a single update can cover hundreds of fixes without offering any granularity. So beyond enabling more targeted prioritization of certain workstations or servers based on these cohorts, it does not really change much. Ideally, security patches would be applied granularly based on cohort membership, but we are not there yet.

What do you think?

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio