On October 13, Microsoft shipped the largest Patch Tuesday in its history: 1,407 CVEs by Tenable's count, 1,417 by the SANS Internet Storm Center's, and the rest in between. A single month now exceeds any previous full year of Microsoft CVEs, and MSRC paired the release with a proposal for deciding what to patch first. The count is the headline. The story is that finding vulnerabilities has become cheap, while deciding what to do about them has not.
Six trackers, five totals, one record
What you count decides what you get. BleepingComputer's 1,411 covers only what shipped on Patch Tuesday itself and sets aside 348 flaws fixed earlier in the month, across Azure services, Exchange Server and Mariner, Microsoft's Linux distribution. The Zero Day Initiative's 1,415 includes a third-party MessagePack-CSharp bug that Microsoft folded into its release. Rapid7 counts 1,413; iTnews counts 1,417 Microsoft-assigned CVEs. Even Microsoft's own data does not reconcile: one patch-management vendor found 1,413 in the release notes, 1,414 in the product-family table and 1,411 in the published CVE list.
The splits drift the same way. BleepingComputer tallies 70 critical, 677 elevation-of-privilege and 317 remote code execution bugs; Tenable has 69 critical, with elevation of privilege at 47.9% of the total; SANS counts 76 critical and Krebs at least 78. Headlines that count three zero-days include two bugs that were only publicly disclosed. Just one was under attack: CVE-2026-96951, a Windows Shell Mark-of-the-Web bypass scored CVSS 8.8.
The methods disagree; the slope does not. On Tenable's consistent count the monthly load went 118 in May, 198 in June, 569 in July, 398 in August, 964 in September and 1,407 in October, 46% above a record set four weeks earlier. Tenable counted 1,130 for all of 2025; its researcher Satnam Narang says 2026 has crossed 4,000 with two months to go.
Microsoft said this was coming, and said it carefully
None of this surprised Microsoft. On May 12 it unveiled MDASH, a scanning harness that "orchestrates more than 100 specialized AI agents," and credited it with 16 new Windows vulnerabilities. On July 9, Windows chief Pavan Davuluri wrote that customers "will see a higher volume of security updates" in each release as AI helps defenders find more issues. July's count nearly tripled June's.
The October post is more careful than some of its coverage. MSRC does not attribute this month's volume to AI; it says the cohort approach "may become more useful" as AI-assisted research contributes to discovery. Krebs was blunter: Microsoft, he wrote, credits large language models for the volume. ZDI's Dustin Childs offers the cleanest framing: AI is not creating bugs "out of thin air", only shortening the time between a flaw existing and someone noticing it.
Cumulative updates hide some of the cost
A four-digit count does not mean a thousand packages. Windows security updates are cumulative, one package per supported version carrying every fix, so the operating system's test cycle does not grow in step with the CVE count. What grows is everything around the package: reading advisories, mapping exposure, granting exceptions, and testing the products that patch on their own. By CyberScoop's tally, October carried 134 Office fixes, 61 in developer tools and 36 in SharePoint Server, each with its own breakage risk and maintenance window.
Microsoft's prescription is to stay current and patch as soon as possible, with hotpatching, deployment rings that pause on reliability signals, and the optional fourth-week preview release for early testing. Sound advice, and also a forecast. Curtis Dukes, writing in SANS NewsBites, expects the volume to persist into the new year.
Microsoft's other answer is the risk cohort: CVEs that need the same assessment of a customer's environment, whatever their root cause or CVSS score. Rather than asking 65 times whether a Remote Desktop gateway faces the internet, an analyst answers once. MSRC lists 15 provisional cohorts, ranging from 136 CVEs down to 24, and says they are not official categories and do not replace per-CVE assessment.
Exploitation, not volume, sets the order
Cohorts sort by environment. The question that should come first is exploitation, and there the numbers run the other way. Fortra's Tyler Reguly counts 26 Microsoft CVEs from 2026 in CISA's Known Exploited Vulnerabilities catalog, against 30 last year and 32 the year before, under 1% of this year's fixes. Childs counts 15 Microsoft zero-days from January to October, against 17 in the same stretch of 2023. Annual fixes have more than tripled; confirmed exploitation has not risen with them.
The cohort table sums to 1,118 CVEs, leaving roughly 300 of the month's fixes outside it, and Daybreak Wire's reading of Microsoft's mapping places CVE-2026-96951 among them. The one bug attackers were using belongs to no cohort. That is less a flaw in the idea than a reminder of its job, and MSRC says as much: cohorts do not replace review of actively exploited bugs.
So the order writes itself. CVE-2026-96951 needs a victim who "will still have to open the file", but it is live, and CISA added it to KEV the same day with an October 16 deadline for federal agencies. Under BOD 26-04, CISA's June risk-tiering directive, agencies weigh asset exposure, KEV status, exploit automation and post-exploitation impact; the worst combination gets three days. For the long tail, EPSS estimates each CVE's probability of exploitation in the next 30 days, refreshed daily. Childs told CyberScoop that teams triaging by raw count are "burning cycles on the wrong bugs."
The 30,000-foot read
For most of software security's history, the scarce resource was discovery: someone clever had to find the bug. That scarcity is ending, and Microsoft has chosen to publish the consequence in full, CVE by CVE. What does not automate is judgment about one's own estate: which systems face the internet, which users open attachments, which servers can take a reboot on a Tuesday night. That part each organization controls, and that is where the effort belongs. Patch the exploited bug today, patch the rest on a schedule you can defend, and stop measuring security work by the count.
Three things to watch. Whether exploitation stays flat while discovery climbs; Childs calls AI-assisted exploitation real but not yet mainstream, and no one should expect that gap to hold. Whether risk cohorts graduate from a blog post into the Security Update Guide. And November 10, the next second Tuesday, which will show whether October was a peak or a step.
Sources: Microsoft MSRC, "Using risk cohorts to prioritize security updates" (cohort definition, 15 cohorts and sizes, AI-assisted research wording, exploited-bug caveat); Windows Experience Blog, Pavan Davuluri (July 9 statement on update volume, Autopatch and ring guidance); Microsoft Security blog (MDASH, 100-plus agents, 16 Windows vulnerabilities); Microsoft Learn, Windows release cycle (cumulative monthly updates, fourth-week preview, second-Tuesday schedule); CISA bulletin on BOD 26-04 (June 10 directive and its four criteria); FIRST (EPSS definition); Tenable reviews for May, June, July, August, September and October, plus its 2025 year in review (monthly series, October severity split, 2025 total); Zero Day Initiative (1,415 count, CVSS score, AI framing, zero-day comparison, full-year comparison); BleepingComputer (1,411 count, 348 earlier fixes, category split, zero-day list); SANS ISC (1,417 count, 76 critical, user interaction); Rapid7 (1,413 count); iTnews (1,417 Microsoft-assigned CVEs, the 65-question example); Krebs on Security (78 critical, 4,000-plus year to date, LLM attribution); CyberScoop (product split, Childs on triage); Hackread (Reguly's KEV counts and under-1% figure); Security Affairs (KEV addition, October 16 deadline); SANS NewsBites (Dukes on persistence); Paubox (BOD 26-04 three-day tier; vendor blog, secondary); Splashtop (Microsoft's inconsistent internal totals; vendor blog); Daybreak Wire (exploited CVE outside the cohorts). Corrections to the brief: other trackers count 1,407 to 1,417, not 1,407 to 1,413 (SANS ISC and iTnews both report 1,417). The "45% above September's 974" figure set BleepingComputer's October count against another outlet's September count; like-for-like rises are 46% (Tenable, 964 to 1,407; BleepingComputer, 966 to 1,411) and 42% (iTnews, 998 to 1,417). "Three zero-days" includes two publicly disclosed bugs; only CVE-2026-96951 was exploited, and Tenable counts two zero-days. The 70 critical figure is BleepingComputer's; other counts run from 69 (Tenable) to 80 (Action1, via Hackread). Microsoft's October post does not credit AI for October's total: the explicit link between AI-assisted discovery and update volume is Davuluri's July 9 post, and "credits large language models" is Krebs's characterization, not a Microsoft quote. CAVEATs: the 677 and 317 category counts are BleepingComputer's approximations; MDASH results are Microsoft-reported; KEV counts are Fortra's, as reported by Hackread and Krebs; the 1,118 cohort total is our sum of MSRC's table (MSRC's text gives different sizes for two cohorts) and assumes cohorts do not overlap; the exploited CVE's absence from every cohort is single-sourced to Daybreak Wire's reading of Microsoft's mapping; Microsoft's Security Update Guide release notes render only with JavaScript and could not be read directly, so totals come from the trackers cited; November 10 is derived from Microsoft's second-Tuesday schedule.