1,400 CVEs in one Patch Tuesday: your Azure triage plan

Microsoft's October 2026 Patch Tuesday, released on 13 October, fixed more than 1,400 vulnerabilities in a single month. Tenable counts 1,407, Rapid7 1,413, Trend Micro's Zero Day Initiative 1,415, and Microsoft's own CVRF feed for the month lists 1,483 entries first published that day once you include the Azure Linux packages the vendor write-ups leave out. The record before this one was September 2026, at roughly a thousand. The record before that was July, at a little over 600. For a Swedish IT department patching Windows Server on Azure, Arc-connected machines and a fleet of Windows 11 laptops, this is not a bad month. It is the new monthly load, and Microsoft says so.

What shipped on 13 October

The counts differ because each vendor decides whether to include Edge, Chromium, Azure Linux and third-party components. The shape of the release is the same in every write-up.

The one that matters today is CVE-2026-96951. A crafted file bypasses Mark of the Web, the control that makes Office open internet-sourced documents in Protected View and makes SmartScreen ask before running a download. It needs a user to open something, and it affects Windows 10, Windows 11 and Windows Server from 2012 R2 through 2025. Rapid7 notes that Windows Server 2012 (not R2) gets no fix. Microsoft says it is exploited, so the ordering of your month is settled: this first, on every endpoint and session host.

Behind it, the Zero Day Initiative flags the Exchange Server remote code execution CVE-2026-70571 as wormable in principle but requiring deep knowledge of the target environment, and a SQL Server deserialization flaw, CVE-2026-65674, at CVSS 8.8. Rapid7 counts five Outlook remote code execution bugs that trigger from the preview pane with no click, and two DNS Server role bugs at CVSS 9.8. Domain controllers running DNS go in the first wave with the zero-day.

Why the number is high, and why it stays high

Microsoft has been explicit about the cause since spring. In May, Tom Gallagher, vice president of engineering at the Microsoft Security Response Center, told The Record that "Microsoft engineers and the wider security community alike are increasingly using AI to examine software more carefully and more often than was practical even a few years ago", and that "AI is changing the scale and speed of vulnerability discovery, which can raise operational demands and requires consistent, disciplined risk management at pace". The MSRC post that accompanied this month's release repeats the point in one line: "As AI-assisted research contributes to vulnerability discovery, this kind of approach may become more useful."

Satnam Narang, security researcher at Tenable, put the year in context for KrebsOnSecurity: "We've now crossed the 4,000 CVE mark with two months left to go." The previous full-year record was 2020, at 1,261. October alone beat it.

The counter-point comes from ZDI, and it is the one your change board needs to hear. Discovery is scaling faster than exploitation. Through October, 2026 has seen 15 Microsoft zero-days exploited in the wild, against 17 in the same period of 2023, when the monthly release averaged under a hundred CVEs. The attackers' pipeline has not grown fourteen-fold. Your inbox has. Tyler Reguly, associate director of security research and development at Fortra, framed the management question the same way: "Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act."

Microsoft's answer: risk cohorts

Alongside the release, MSRC published a post called "Using risk cohorts to prioritize security updates". The definition is short: "A risk cohort is a group of CVEs that require a similar customer assessment." The CVEs in a cohort share neither a root cause nor a CVSS score. They share the question you must answer to know whether they matter to you. If you have no RDP exposed, the remote-access cohort drops down your list in one decision instead of 65.

Microsoft published 15 cohorts for October, with the CVE-to-cohort mapping in a 45-page PDF rather than in the Security Update Guide, which "does not currently display these relationships".

The right-hand column is our reading, not Microsoft's. Microsoft's own caveat: cohorts "are not official Microsoft vulnerability categories, do not change Microsoft update guidance, and do not replace the assessment of individual CVEs". And the coverage has holes. IT-Connect's analysis of the PDF finds 289 of the month's 1,407 CVEs in no cohort at all, including all six Exchange Server CVEs it counted, all 22 SQL Server CVEs, 35 of 36 SharePoint CVEs, and the exploited Windows Shell zero-day itself. The cohorts help you say no to large blocks of workstation CVEs quickly. They do not yet help with the server products a Swedish mid-size company actually worries about. Use them as a first pass, then fall back on Microsoft's "Exploited" and "Exploitation More Likely" flags and on CISA's Known Exploited Vulnerabilities catalogue, which Reguly notes carries 26 Microsoft entries this month.

The Azure column: what Microsoft fixed for you, and what you install

Cloud CVEs confuse this discussion every month, so separate them. Pulling the Azure-titled entries out of the October CVRF document gives two distinct groups.

The first group is already closed. The App Service bug was corrected on 8 October with no customer action, and most vendors exclude it from the 1,400 because it predates Patch Tuesday. What you owe is a look back: query App Service and Azure Monitor logs for the window before 8 October for requests you do not recognise. The SRE Agent fix is also server side, but the agent's managed identity has whatever RBAC you granted it, so this is the week to tighten that.

The second group hides where patch management does not look. The Arc agent update arrives through Azure Update Manager or the agent's auto-upgrade, unless you pinned it. The Key Vault and Storage SDK fixes are dependency bumps in your own code, so they belong to application teams and to your Dependabot or Renovate rules, not to the Windows patch cycle. If your governance assumes "Azure CVEs are Microsoft's problem", the SDK rows are where that assumption breaks. Everything on an Azure virtual machine is in the ordinary column: Windows Server, SQL Server, Exchange, SharePoint and the DNS role. Those are yours.

Capacity math: reboots, hours and the tooling that is now free

Patching capacity is measured in maintenance windows and reboots, not in CVEs. Three facts about the Azure tooling change the arithmetic.

• Azure Update Manager costs nothing for Azure VMs. Arc-connected servers are charged per server per day, only on days the machine is connected and has an update operation or a schedule attached. The charge is waived with Arc-delivered Extended Security Updates or Defender for Servers Plan 2 on the subscription. Read the Swedish rate in the portal; the pricing page renders it dynamically.
• Hotpatch for Arc-connected Windows Server 2025 is free since May 2026. Microsoft charged $1.50 per core per month from July 2025. Learn now states it is "available at no extra cost" for Standard and Datacenter editions connected through Arc. Azure Edition images have had it included all along.
• Hotpatch cadence is four baselines and eight restart-free months a year. Every third month is a cumulative update that needs a restart; the two months after it patch running processes with no reboot. The exception is an "unplanned baseline" when a zero-day cannot ship as a hotpatch, and that month costs you the restart you thought you had saved.

Put numbers on a fleet of 60 Windows Server 2025 machines, half in Azure and half on Arc. Without hotpatch, 60 servers times 12 monthly restarts is 720 reboots a year, each with a maintenance window an application owner has to approve. With hotpatch on every eligible machine, planned restarts fall to four a year, or 240 reboots. At 1,400 CVEs a month the thing that breaks first is the change-approval queue, not the download, and hotpatch removes two-thirds of the approvals. It does not cover .NET updates, drivers, firmware or non-security fixes, so the .NET bypass CVE-2026-108398 reboots you this month regardless.

Three lifecycle dates landed in the same release. Windows Server 2012 R2's final ESU year ended on 13 October 2026, so the Windows Shell fix is the last security update that platform receives, and 2012 non-R2 did not get even that. Exchange Server 2016 and 2019 lose Extended Security Updates at the end of October 2026 with no further extension. Office 2021 and Office LTSC 2021 reached end of support on 14 October. If any of these are in your estate, migration is no longer a project, it is the patch.

# Azure Resource Graph: every Azure or Arc machine still missing a Critical or Security patch
# after Update Manager's last assessment. Run in the portal's Resource Graph Explorer or:
#   az graph query -q "<query>" --first 1000
patchassessmentresources
| where type =~ "microsoft.compute/virtualmachines/patchassessmentresults/softwarepatches"
   or type =~ "microsoft.hybridcompute/machines/patchassessmentresults/softwarepatches"
| extend classification = tostring(properties.classifications[0]),
         kb = tostring(properties.kbId),
         patchName = tostring(properties.patchName),
         machine = tostring(split(id, "/patchAssessmentResults")[0])
| where classification in ("Critical", "Security")
| summarize pending = count(), kbs = make_set(kb, 20) by machine
| order by pending desc

# Create a maintenance configuration aligned to Patch Tuesday (second Tuesday, 02:00 Stockholm time)
# and let dynamic scoping pull in every VM tagged patchring=wave1.
az maintenance configuration create \
  --resource-group rg-platform --resource-name mc-wave1-patch-tuesday \
  --maintenance-scope InGuestPatch --location swedencentral \
  --start-date-time "2026-11-10 02:00" --time-zone "W. Europe Standard Time" \
  --duration "03:55" --recur-every "Month Second Tuesday" \
  --reboot-setting IfRequired \
  --install-patches-windows-parameters classificationsToInclude="Critical" classificationsToInclude="Security" \
  --extension-properties InGuestPatchMode=User

# Dynamic scope: all VMs and Arc machines with the wave1 tag, across the subscription
az maintenance assignment create-or-update-subscription \
  --maintenance-configuration-id "/subscriptions/<sub>/resourceGroups/rg-platform/providers/Microsoft.Maintenance/maintenanceConfigurations/mc-wave1-patch-tuesday" \
  --configuration-assignment-name wave1 \
  --filter-tags '{"patchring":["wave1"]}' --filter-tags-operator Any \
  --filter-resource-types "microsoft.compute/virtualmachines" "microsoft.hybridcompute/machines"

The Resource Graph query is the artefact your auditor will ask for. It answers "which machines were still exposed on day N" from the data Update Manager already holds.

The Swedish and EU angle

Cybersäkerhetslagen makes patch cadence a legal question. The law (SFS 2025:1506) entered into force on 15 January 2026 and implements NIS2. Chapter 2, section 3 requires "lämpliga och proportionella tekniska, driftsrelaterade och organisatoriska åtgärder", including "säkerhet vid förvärv, utveckling och underhåll av nätverks- och informationssystem" and "grundläggande praxis för cyberhygien". Neither the law nor NIS2 names a number of days to patch. A supervisory authority will ask for evidence that you had a risk-based process and followed it. A Resource Graph export showing KEV-listed CVEs closed within your own stated window is that evidence. A spreadsheet of 1,400 rows with no prioritisation is the opposite.

The reporting clock is shorter than the patch clock. The same law requires an early warning "så snart det kan ske, dock senast 24 timmar" after becoming aware of a significant incident, a fuller report within 72 hours, and a final report within one month. If the Windows Shell zero-day was used against you before 13 October, the clock started when you found out, not when Microsoft published. The retrospective log review for the App Service bug sits under the same rule. Sanctions reach 2 percent of global annual turnover or 10 million euro for essential private entities, 1.4 percent or 7 million euro for important entities, and 10 million kronor for public bodies.

Hotpatch is the right default on both sides of the Arc boundary. For Arc-connected Windows Server 2025 in your own datacentre, the May 2026 price change removes the last reason not to enable it. Older on-premises servers still reboot monthly, which is one more argument for finishing the 2022-to-2025 upgrades before the next thousand-CVE month. GDPR Article 32 asks for the same evidence as cybersäkerhetslagen, so a single patching record that shows the prioritisation logic, the window and the documented exceptions serves both regimes.

Decision guide for the next 14 days

• Day 0 to 2: CVE-2026-96951 everywhere users open files. Workstations, Windows 365 Cloud PCs, Azure Virtual Desktop session hosts, RDS. Expedite through Intune or Autopatch rather than waiting for the ring schedule. Confirm with the Resource Graph query that no session host is still pending.
• Day 0 to 3: the exposed-service wave. Domain controllers with the DNS role (two CVSS 9.8 bugs), Exchange servers (CVE-2026-70571, "Exploitation More Likely"), anything with RDP or RD Gateway reachable from the internet, and SQL Server instances that accept connections from application tiers you do not fully control.
• Day 1 to 5: the dependency wave nobody owns yet. Hand the Key Vault and Storage SDK CVEs to application teams with a ticket each, update the Azure CLI on build agents, and confirm the Arc Connected Machine Agent is on the fixed version everywhere. Check whether Dependabot or Renovate would have caught these without a human.
• Day 2 to 10: the rest, by cohort. Download Microsoft's cohort PDF, answer the fifteen questions above once per machine class, and let the "no" answers defer whole blocks to the regular cycle. Then run the 289 uncohorted CVEs through "Exploited", "Exploitation More Likely" and KEV. What remains is a normal month's work.
• Before November's release: enable hotpatch on every Windows Server 2025 machine, Azure and Arc. It is free in both places now and cuts planned reboots from 12 to 4 a year. Document the .NET and driver exceptions so nobody is surprised by a restart in a hotpatch month.
• Before November's release: decide the 2012 R2, Exchange 2016/2019 and Office 2021 question. No more patches are coming for any of them. Migrate, isolate behind a jump host with no internet path, or accept the risk in writing at the level cybersäkerhetslagen holds responsible, which is the board.
• Write the capacity memo. If September was a thousand and October 1,400, plan November at the same level and ask for the hours, or for the tooling that removes them.

A year ago, 100 CVEs a month was a Tuesday. The number is now 1,400, and Microsoft's own explanation is that the tools finding bugs are the same tools everyone else has. Build the process for that, not for the month it finally slows down.