# 1,400 CVEs in one Patch Tuesday: your Azure triage plan

Microsoft's October 2026 Patch Tuesday fixed more than 1,400 CVEs, with one exploited Windows Shell zero-day and a Microsoft statement that AI-assisted discovery is why the volume keeps climbing. Here is the triage: which Azure CVEs were fixed server side and which land in your SDKs and Arc agents, how Microsoft's new risk cohorts help and where they leave 289 CVEs uncovered, the hotpatch reboot math, and what cybersäkerhetslagen expects you to be able to show.

- Published: 2026-10-14 · Category: Security & Compliance · Tags: Patch Tuesday, Microsoft Security, Azure Update Manager, Azure Arc, Hotpatch, Windows Server 2025, Risk Cohorts, NIS2, Cybersäkerhetslagen, Vulnerability Management
- Author: Technspire AB, Stockholm (https://technspire.com)
- Canonical: https://technspire.com/en/blog/patch-tuesday-1400-cves-your-azure-triage-plan

Microsoft's October 2026 Patch Tuesday, released on 13 October, fixed more than 1,400 vulnerabilities in a single month. Tenable counts 1,407, Rapid7 1,413, Trend Micro's Zero Day Initiative 1,415, and Microsoft's own CVRF feed for the month lists 1,483 entries first published that day once you include the Azure Linux packages the vendor write-ups leave out. The record before this one was September 2026, at roughly a thousand. The record before that was July, at a little over 600. For a Swedish IT department patching Windows Server on Azure, Arc-connected machines and a fleet of Windows 11 laptops, this is not a bad month. It is the new monthly load, and Microsoft says so.

## What shipped on 13 October

The counts differ because each vendor decides whether to include Edge, Chromium, Azure Linux and third-party components. The shape of the release is the same in every write-up.

| Measure | October 2026 | Source |
| --- | --- | --- |
| CVEs, Microsoft products only | 1,407 (Tenable), 1,411 (BleepingComputer), 1,413 (Rapid7), 1,415 (ZDI) | Vendor Patch Tuesday reviews |
| Entries first published 13 October in Microsoft's CVRF document, all products | 1,483 | MSRC CVRF API, 2026-Oct |
| Rated Critical | 69 (Tenable), 70 (BleepingComputer), "at least 78" (KrebsOnSecurity) | As stated |
| Exploited in the wild before the patch | 1: CVE-2026-96951, Windows Shell security feature bypass, CVSS 8.8 | MSRC |
| Publicly disclosed before the patch | 2: CVE-2026-108398 (.NET Framework, bypasses App Control for Business), CVE-2026-92707 (MessagePack-CSharp denial of service) | MSRC |
| Elevation of privilege share | 47.9% (677 CVEs) | Tenable, BleepingComputer |
| Remote code execution share | 22.3% (317 CVEs) | Tenable, BleepingComputer |
| Most-patched components | Excel 69, DNS Server role 52, Windows Kernel 46, Windows Installer 38, Win32k 36 | Tenable |
| Server products | SQL Server 22 to 23, SharePoint 36, Hyper-V 18, Exchange Server 7 | CVRF, Tenable |

The one that matters today is CVE-2026-96951. A crafted file bypasses Mark of the Web, the control that makes Office open internet-sourced documents in Protected View and makes SmartScreen ask before running a download. It needs a user to open something, and it affects Windows 10, Windows 11 and Windows Server from 2012 R2 through 2025. Rapid7 notes that Windows Server 2012 (not R2) gets no fix. Microsoft says it is exploited, so the ordering of your month is settled: this first, on every endpoint and session host.

Behind it, the Zero Day Initiative flags the Exchange Server remote code execution CVE-2026-70571 as wormable in principle but requiring deep knowledge of the target environment, and a SQL Server deserialization flaw, CVE-2026-65674, at CVSS 8.8. Rapid7 counts five Outlook remote code execution bugs that trigger from the preview pane with no click, and two DNS Server role bugs at CVSS 9.8. Domain controllers running DNS go in the first wave with the zero-day.

## Why the number is high, and why it stays high

Microsoft has been explicit about the cause since spring. In May, Tom Gallagher, vice president of engineering at the Microsoft Security Response Center, told The Record that "Microsoft engineers and the wider security community alike are increasingly using AI to examine software more carefully and more often than was practical even a few years ago", and that "AI is changing the scale and speed of vulnerability discovery, which can raise operational demands and requires consistent, disciplined risk management at pace". The MSRC post that accompanied this month's release repeats the point in one line: "As AI-assisted research contributes to vulnerability discovery, this kind of approach may become more useful."

Satnam Narang, security researcher at Tenable, put the year in context for KrebsOnSecurity: "We've now crossed the 4,000 CVE mark with two months left to go." The previous full-year record was 2020, at 1,261. October alone beat it.

The counter-point comes from ZDI, and it is the one your change board needs to hear. Discovery is scaling faster than exploitation. Through October, 2026 has seen 15 Microsoft zero-days exploited in the wild, against 17 in the same period of 2023, when the monthly release averaged under a hundred CVEs. The attackers' pipeline has not grown fourteen-fold. Your inbox has. Tyler Reguly, associate director of security research and development at Fortra, framed the management question the same way: "Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act."

## Microsoft's answer: risk cohorts

Alongside the release, MSRC published a post called "Using risk cohorts to prioritize security updates". The definition is short: "A risk cohort is a group of CVEs that require a similar customer assessment." The CVEs in a cohort share neither a root cause nor a CVSS score. They share the question you must answer to know whether they matter to you. If you have no RDP exposed, the remote-access cohort drops down your list in one decision instead of 65.

Microsoft published 15 cohorts for October, with the CVE-to-cohort mapping in a 45-page PDF rather than in the Security Update Guide, which "does not currently display these relationships".

| Risk cohort (Microsoft's name) | CVEs | The question it asks of you |
| --- | --- | --- |
| Windows filesystems, storage and backup | 136 | Who can write files to this machine? |
| Office document and mail clients | 135 | Do users open external documents and mail here? |
| Windows graphics, media and content processing | 131 | Does this machine render untrusted content? |
| Windows core and kernel privilege boundaries | 109 | Do untrusted users or code run locally? |
| Windows installation, deployment and update services | 103 | Can a standard user trigger installs or repairs? |
| Windows device, peripheral and print surfaces | 76 | Is the print spooler or USB class driver reachable? |
| DNS, DHCP and network-address infrastructure | 76 | Does this server run the DNS or DHCP role? |
| Remote-access and RDP deployments | 65 | Is RDP, RD Gateway or a VPN endpoint exposed? |
| Windows authentication, credentials and cryptography | 61 | Does this host hold or relay credentials? |
| Windows networking and protocol stack | 53 | Which protocols are reachable from outside the segment? |
| Virtualization, container and isolation hosts | 45 | Does this host run other tenants' workloads? |
| Network file and resource sharing | 39 | Are SMB shares reachable by many users? |
| Endpoint management and security controls | 38 | Can a local user tamper with Defender or Intune? |
| Windows web, RPC and messaging services | 27 | Are IIS, RPC or MSMQ listening? |
| Directory, federation and certificate infrastructure | 24 | Is this a domain controller, ADFS or CA? |

The right-hand column is our reading, not Microsoft's. Microsoft's own caveat: cohorts "are not official Microsoft vulnerability categories, do not change Microsoft update guidance, and do not replace the assessment of individual CVEs". And the coverage has holes. IT-Connect's analysis of the PDF finds 289 of the month's 1,407 CVEs in no cohort at all, including all six Exchange Server CVEs it counted, all 22 SQL Server CVEs, 35 of 36 SharePoint CVEs, and the exploited Windows Shell zero-day itself. The cohorts help you say no to large blocks of workstation CVEs quickly. They do not yet help with the server products a Swedish mid-size company actually worries about. Use them as a first pass, then fall back on Microsoft's "Exploited" and "Exploitation More Likely" flags and on CISA's Known Exploited Vulnerabilities catalogue, which Reguly notes carries 26 Microsoft entries this month.

## The Azure column: what Microsoft fixed for you, and what you install

Cloud CVEs confuse this discussion every month, so separate them. Pulling the Azure-titled entries out of the October CVRF document gives two distinct groups.

| CVE | Service or component | CVSS | Who acts |
| --- | --- | --- | --- |
| CVE-2026-77900 | Azure App Service for Linux, remote code execution (published 8 October) | 9.8 | Microsoft, server side. Review your logs. |
| CVE-2026-69435 | Azure SRE Agent, elevation of privilege (8 October) | 9.6 | Microsoft, server side. Audit the agent's RBAC. |
| CVE-2026-83943 | Azure API Center, information disclosure (8 October) | 8.7 | Microsoft, server side |
| CVE-2026-83947 | Azure Event Grid, spoofing (8 October) | 7.7 | Microsoft, server side |
| CVE-2026-85916 | Azure Active Directory (Entra ID), information disclosure | 6.2 | Microsoft, server side |
| CVE-2026-96204 | Azure Arc, Connected Machine Agent, elevation of privilege | 6.5 | **You**: update the agent on every Arc server |
| CVE-2026-85925, CVE-2026-85922, CVE-2026-88132 | Azure Key Vault client SDKs (.NET, Java, Python, Rust, admin) | 8.2 / 7.4 / 5.9 | **You**: bump the package and redeploy |
| CVE-2026-88094 | Azure Storage Blobs client library for Java, blob batch | 8.1 | **You**: bump the package and redeploy |
| CVE-2026-100207 | Azure CycleCloud 8.9.1 and 8.9.2, remote code execution | 7.3 | **You**: upgrade CycleCloud |
| CVE-2026-69877 | Azure CLI and Azure DevOps CLI extension, information disclosure | 6.5 | **You**: update CLI on build agents |

The first group is already closed. The App Service bug was corrected on 8 October with no customer action, and most vendors exclude it from the 1,400 because it predates Patch Tuesday. What you owe is a look back: query App Service and Azure Monitor logs for the window before 8 October for requests you do not recognise. The SRE Agent fix is also server side, but the agent's managed identity has whatever RBAC you granted it, so this is the week to tighten that.

The second group hides where patch management does not look. The Arc agent update arrives through Azure Update Manager or the agent's auto-upgrade, unless you pinned it. The Key Vault and Storage SDK fixes are dependency bumps in your own code, so they belong to application teams and to your Dependabot or Renovate rules, not to the Windows patch cycle. If your governance assumes "Azure CVEs are Microsoft's problem", the SDK rows are where that assumption breaks. Everything on an Azure virtual machine is in the ordinary column: Windows Server, SQL Server, Exchange, SharePoint and the DNS role. Those are yours.

## Capacity math: reboots, hours and the tooling that is now free

Patching capacity is measured in maintenance windows and reboots, not in CVEs. Three facts about the Azure tooling change the arithmetic.

- **Azure Update Manager costs nothing for Azure VMs.** Arc-connected servers are charged per server per day, only on days the machine is connected and has an update operation or a schedule attached. The charge is waived with Arc-delivered Extended Security Updates or Defender for Servers Plan 2 on the subscription. Read the Swedish rate in the portal; the pricing page renders it dynamically.
- **Hotpatch for Arc-connected Windows Server 2025 is free since May 2026.** Microsoft charged $1.50 per core per month from July 2025. Learn now states it is "available at no extra cost" for Standard and Datacenter editions connected through Arc. Azure Edition images have had it included all along.
- **Hotpatch cadence is four baselines and eight restart-free months a year.** Every third month is a cumulative update that needs a restart; the two months after it patch running processes with no reboot. The exception is an "unplanned baseline" when a zero-day cannot ship as a hotpatch, and that month costs you the restart you thought you had saved.

Put numbers on a fleet of 60 Windows Server 2025 machines, half in Azure and half on Arc. Without hotpatch, 60 servers times 12 monthly restarts is 720 reboots a year, each with a maintenance window an application owner has to approve. With hotpatch on every eligible machine, planned restarts fall to four a year, or 240 reboots. At 1,400 CVEs a month the thing that breaks first is the change-approval queue, not the download, and hotpatch removes two-thirds of the approvals. It does not cover .NET updates, drivers, firmware or non-security fixes, so the .NET bypass CVE-2026-108398 reboots you this month regardless.

Three lifecycle dates landed in the same release. Windows Server 2012 R2's final ESU year ended on 13 October 2026, so the Windows Shell fix is the last security update that platform receives, and 2012 non-R2 did not get even that. Exchange Server 2016 and 2019 lose Extended Security Updates at the end of October 2026 with no further extension. Office 2021 and Office LTSC 2021 reached end of support on 14 October. If any of these are in your estate, migration is no longer a project, it is the patch.

```
# Azure Resource Graph: every Azure or Arc machine still missing a Critical or Security patch
# after Update Manager's last assessment. Run in the portal's Resource Graph Explorer or:
#   az graph query -q "<query>" --first 1000
patchassessmentresources
| where type =~ "microsoft.compute/virtualmachines/patchassessmentresults/softwarepatches"
   or type =~ "microsoft.hybridcompute/machines/patchassessmentresults/softwarepatches"
| extend classification = tostring(properties.classifications[0]),
         kb = tostring(properties.kbId),
         patchName = tostring(properties.patchName),
         machine = tostring(split(id, "/patchAssessmentResults")[0])
| where classification in ("Critical", "Security")
| summarize pending = count(), kbs = make_set(kb, 20) by machine
| order by pending desc

# Create a maintenance configuration aligned to Patch Tuesday (second Tuesday, 02:00 Stockholm time)
# and let dynamic scoping pull in every VM tagged patchring=wave1.
az maintenance configuration create \
  --resource-group rg-platform --resource-name mc-wave1-patch-tuesday \
  --maintenance-scope InGuestPatch --location swedencentral \
  --start-date-time "2026-11-10 02:00" --time-zone "W. Europe Standard Time" \
  --duration "03:55" --recur-every "Month Second Tuesday" \
  --reboot-setting IfRequired \
  --install-patches-windows-parameters classificationsToInclude="Critical" classificationsToInclude="Security" \
  --extension-properties InGuestPatchMode=User

# Dynamic scope: all VMs and Arc machines with the wave1 tag, across the subscription
az maintenance assignment create-or-update-subscription \
  --maintenance-configuration-id "/subscriptions/<sub>/resourceGroups/rg-platform/providers/Microsoft.Maintenance/maintenanceConfigurations/mc-wave1-patch-tuesday" \
  --configuration-assignment-name wave1 \
  --filter-tags '{"patchring":["wave1"]}' --filter-tags-operator Any \
  --filter-resource-types "microsoft.compute/virtualmachines" "microsoft.hybridcompute/machines"
```

The Resource Graph query is the artefact your auditor will ask for. It answers "which machines were still exposed on day N" from the data Update Manager already holds.

## The Swedish and EU angle

**Cybersäkerhetslagen makes patch cadence a legal question.** The law (SFS 2025:1506) entered into force on 15 January 2026 and implements NIS2. Chapter 2, section 3 requires "lämpliga och proportionella tekniska, driftsrelaterade och organisatoriska åtgärder", including "säkerhet vid förvärv, utveckling och underhåll av nätverks- och informationssystem" and "grundläggande praxis för cyberhygien". Neither the law nor NIS2 names a number of days to patch. A supervisory authority will ask for evidence that you had a risk-based process and followed it. A Resource Graph export showing KEV-listed CVEs closed within your own stated window is that evidence. A spreadsheet of 1,400 rows with no prioritisation is the opposite.

**The reporting clock is shorter than the patch clock.** The same law requires an early warning "så snart det kan ske, dock senast 24 timmar" after becoming aware of a significant incident, a fuller report within 72 hours, and a final report within one month. If the Windows Shell zero-day was used against you before 13 October, the clock started when you found out, not when Microsoft published. The retrospective log review for the App Service bug sits under the same rule. Sanctions reach 2 percent of global annual turnover or 10 million euro for essential private entities, 1.4 percent or 7 million euro for important entities, and 10 million kronor for public bodies.

**Hotpatch is the right default on both sides of the Arc boundary.** For Arc-connected Windows Server 2025 in your own datacentre, the May 2026 price change removes the last reason not to enable it. Older on-premises servers still reboot monthly, which is one more argument for finishing the 2022-to-2025 upgrades before the next thousand-CVE month. GDPR Article 32 asks for the same evidence as cybersäkerhetslagen, so a single patching record that shows the prioritisation logic, the window and the documented exceptions serves both regimes.

## Decision guide for the next 14 days

- **Day 0 to 2: CVE-2026-96951 everywhere users open files.** Workstations, Windows 365 Cloud PCs, Azure Virtual Desktop session hosts, RDS. Expedite through Intune or Autopatch rather than waiting for the ring schedule. Confirm with the Resource Graph query that no session host is still pending.
- **Day 0 to 3: the exposed-service wave.** Domain controllers with the DNS role (two CVSS 9.8 bugs), Exchange servers (CVE-2026-70571, "Exploitation More Likely"), anything with RDP or RD Gateway reachable from the internet, and SQL Server instances that accept connections from application tiers you do not fully control.
- **Day 1 to 5: the dependency wave nobody owns yet.** Hand the Key Vault and Storage SDK CVEs to application teams with a ticket each, update the Azure CLI on build agents, and confirm the Arc Connected Machine Agent is on the fixed version everywhere. Check whether Dependabot or Renovate would have caught these without a human.
- **Day 2 to 10: the rest, by cohort.** Download Microsoft's cohort PDF, answer the fifteen questions above once per machine class, and let the "no" answers defer whole blocks to the regular cycle. Then run the 289 uncohorted CVEs through "Exploited", "Exploitation More Likely" and KEV. What remains is a normal month's work.
- **Before November's release: enable hotpatch on every Windows Server 2025 machine, Azure and Arc.** It is free in both places now and cuts planned reboots from 12 to 4 a year. Document the .NET and driver exceptions so nobody is surprised by a restart in a hotpatch month.
- **Before November's release: decide the 2012 R2, Exchange 2016/2019 and Office 2021 question.** No more patches are coming for any of them. Migrate, isolate behind a jump host with no internet path, or accept the risk in writing at the level cybersäkerhetslagen holds responsible, which is the board.
- **Write the capacity memo.** If September was a thousand and October 1,400, plan November at the same level and ask for the hours, or for the tooling that removes them.

A year ago, 100 CVEs a month was a Tuesday. The number is now 1,400, and Microsoft's own explanation is that the tools finding bugs are the same tools everyone else has. Build the process for that, not for the month it finally slows down.

## Sources

- [MSRC Blog: Using risk cohorts to prioritize security updates (13 October 2026; cohort definition, the 15 cohorts, caveats, PDF mapping)](https://www.microsoft.com/en-us/msrc/blog/2026/10/using-risk-cohorts-to-prioritize-security-updates)
- [MSRC CVRF API: October 2026 Security Updates (machine-readable release; exploited and disclosed flags; Azure, SQL Server and Exchange entries)](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Oct)
- [Tenable: Microsoft's October 2026 Patch Tuesday addresses 1,407 CVEs (severity split, EoP and RCE shares, most-impacted products)](https://www.tenable.com/blog/microsofts-october-2026-patch-tuesday-addresses-1407-cves-cve-2026-96951)
- [BleepingComputer: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days (category counts, Microsoft's AI statement, 348 fixes earlier in October)](https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/)
- [Zero Day Initiative: The October 2026 Security Update Review (1,415 count, Exchange and SQL Server analysis, 15 vs 17 zero-days)](https://www.thezdi.com/blog/2026/10/13/the-october-2026-security-update-review)
- [Rapid7: Patch Tuesday, October 2026 (Outlook preview-pane RCEs, DNS Server CVSS 9.8, Server 2012 not patched, lifecycle dates)](https://www.rapid7.com/blog/post/em-patch-tuesday-october-2026/)
- [KrebsOnSecurity: Microsoft patches more than 1,400 security flaws (Narang and Reguly quotes, 2020 record, KEV count)](https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws)
- [The Record: Microsoft on pace to break annual vulnerability record as AI-driven patch wave takes hold (Tom Gallagher quotes, May 2026)](https://therecord.media/microsoft-on-pace-to-break-annual-vulnerability-record-ai)
- [IT-Connect: Microsoft tests risk cohorts to help prioritize 1,400 CVEs (289 unclassified CVEs, Exchange, SQL Server and SharePoint gaps)](https://www.it-connect.tech/patch-tuesday-microsoft-tests-risk-cohorts-to-help-prioritize-1400-cves/)
- [Microsoft Learn: Hotpatch for Windows Server (cadence, unplanned baselines, exclusions, Arc at no extra cost)](https://learn.microsoft.com/en-us/windows-server/get-started/hotpatch)
- [Microsoft Learn: Azure Update Manager overview (dynamic scoping, maintenance configurations, Patch Tuesday alignment)](https://learn.microsoft.com/en-us/azure/update-manager/overview)
- [Azure pricing: Azure Update Manager (free for Azure VMs, per-server-per-day for Arc, ESU and Defender for Servers Plan 2 waivers)](https://azure.microsoft.com/en-us/pricing/details/azure-update-management-center/)
- [Riksdagen: Cybersäkerhetslag (2025:1506) (2 kap. 3 § measures, reporting deadlines, 4 kap. 10 § sanctions)](https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/cybersakerhetslag-20251506_sfs-2025-1506/)
- [BleepingComputer: Microsoft Exchange 2016 and 2019 ESU program ends in October (no further extension)](https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-2016-and-2019-esu-program-ends-in-october/)

---

Technspire AB builds AI agents, Azure OpenAI solutions, and production web platforms for Swedish and EU enterprises. Book a call: https://calendly.com/technspire · hello@technspire.com · More articles: https://technspire.com/en/blog · Site overview for agents: https://technspire.com/llms.txt