Sometime on Tuesday a lot of patch-management dashboards turned a colour nobody had set a threshold for. Microsoft shipped fixes for 1,413 vulnerabilities in one go, a record, and the September release that looked absurd at the time ("nearly 1,000") now reads like a warm-up. The Hacker News has the breakdown: 1,102 in Windows, 134 in Office, 61 in developer tools, 36 in SharePoint Server and 22 in SQL Server, with more than 70 rated Critical.
One bug actually matters this week
Out of 1,413, Microsoft flags one as exploited: CVE-2026-96951, a command injection in Windows Shell scored 8.8. It lets an attacker get past a security feature, and the reporting ties it to Mark of the Web, the marker that makes Windows treat a downloaded file with suspicion. Nobody has said who is using it or against whom. CISA put it in the Known Exploited Vulnerabilities catalogue with a federal deadline of 16 October, which, as Cyber Security News notes, still needs a user to open something. That is a low bar. A zipped attachment or a link in a chat message is enough of a delivery route.
Two other entries are worth reading before the rest of the pile. CVE-2026-108398, a .NET Framework search-path bug, is publicly known and can bypass Windows Defender Application Control, credited to James Forshaw of Google Project Zero. And a Raw Image Extension flaw, CVE-2026-21413 (9.8, heap overflow), fires when Windows builds a thumbnail, so nobody needs to double-click anything. If you run file servers where people drop camera RAW files, that one deserves a faster lane.
The volume is the story
Satnam Narang of Tenable says Microsoft has now fixed more than 4,000 CVEs this year. Dustin Childs of the Zero Day Initiative puts it bluntly: hundreds in a release used to be unusual and is now the baseline, partly because AI-assisted bug hunting is finding things faster than anyone can write them up. Microsoft is responding with "risk cohorts", groups of CVEs that call for the same kind of assessment. It is a useful idea, but it is also an admission that a flat list of 1,413 cannot be triaged by hand.
The uncomfortable arithmetic is that a monthly change window designed for 100 patches has been absorbing ten times that for a while, and the mean time to deploy has not improved. CyberInsider reports that the Windows 11 updates came with VPN failures and black screens for some users, which is exactly the sort of side effect that makes a team slow down.
A triage order that survives a record month
- Start with exposure, not score. Anything on the KEV list goes first, then things that parse untrusted input without a click (thumbnails, previews, mail rendering).
- Stage the Windows Shell fix to people who open outside files all day: finance, recruitment, support, anyone who lives in email attachments. Do them before the servers.
- Pilot on a ring of real machines, including one running your VPN client, before the broad push. This month's regression reports make that ring worth having.
- Use Microsoft's cohorts as a starting grouping, then overlay your own estate: which products you actually run decides which of the 1,413 you can ignore.
- Report the number you can defend. "Exploited bugs patched in 48 hours" tells a board more than "98% of 1,413".
If your patch process is still shaped like a monthly project, the next few months will make that visible. We can help turn it into a rolling, risk-ordered routine. Write to sales@halfteck.com.