Microsoft’s October Patch Tuesday shipped fixes for 1,413 vulnerabilities in a single release, more than the company fixed in all of 2025. It was the second record in a row. September had already set the bar at 974 patched flaws, and only three months ago, a record month meant 570 security fixes.
No IT team tests and deploys 1,413 fixes in a month, and many were already running behind before the count hit four digits. Every new release lands on top of the last one, so the backlog only grows.
That leaves anyone who owns patching with two questions: which fixes go out first, and what protects everything else while the rest of the list waits.
Why Patch Counts Keep Climbing
Microsoft has been upfront about the cause. In July, Microsoft EVP Pavan Davuluri told Windows customers to expect bigger releases, with AI helping researchers find more flaws, faster, across more code. A lot of what turns up is old code getting a closer look than it ever has before.
Microsoft isn’t alone. In June, FIRST (the global forum of incident response teams) raised its 2026 forecast to roughly 66,000 published CVEs, up from about 59,000 at the start of the year. That would be the highest annual total on record.
Whatever the exact mix of causes, the direction is clear. AI-assisted discovery isn’t going away, so these numbers won’t fall back to where they were, and a patch program designed around a few dozen fixes a month needs a new plan.
What a Patch Backlog Looks Like
Every fix still goes through the same process: testing, staging, a maintenance window, and someone watching for the line-of-business app that breaks afterward. None of those steps get faster because the list got longer, and patch fatigue sets in quickly when the list never shrinks.
Attackers have noticed. Verizon’s 2026 Data Breach Investigations Report found that exploiting vulnerabilities has overtaken stolen credentials as the most common way into a network.
Defenders are slipping on the other side. The same report found organizations fully remediated just 26% of known exploited vulnerabilities, down from 38% the year before, and the median time to fix them stretched from 32 days to 43. Those are the flaws attackers are known to be using.
So every team is already triaging, whether it has a formal process or not. Teams that do it on purpose get the dangerous flaws out first, while everyone else patches in whatever order their tooling happens to show them.
Most Flaws Never Get Exploited, but Nobody Knows Which
Only a small fraction of published vulnerabilities are ever used in real attacks. FIRST’s mid-year update found that even as CVE volume surged, exploitable risk stayed roughly flat. CISA tracks the flaws attackers do use in its Known Exploited Vulnerabilities (KEV) catalog, a far shorter list than any recent Patch Tuesday.
The catch is that nobody can say in advance which flaws will end up there. Vendor exploitability ratings are educated guesses, and they miss. A SharePoint flaw that Microsoft rated “exploitation less likely” was added to the KEV catalog on July 1, less than two months after the fix shipped in May.
Microsoft is trying to make triage easier. October’s release introduced risk cohorts, which group CVEs that need a similar assessment so teams can work through them in batches. Microsoft calls cohorts a starting point, though, and the best prioritization still weighs signals like:
- Confirmed exploitation, including a listing in CISA’s KEV catalog
- Whether the affected system is exposed to the internet
- A public exploit or proof of concept
- Whether the attack needs a user to click or open something
- What level of access an attacker needs before the flaw is useful
That last signal gets less attention than it deserves, and it covers a huge share of this month’s release.
Nearly Half the List Is Privilege Escalation
By BleepingComputer’s count, 677 of October’s fixes were elevation of privilege flaws. These bugs don’t get an attacker through the door. They take someone who has already landed in a standard user account and hand them admin or SYSTEM rights.
Attackers chain them with whatever got them in. In September, Microsoft patched two Windows privilege escalation flaws that were already being exploited, the kind usually paired with a phishing payload or a code execution bug. If the compromised user already has local admin rights, though, the attacker skips that step entirely.
Removing standing admin rights makes escalation a requirement. The attacker now needs a working exploit for a flaw that’s still unpatched on that specific machine, and every escalation fix you deploy takes another option away. Admin By Request EPM covers the day-to-day side, giving users just-in-time elevation for approved apps with a full audit trail, so removing admin rights doesn’t turn into a flood of helpdesk tickets.
Layers make it harder still. October’s .NET flaw that bypasses WDAC is a reminder that any single control can be sidestepped once an attacker is on the device, so it pays to limit what reaches the device in the first place. Exploit tools and payloads often arrive through the browser, and our Web Access Management holds executable downloads on the endpoint until they pass a multi-engine malware scan and any approval or MFA rules you’ve set.
Patch What’s Exploited, Contain the Rest
Patching still has to happen, and exploited flaws still need to go out fast. It just can’t be the only thing standing between an attacker and your endpoints when each release adds hundreds of items to the queue.
With standing admin rights gone and downloads under control, the escalation flaws in each release become hurdles for an attacker instead of shortcuts. Your team gets room to test and deploy on a sensible schedule, and the fixes that can’t wait still go out first.
To see how our Zero Trust Platform handles this on your own endpoints, book a free demo or start with our free plan, which covers up to 25 endpoints for as long as you want.
