{"id":38075,"date":"2026-10-23T21:24:27","date_gmt":"2026-10-23T21:24:27","guid":{"rendered":"https:\/\/www.adminbyrequest.com\/en\/?p=38075"},"modified":"2026-10-27T21:32:54","modified_gmt":"2026-10-27T21:32:54","slug":"when-patch-tuesday-hits-four-digits-what-do-you-fix-first","status":"publish","type":"post","link":"https:\/\/www.adminbyrequest.com\/en\/blogs\/when-patch-tuesday-hits-four-digits-what-do-you-fix-first","title":{"rendered":"When Patch Tuesday Hits Four Digits, What Do You Fix First?"},"content":{"rendered":"\n

Microsoft’s October Patch Tuesday shipped fixes for 1,413 vulnerabilities in a single release<\/a>, more than the company fixed in all of 2025<\/a>. It was the second record in a row. September had already set the bar at 974 patched flaws<\/a>, and only three months ago, a record month meant 570 security fixes<\/a>.<\/p>\n\n\n\n

No IT team tests and deploys 1,413 fixes in a month, and many were already running behind before the count hit four digits. Every new release lands on top of the last one, so the backlog only grows.<\/p>\n\n\n\n

That leaves anyone who owns patching with two questions: which fixes go out first, and what protects everything else while the rest of the list waits.<\/p>\n\n\n\n

Why Patch Counts Keep Climbing<\/strong><\/h2>\n\n\n\n

Microsoft has been upfront about the cause. In July, Microsoft EVP Pavan Davuluri told Windows customers to expect bigger releases<\/a>, with AI helping researchers find more flaws, faster, across more code. A lot of what turns up is old code getting a closer look than it ever has before.<\/p>\n\n\n\n

Microsoft isn’t alone. In June, FIRST (the global forum of incident response teams) raised its 2026 forecast to roughly 66,000 published CVEs<\/a>, up from about 59,000 at the start of the year. That would be the highest annual total on record.<\/p>\n\n\n\n

Whatever the exact mix of causes, the direction is clear. AI-assisted discovery isn’t going away, so these numbers won’t fall back to where they were, and a patch program designed around a few dozen fixes a month needs a new plan.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

What a Patch Backlog Looks Like<\/strong><\/h2>\n\n\n\n

Every fix still goes through the same process: testing, staging, a maintenance window, and someone watching for the line-of-business app that breaks afterward. None of those steps get faster because the list got longer, and patch fatigue sets in quickly when the list never shrinks.<\/p>\n\n\n\n

Attackers have noticed. Verizon’s 2026 Data Breach Investigations Report found that exploiting vulnerabilities has overtaken stolen credentials<\/a> as the most common way into a network.<\/p>\n\n\n\n

Defenders are slipping on the other side. The same report found organizations fully remediated just 26% of known exploited vulnerabilities<\/a>, down from 38% the year before, and the median time to fix them stretched from 32 days to 43. Those are the flaws attackers are known to be using.<\/p>\n\n\n\n

So every team is already triaging, whether it has a formal process or not. Teams that do it on purpose get the dangerous flaws out first, while everyone else patches in whatever order their tooling happens to show them.<\/p>\n\n\n\n

Most Flaws Never Get Exploited, but Nobody Knows Which<\/strong><\/h2>\n\n\n\n

Only a small fraction of published vulnerabilities are ever used in real attacks. FIRST’s mid-year update found that even as CVE volume surged, exploitable risk stayed roughly flat<\/a>. CISA tracks the flaws attackers do use in its Known Exploited Vulnerabilities (KEV) catalog<\/a>, a far shorter list than any recent Patch Tuesday.<\/p>\n\n\n\n

The catch is that nobody can say in advance which flaws will end up there. Vendor exploitability ratings are educated guesses, and they miss. A SharePoint flaw that Microsoft rated “exploitation less likely” was added to the KEV catalog<\/a> on July 1, less than two months after the fix shipped in May.<\/p>\n\n\n\n

Microsoft is trying to make triage easier. October’s release introduced risk cohorts<\/a>, which group CVEs that need a similar assessment so teams can work through them in batches. Microsoft calls cohorts a starting point, though, and the best prioritization still weighs signals like:<\/p>\n\n\n\n