1,413 CVEs in One Month: Why "Patch Everything" Is Dead and What Replaces It
Microsoft’s October 2026 Patch Tuesday fixed 1,413 CVEs, according to SecurityWeek . The same report says that is more than Microsoft patched in all of 2025, and that the surge is “largely driven by AI”, which is the reporter’s characterisation and not a Microsoft statement. Computerworld counts 1,408 CVEs requiring customer action, 72 of them rated critical.
A small team cannot test 1,400 fixes a month. It also does not need to. The count has stopped telling you what is urgent.
What attackers used that week
Look at what was exploited in the same fortnight. Help Net Security reports that CISA added four flaws to its Known Exploited Vulnerabilities (KEV) catalogue:
- Cisco Secure Email Gateway, CVE-2026-76519 (CVSS 9.8). A crafted email attachment can write arbitrary files and run commands as root when File Reputation is enabled. Cisco’s PSIRT confirmed active exploitation.
- Palo Alto PAN-OS, CVE-2026-0322 (CVSS 8.6). An authenticated attacker with network access to the management interface can execute code as root. The vendor reports “very limited” exploitation against that interface.
- Ahsay AhsayCBS, CVE-2026-105133 and CVE-2026-105134. An authentication bypass chained with command injection to run code as SYSTEM. Huntress reports attackers planting webshells and cryptominers on internet-facing servers. Ahsay says earlier patches did not fully fix the issues.
An email gateway, a firewall management plane and a backup console. None is a desktop, and none waits for the second Tuesday.
Windows did have an exploited flaw: CVE-2026-96951, a Mark of the Web bypass, which CISA listed on 13 October with a 16 October deadline for federal agencies. One exploited Windows flaw among 1,413 fixes is the signal in the noise. The other 1,412 are a queue.
The SharePoint lesson
Computerworld flags a trap. CVE-2026-65660 is a SharePoint Server remote code execution flaw fixed in August. On 25 September Microsoft revised its advisory to say it had reliable evidence of observed attacks. The Security Update Guide still shows “Exploited: No”.
If your triage report filters on that field, it missed an in-the-wild RCE. No single vendor flag should decide urgency. Cross-check against CISA KEV and the vendor’s PSIRT feeds, and treat a revised advisory as a new event.
The dev platform nobody tiers
On 29 October CISA added a GitLab flaw to KEV. CVE-2026-97229 scores CVSS 10.0: according to GitLab’s advisory , a crafted regular expression in a CI/CD configuration can let an unauthenticated user run code on the server under certain conditions. The fixed releases are 19.2.8, 19.3.5 and 19.4.2. Shadowserver tracks nearly 2,800 internet-exposed GitLab CE instances, BleepingComputer reports.
GitLab.com was patched before the advisory went out. Self-managed servers were patched only if someone acted, and GitLab shipped the fix on 12 October, 17 days before the KEV listing. A team that waited for KEV gave attackers more than two weeks.
Self-hosted code platforms fall through patch cycles because “the developers run it”. They also hold source code, CI secrets and deploy keys, which puts them in the same tier as domain controllers. Give each one a named owner and add it to Tier 1. For an internet-facing instance, start the 72-hour clock from the vendor’s critical release. After upgrading, review CI job logs and runner activity since 12 October. If you cannot rule out compromise, rotate CI variables, deploy keys and runner tokens.
An exposure-first patch policy
Replace “percent patched” with three tiers. The timings below are my recommendation, so adjust them to your risk appetite.
| Tier | What is in it | Target |
|---|---|---|
| 1. Exposed or exploited | Internet-facing and management-plane assets (email gateways, firewalls, VPNs, backup consoles, self-hosted code platforms), plus anything on CISA KEV | Patch or mitigate within 72 hours |
| 2. Automated rings | Windows, Office and endpoint updates through Intune or Windows Update for Business | Pilot ring at 3 days, broad ring at 14 days |
| 3. Everything else | Internal systems with no known exploitation | Next maintenance window, or a signed risk acceptance |
This maps to ISO 27001:2022 Annex A control 8.8, management of technical vulnerabilities. The control asks you to obtain timely information on vulnerabilities, evaluate your exposure and take appropriate measures. A tiered policy with written timings and recorded exceptions is evidence that you did.
Tier 1 deserves a standing emergency lane. If the Cisco gateway sits in front of your mail, “next monthly cycle” is the wrong answer. Where no patch can land in 72 hours, restrict management interfaces to trusted internal addresses. Help Net Security notes this reduces PAN-OS risk, and it takes minutes.
Automate the boring 90%
Most of the 1,413 sit in Windows, which Computerworld says carried 1,102 of them in this release. That is what rings are for. Deploy to a pilot group first, then the wider estate, and spend human time on the exceptions.
Computerworld’s testing list for this release is a useful pilot checklist:
- Remote Desktop. Connect with a non-admin account to hosts that have Administrator protection enabled, since a known issue returns error 0xC000000D.
- Printing. Print mixed-font documents from 32-bit and 64-bit apps to physical and virtual printers.
- MSI packages. Install, repair and uninstall a representative set, including ones with script custom actions. Windows Installer has 38 fixes this month.
- VPN and Wi-Fi. Test MS-CHAPv2 connections. Microsoft warns an NTLMv1-derived credential restriction might affect them where Credential Guard is off.
- Downloaded files. Confirm SmartScreen and security warnings still appear.
Run the list against the pilot ring and let the broad ring follow.
Report risk, not patch counts
“Ninety-four percent patched” tells management nothing when the missing six percent is the internet-facing gateway. Report instead:
- Tier 1 assets and the time each took from advisory to remediation.
- KEV entries that apply to your estate, and how many are open.
- Documented risk acceptances, with an owner and a review date.
- Internet-facing and management interfaces that are reachable from outside, which should be a shrinking list.
These four lines show management where the risk sits, and they give an auditor something concrete against control 8.8.
FAQ
Does exposure-first mean ignoring the monthly release?
No. Tier 2 still processes it every month. The change is that the monthly cycle stops being the only clock, and the exposed assets get their own faster one.
Which feeds should replace the “Exploited” flag?
CISA KEV for confirmed exploitation, plus the PSIRT advisories of the vendors whose products face the internet. Check advisory revision history too, as the SharePoint case shows.
What if we cannot patch an edge device in 72 hours?
Mitigate first. Restrict management access, apply the vendor’s interim guidance, and record the exception with an owner and a deadline. Cisco and Palo Alto both report no workarounds for these flaws, so patching is the real fix and the mitigation only buys time.
The volume of CVEs will not fall. Decide this month which assets sit in Tier 1, write the timings down, and let the other 1,400 fixes arrive on a schedule you control.
Sources: SecurityWeek, 14 October 2026 ( https://www.securityweek.com/microsoft-patches-record-1413-vulnerabilities-including-exploited-windows-zero-day/); Computerworld, 16 October 2026 ( https://www.computerworld.com/article/4236627/october-patch-tuesday-1408-cves-1-exploited-flaw-and-a-sharepoint-surprise.html); Help Net Security, 15 October 2026 ( https://www.helpnetsecurity.com/2026/10/15/cve-2026-0322-cve-2026-76519-cve-2026-105133-cve-2026-105134-exploted/); GitLab critical patch release, 12 October 2026 ( https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/); BleepingComputer, 30 October 2026 ( https://www.bleepingcomputer.com/news/security/hackers-now-exploiting-max-severity-gitlab-flaw-in-attacks/); Canadian Centre for Cyber Security AV26-1028, updated 29 October 2026 ( https://cyber.gc.ca/en/alerts-advisories/gitlab-security-advisory-av26-1028) . Microsoft, Cisco, Palo Alto and Ahsay facts are as reported in trade coverage; GitLab facts are from its own advisory. Tier timings and the GitLab response steps are the author’s recommendation.