Microsoft risk cohorts: per-CVE review still required
Alongside the October security updates, Microsoft is introducing provisional risk cohorts. They group vulnerabilities that raise similar questions about a customer’s environment and are meant to support patch prioritization. They are not official categories. Every vulnerability should still be reviewed individually.
Key takeaways
- Microsoft proposes provisional risk cohorts. They group vulnerabilities that raise similar questions about a customer’s environment. A shared root cause is not required.
- The cohorts do not change Microsoft’s update recommendations. Membership in a cohort does not imply that a single update fixes every vulnerability it contains.
- A flaw in the Windows shell is already being actively exploited. It bypasses the Mark of the Web protection for files from the internet, but requires an action from the user.
Related: Windows flaws: Patch order for critical assets · Linux kernel flaw: Ubuntu has yet to ship a patch
The October Patch Tuesday in numbers
On 13 October, the monthly Patch Tuesday, Microsoft released its security updates. According to a count by BleepingComputer, they fix 1,411 vulnerabilities. Flaws that were already fixed earlier in the month are not included in that count. By the count of the Zero Day Initiative, the October release contains 1,415 new CVEs from Microsoft. A CVE is the unique identifier assigned to a publicly tracked vulnerability.
On the same day, Microsoft introduced a provisional approach meant to help customers with their own vulnerability analysis. It groups vulnerabilities by the questions they raise about the customer’s environment.
What is a risk cohort? A risk cohort groups together vulnerabilities that raise similar questions about a customer’s environment. A shared root cause or an identical CVSS score is not required. Microsoft presents the concept as a provisional approach that does not constitute an official vulnerability category.
How risk cohorts are intended to work
Microsoft calls the concept “risk cohorts“. A risk cohort bundles CVEs that raise similar questions about a customer’s environment. It requires neither a shared root cause nor an identical CVSS score. The CVSS score is a standardized metric for the technical severity of a vulnerability.
Placement therefore hinges on the questions that arise in the customer’s IT environment. Two technically different flaws can consequently sit in the same cohort. Customers are expected to document the shared questions about their IT environment that the vulnerabilities in a cohort raise. The approach is intended to support analyses that customers carry out themselves.
What the cohorts do not do
The risk cohorts are not official Microsoft vulnerability categories. They leave Microsoft’s update recommendations untouched. Membership in a cohort also does not mean that a single update or a common countermeasure fixes every CVE it contains. How the concept will feed into Microsoft’s tools remains open.
Every CVE should still be reviewed individually. Four criteria are envisaged for this:
- active exploitation
- severity
- attack vector
- product-specific recommendations
Documenting these common questions about the customer’s IT environment supplements this review.
Two October flaws compared
Two flaws from the October bulletin show just how far apart two entries from the same month can lie. CVE-2026-96951 affects the Windows shell, the operating system’s user interface. The flaw is considered actively exploited and carries the severity rating “Important”. An unauthorized attacker can inject commands over the network using a technique known as command injection. In doing so, the attacker bypasses the Mark of the Web protection, a Windows marking for files from the internet.
Exploitation requires an action from the user. According to the Zero Day Initiative, affected customers should test and roll out the patch quickly because of the active exploitation.
CVE-2026-108398 in the .NET Framework is a different case. The attacker must be authenticated, meaning they hold a valid login. They can then bypass Windows Defender Application Control locally, WDAC for short. The feature controls which applications are allowed to run on a machine. The flaw is publicly known. No active exploitation has been reported.
Measured against the four review criteria, the two cases differ in exploitation, attack vector, and the conditions the attacker must meet. Microsoft’s update recommendations for both flaws remain unaffected by the risk cohorts.
Frequently asked questions
Every question starts collapsed. A tap reveals the answer.
Does exploiting CVE-2026-96951 require user action?
The flaw cannot be exploited without an action from the victim. The attacker has to lure the victim into taking it, for example via a crafted link or attachment.
Does the Security Update Guide show the risk cohorts?
Not at the moment. The Security Update Guide, Microsoft’s portal with details on security updates, does not yet display the cohort relationships. Microsoft has not committed to any concrete product integration.
Have the details for CVE-2026-96951 changed since publication?
The revision log for the flaw lists only the initial publication on 13 October. The latest published version of the October bulletin is also dated that day.
Editor’s Picks
Editor’s PickWindows Vulnerabilities: Patch Priority for Critical Assets
Image source: AI-generated (November 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
