{"id":26677,"date":"2026-11-05T08:00:00","date_gmt":"2026-11-05T08:00:00","guid":{"rendered":"https:\/\/www.securitytoday.de\/?p=26677"},"modified":"2026-11-13T14:25:12","modified_gmt":"2026-11-13T14:25:12","slug":"microsoft-risk-groups-dont-replace-individual-checks","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2026\/11\/05\/microsoft-risk-groups-dont-replace-individual-checks\/","title":{"rendered":"Microsoft risk cohorts: per-CVE review still required"},"content":{"rendered":"<p><strong>Alongside the October security updates, Microsoft is introducing provisional risk cohorts. They group vulnerabilities that raise similar questions about a customer&#8217;s environment and are meant to support patch prioritization. They are not official categories. Every vulnerability should still be reviewed&nbsp;individually.<\/strong><\/p>\n<div style=\"background:#003340;color:#fff;padding:32px 36px;margin:32px 0;border-radius:8px;\">\n<p style=\"color:#69d8ed;text-transform:uppercase;letter-spacing:0.08em;font-size:0.82em;font-weight:700;margin:0 0 16px;\">Key takeaways<\/p>\n<ul style=\"margin:0;padding-left:20px;line-height:1.7;\">\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">Microsoft proposes provisional risk cohorts.<\/strong> They group vulnerabilities that raise similar questions about a customer&#8217;s environment. A shared root cause is not&nbsp;required.<\/li>\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">The cohorts do not change Microsoft&#8217;s update recommendations.<\/strong> Membership in a cohort does not imply that a single update fixes every vulnerability it&nbsp;contains.<\/li>\n<li style=\"margin-bottom:0;\"><strong style=\"color:#69d8ed;\">A flaw in the Windows shell is already being actively exploited.<\/strong> It bypasses the Mark of the Web protection for files from the internet, but requires an action from the&nbsp;user.<\/li>\n<\/ul>\n<\/div>\n<p style=\"border-bottom:1px solid rgba(230,227,218,0.14);padding:14px 0;margin:28px 0;font-size:0.92em;color:#b8c5ce;\"><strong style=\"color:#69d8ed;\">Related:<\/strong> <a href=\"https:\/\/www.securitytoday.de\/en\/2026\/07\/26\/windows-vulnerabilities-patch-priority-critical-assets\/\" target=\"_blank\" rel=\"noopener\">Windows flaws: Patch order for critical assets<\/a> &nbsp;\u00b7&nbsp; Linux kernel flaw: Ubuntu has yet to ship a&nbsp;patch<\/p>\n<h2>The October Patch Tuesday in&nbsp;numbers<\/h2>\n<p>On 13 October, the monthly Patch Tuesday, Microsoft released its security updates. According to a count by <a href=\"https:\/\/www.bleepingcomputer.com\/news\/microsoft\/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days\/\" target=\"_blank\" rel=\"noopener\">BleepingComputer<\/a>, they fix 1,411 vulnerabilities. Flaws that were already fixed earlier in the month are not included in that count. By the count of the <a href=\"https:\/\/www.thezdi.com\/blog\/2026\/10\/13\/the-october-2026-security-update-review\" target=\"_blank\" rel=\"noopener\">Zero Day Initiative<\/a>, the October release contains 1,415 new CVEs from Microsoft. A CVE is the unique identifier assigned to a publicly tracked&nbsp;vulnerability.<\/p>\n<p>On the same day, Microsoft introduced a provisional approach meant to help customers with their own vulnerability analysis. It groups vulnerabilities by the questions they raise about the customer&#8217;s&nbsp;environment.<\/p>\n<div data-element=\"definition_box\" style=\"background:#23261f;border:1px solid rgba(105,216,237,0.22);border-radius:10px;padding:20px 24px;margin:32px 0;box-shadow:0 2px 10px rgba(0,0,0,0.22);\">\n<p style=\"margin:0;color:#e6e3da;line-height:1.6;\"><strong>What is a risk cohort?<\/strong> A risk cohort groups together vulnerabilities that raise similar questions about a customer&#8217;s environment. A shared root cause or an identical CVSS score is not required. Microsoft presents the concept as a provisional approach that does not constitute an official vulnerability category.<\/p>\n<\/div>\n<h2>How risk cohorts are intended to&nbsp;work<\/h2>\n<p>Microsoft calls the concept &#8220;<a href=\"https:\/\/www.microsoft.com\/en-us\/msrc\/blog\/2026\/10\/using-risk-cohorts-to-prioritize-security-updates\" target=\"_blank\" rel=\"noopener\">risk cohorts<\/a>&#8220;. A risk cohort bundles CVEs that raise similar questions about a customer&#8217;s environment. It requires neither a shared root cause nor an identical CVSS score. The CVSS score is a standardized metric for the technical severity of a&nbsp;vulnerability.<\/p>\n<p>Placement therefore hinges on the questions that arise in the customer&#8217;s IT environment. Two technically different flaws can consequently sit in the same cohort. Customers are expected to document the shared questions about their IT environment that the vulnerabilities in a cohort raise. The approach is intended to support analyses that customers carry out&nbsp;themselves.<\/p>\n<h2>What the cohorts do not&nbsp;do<\/h2>\n<p>The risk cohorts are not official Microsoft vulnerability categories. They leave Microsoft&#8217;s update recommendations untouched. Membership in a cohort also does not mean that a single update or a common countermeasure fixes every CVE it contains. How the concept will feed into Microsoft&#8217;s tools remains&nbsp;open.<\/p>\n<p>Every CVE should still be reviewed individually. Four criteria are envisaged for&nbsp;this:<\/p>\n<ul style=\"padding-left:1.4em;\">\n<li>active&nbsp;exploitation<\/li>\n<li>severity<\/li>\n<li>attack vector<\/li>\n<li>product-specific recommendations<\/li>\n<\/ul>\n<p>Documenting these common questions about the customer&#8217;s IT environment supplements this&nbsp;review.<\/p>\n<h2>Two October flaws&nbsp;compared<\/h2>\n<p>Two flaws from the <a href=\"https:\/\/api.msrc.microsoft.com\/cvrf\/v3.0\/cvrf\/2026-Oct\" target=\"_blank\" rel=\"noopener\">October bulletin<\/a> show just how far apart two entries from the same month can lie. CVE-2026-96951 affects the Windows shell, the operating system&#8217;s user interface. The flaw is considered actively exploited and carries the severity rating &#8220;Important&#8221;. An unauthorized attacker can inject commands over the network using a technique known as command injection. In doing so, the attacker bypasses the Mark of the Web protection, a Windows marking for files from the&nbsp;internet.<\/p>\n<p>Exploitation requires an action from the user. According to the Zero Day Initiative, affected customers should test and roll out the patch quickly because of the active&nbsp;exploitation.<\/p>\n<p>CVE-2026-108398 in the .NET Framework is a different case. The attacker must be authenticated, meaning they hold a valid login. They can then bypass Windows Defender Application Control locally, WDAC for short. The feature controls which applications are allowed to run on a machine. The flaw is publicly known. No active exploitation has been&nbsp;reported.<\/p>\n<p>Measured against the four review criteria, the two cases differ in exploitation, attack vector, and the conditions the attacker must meet. Microsoft&#8217;s update recommendations for both flaws remain unaffected by the risk&nbsp;cohorts.<\/p>\n<h2 style=\"padding-top:64px;margin-bottom:20px;\">Frequently asked questions<\/h2>\n<p class=\"st-faq-hint\">Every question starts collapsed. A tap reveals the&nbsp;answer.<\/p>\n<details>\n<summary><strong>Does exploiting CVE-2026-96951 require user action?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">The flaw cannot be exploited without an action from the victim. The attacker has to lure the victim into taking it, for example via a crafted link or&nbsp;attachment.<\/p>\n<\/details>\n<details>\n<summary><strong>Does the Security Update Guide show the risk cohorts?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Not at the moment. The Security Update Guide, Microsoft&#8217;s portal with details on security updates, does not yet display the cohort relationships. Microsoft has not committed to any concrete product&nbsp;integration.<\/p>\n<\/details>\n<details>\n<summary><strong>Have the details for CVE-2026-96951 changed since publication?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">The revision log for the flaw lists only the initial publication on 13 October. The latest published version of the October&nbsp;bulletin is also dated that day.<\/p>\n<\/details>\n<p><!--ST-LOWER-CARDS lang=en--><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">Editor&#8217;s Picks<\/h3>\n<p><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/07\/26\/windows-vulnerabilities-patch-priority-critical-assets\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/windows-luecken-patch-reihenfolge-fuer-kritische-assets-cover-hero-250x143.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Windows Vulnerabilities: Patch Priority for Critical Assets<\/span><\/span><\/a><!--\/ST-LOWER-CARDS--><\/p>\n<p style=\"font-style:italic;text-align:right;font-size:0.85em;margin-top:8px;\">Image source: AI-generated (November 2026)<\/p>\n","protected":false},"excerpt":{"rendered":"Microsoft proposes grouping CVEs that raise similar questions about customers&#8217; IT. Every vulnerability still needs an individual review.","protected":false},"author":50,"featured_media":25440,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"Patch prioritization","_yoast_wpseo_title":"Microsoft risk cohorts do not replace individual review","_yoast_wpseo_metadesc":"Microsoft proposes grouping CVEs by shared environment questions to aid patch prioritization. Each vulnerability still needs individual review.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"evm_kih_original":false,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"en","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[255],"tags":[],"class_list":["post-26677","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-praxis-umsetzung-en"],"evm_reading_time_minutes":5,"wpml_language":"en","wpml_translation_of":25438,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/26677","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=26677"}],"version-history":[{"count":18,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/26677\/revisions"}],"predecessor-version":[{"id":27191,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/26677\/revisions\/27191"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/25440"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=26677"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=26677"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=26677"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}