Microsoft's October Patch Tuesday has seven totals, 1,407 to 1,417, and one exploited CVE, not three zero-days

Seven totals for one release, and one CVE flagged exploited

Microsoft's own release notes for 13 October 2026 give two totals for the same release. The heading says it "consists of the following 1413 Microsoft CVEs". The table beneath lists ten product families whose figures add up to 1,413 (derived), and its Total row says 1,414. The machine-readable release data, the CVRF at revision 678, holds 1,759 records: 1,758 CVE identifiers and one advisory, ADV260001, whose own threat label is "Not a Vulnerability" (derived).

Nine sources give seven different totals: 1,407 (Tenable), 1,409 (Action1), 1,411 (BleepingComputer), 1,413 (Microsoft's heading, The Hacker News and Rapid7), 1,414 (Microsoft's table), 1,415 (Zero Day Initiative and Talos) and 1,417 (the SANS Internet Storm Center). Krebs on Security says "more than 1,400". Every figure reproduces from a counting rule applied to Microsoft's data except 1,413 and 1,414, which Microsoft prints itself. The spread is 10, or 0.7 per cent of 1,410 (derived), which is small. The rules behind it are not small: they decide which CVEs a reader believes are in the release.

The labels differ as much as the totals. BleepingComputer's headline says "3 zero-days"; its text says one actively exploited and two publicly disclosed. In Microsoft's data exactly one CVE carries Exploited:Yes, CVE-2026-96951, a Windows Shell security feature bypass. That is 1 of 1,410 CVE ids first published on the day, or 0.07 per cent (derived). The other two, CVE-2026-108398 and CVE-2026-92707, carry Publicly Disclosed:Yes and Exploited:No. Only one of the three is exploited, and the word zero-day does not say which.

What this does not establish. It does not show that any outlet is wrong: each counted something real. It does not show that the size of the release measures a defender's workload: Microsoft's table counts 176 distinct updates and puts 1,102 Windows CVEs into 39 of them, and for one Windows 11 24H2 x64 machine, 1,008 of the 1,020 CVE ids that list it name the same update, KB5127648 (derived). And it says nothing about how the exploited bug is being used, by whom or against whom, because Microsoft does not state it.

Everything here was read between 06:19 and 06:52 BST on Wednesday 14 October 2026: Microsoft's CVRF (current release date 2026-10-13T18:45:51 in the file, which gives no time zone), the Security Update Guide, the outlets' own pages, and the UK pages named in the UK section. Figures marked (derived) are my arithmetic on that data and are shown in full in the factcheck file. Anything that can change after reading, such as a Microsoft revision or the CISA catalogue, is time-stamped.

Who counted what, and the rule that reproduces each figure

The first table gives each source's figures, the counting rule that reproduces them from Microsoft's data, and what the count leaves out. The rules are mine unless a source states one (only BleepingComputer partly does). Two Microsoft surfaces are involved: the CVRF file, and the Security Update Guide, the web page whose own data service I read for each CVE. "Mariner" is the product-family tag the CVRF puts on 340 records, mostly third-party CVEs assigned by Linux, Apache, MITRE and others; the Guide has a matching isMariner field.

Totals and Critical counts as published, the rule that reproduces each from Microsoft's CVRF and Security Update Guide (derived), and what each leaves out. Sources read 14 October 2026.

Source and its figures	Reproduced by (derived)	Not in the count
Microsoft release notes: heading 1,413; table rows sum 1,413; Total row 1,414	Not reproduced. Nearest field rules: 1,416 Microsoft-assigned CVE ids (3 more) or the 1,408 of them first published 13 October (5 fewer)	One non-Microsoft CVE it republishes (CVE-2026-21413), listed apart
BleepingComputer: 1,411 flaws; 70 Critical (57 RCE, 11 EoP, 2 spoofing); 348 excluded	1,759 records, less 340 tagged Mariner, less 8 non-Mariner records first published before 13 October. Exact, including the 70 and its split, only if ADV260001 is counted	340 Mariner records (72 first published 13 October) and 8 earlier ones: 7 cloud CVEs and 1 Exchange CVE
The Hacker News and Rapid7: 1,413; THN adds 1,102 Windows, 134 Office, 61 Developer Tools, 36 SharePoint, 22 SQL Server; over 70 Critical	Repeat Microsoft's heading and family table. THN's more than 670 EoP, over 300 RCE and 250 information disclosure fit 673, 315 and 252 (derived)	As Microsoft's
SANS Internet Storm Center: 1,417; 76 Critical, 7 needing no customer action; 1 disclosed, 1 exploited	Every record whose assigner is Microsoft: 1,416 CVE ids plus ADV260001. Its table ids match exactly; 76 is the CVRF count for them	The GitHub-assigned MessagePack CVE, hence one disclosed CVE, not two. Includes the advisory and 8 earlier records
Zero Day Initiative: 1,415 new CVEs; table of 1,417 rows, 86 Critical; 1 exploited, 2 publicly known	1,415 is Microsoft-assigned CVE ids that have a Security Update Guide entry. Its rows add 2 CVEs assigned by others and omit CVE-2026-88164. 86 is the Guide's rating	CVE-2026-88164 (no Guide entry); Mariner records
Talos: 1,415; 85 Critical, 67 of them RCE	The same 1,415, with the Guide's severity. Exact, including the 67	As ZDI's
Tenable: 1,407; 69 Critical, 1,337 Important, 0 Moderate, 1 Low	Microsoft-assigned CVE ids first published 13 October (1,408), less CVE-2026-88164, which has no severity row. 69 is the CVRF count	8 earlier records; CVEs assigned by others
Action1: 1,409 patches; 80 Critical; two zero-days	1,409 is Microsoft-assigned records first published 13 October, advisory included. The 80 is not reproduced (79 on the Guide's feed for non-Mariner CVE ids that day)	8 earlier records; Mariner records
Krebs on Security: more than 1,400; at least 78 Critical; one zero-day	78 is the Guide's Critical rating for Microsoft-assigned CVE ids first published 13 October. The post states no rule	No exact total given
BleepingComputer's own table: 1,758 rows, 174 Critical	Every CVE id in the file, Mariner included	Only the advisory ADV260001

BleepingComputer is the one outlet whose whole headline set I reproduce exactly from a single release file, namely 1,411, 70 Critical, and the 57, 11 and 2 split. It needs the advisory counted, so its flaws include one record Microsoft labels Not a Vulnerability (derived). Its text says the 348 excluded were fixed earlier in the month. By first revision date, 72 of the 340 Mariner records first appear on 13 October, so earlier fits 276 of the 348, not all (derived). Its category list gives 677 elevation of privilege, which matches the count over all CVE ids or all Microsoft-assigned ones, not the 673 inside its own 1,411 (derived); its text calls the figures approximate.

SANS and BleepingComputer differ by 6 because SANS keeps 8 earlier Microsoft records that BleepingComputer drops, while BleepingComputer keeps two CVEs assigned by others that SANS leaves out: 8 minus 2 (derived). Those two are CVE-2026-21413, which Microsoft says it is republishing for Cisco Talos, and the GitHub-assigned CVE-2026-92707. That is also why SANS counts one publicly disclosed CVE where Microsoft's own data flags two.

Microsoft's number is the one I cannot rebuild. The Hacker News and Rapid7 repeat it. Its SharePoint (36), SQL Server (22) and Exchange (7) rows match counts of Microsoft-assigned CVEs by product family, and the Exchange row includes CVE-2026-96940, first published 2 October (derived), so Microsoft's table is not limited to what appeared on 13 October. That CVE is covered in an earlier briefing: Microsoft shipped September's Exchange update twice, 24 days apart.

One file, ten counting rules. Counts derived from MSRC CVRF revision 678 and the Security Update Guide, read 14 October 2026.

Counting rule (derived)	Count	Who counts this way
Every record in the CVRF	1,759	BleepingComputer's 1,411 plus its 348 excluded
CVE ids only	1,758	BleepingComputer's table
CVE ids first published 13 October	1,482	Includes 72 Mariner-tagged
The same, not tagged Mariner (my baseline)	1,410	No outlet states this rule
The same, plus the advisory	1,411	BleepingComputer's headline
Microsoft-assigned CVE ids, any date	1,416	SANS minus the advisory
Microsoft-assigned records, advisory included	1,417	SANS
Microsoft-assigned CVE ids with a Security Update Guide entry	1,415	ZDI and Talos
Microsoft-assigned records first published 13 October, advisory included	1,409	Action1
Microsoft-assigned CVE ids first published 13 October	1,408	Tenable, plus one record

Against my baseline of 1,410 (CVE ids first published 13 October and not tagged Mariner), the figures sit at minus 3 (Tenable), minus 1 (Action1), plus 1 (BleepingComputer), plus 3 (Microsoft's heading, The Hacker News, Rapid7), plus 4 (Microsoft's table), plus 5 (ZDI, Talos), plus 7 (SANS) and plus 348 (BleepingComputer's table) (derived). The share of the 13 October group not assigned by Microsoft is 74 of 1,482, or 5.0 per cent (derived). Of those 74, 72 are Mariner-tagged and two are the Talos and GitHub CVEs above. Of the 276 CVE ids first published earlier, 8 are Microsoft's and 268 are Mariner-tagged records assigned by Linux, Apache, MITRE, Go and others.

The rule moves the count more than the detail inside the rule

A CVE has one row per affected product in the CVRF, and the rows can disagree. To count a CVE once you need a rule, so I tested three: the first row, the most common row, and the highest (and the lowest as a check). In this release the choice barely matters, because only 8 of 1,758 CVE ids carry more than one severity across their rows and only 2 more than one impact type (derived). What moves the number is the population, and after that which of Microsoft's two surfaces is read.

Critical and impact-type counts under each rule or feed (derived from MSRC CVRF revision 678 and the Security Update Guide, read 14 October 2026).

What is counted	Count	Rule or feed
Critical, 1,410 CVE ids first published 13 October, not Mariner	70	CVRF. Same under first row, most common row and highest row; 69 under lowest row
Critical, 1,408 Microsoft-assigned, first published 13 October	69	CVRF, highest row
Critical, 1,416 Microsoft-assigned, any date	76 or 85	CVRF 76; Security Update Guide 85
Critical, 1,418 non-Mariner CVE ids	77 or 86	CVRF 77; Security Update Guide 86
Critical, all 1,758 CVE ids	174	CVRF; BleepingComputer's own table also shows 174
Critical share of severity rows	4.1%	1,300 of 31,736 product rows, CVRF
Elevation of privilege, 1,410	673	First row, most common row and row of highest severity all agree
Information disclosure and denial of service, 1,410	252, 251, 252 and 71, 73, 72	First row, most common row, row of highest severity

Microsoft's two surfaces disagree. Of 1,418 non-Mariner records I read in the Security Update Guide, severity differs from the CVRF for 12 (derived): nine Word and Excel remote code execution CVEs are Important in the CVRF and Critical in the Guide, and three more records differ, among them the advisory. One CVE, CVE-2026-88164 (SharePoint), has no Guide entry (the service answers not found) and no severity row in the CVRF. This is why SANS, BleepingComputer and Tenable report 76, 70 and 69 Critical, which fit the CVRF, while ZDI, Talos and Krebs report 86, 85 and at least 78, which fit the Guide (derived). I cannot say which is current: the Guide shows one revision for those CVEs and I found no revision note.

Severity does not stand in for exploitation either. Among the 1,408 Microsoft-assigned CVEs first published on the day, 108 carry Microsoft's Exploitation More Likely rating, and 2 of them are Critical (CVE-2026-70229 and CVE-2026-70571); of the 70 Critical CVEs, 2 are More Likely (derived). Microsoft's severity and its exploitability index answer different questions, and a queue built from one misses most of the other.

Three zero-days, one exploited

Microsoft's data does not use the word zero-day. Each CVE carries one string with the flags, for example Publicly Disclosed:No;Exploited:Yes;Latest Software Release:Exploitation Detected. Microsoft's Security Update Guide FAQ defines the first two: Publicly Disclosed is marked yes when the flaw was disclosed before the release of the update, and Exploited is marked yes when it was exploited before that release.

The three CVEs behind the zero-day headlines, from MSRC CVRF revision 678 and the Security Update Guide, read 14 October 2026.

CVE, product and score	What Microsoft's data says	Not stated
CVE-2026-96951, Windows Shell, security feature bypass, CVSS 8.8, rated Important	Exploited:Yes, Exploitation Detected. Network vector, user interaction required, command injection weakness (CWE-77). 31 product rows	How it is used, by whom, against whom, since when, how many victims
CVE-2026-108398, .NET Framework, security feature bypass of Windows Defender Application Control, CVSS 8.8, Important	Publicly Disclosed:Yes, Exploited:No, Exploitation Less Likely. Local vector, authenticated attacker. Credited to a Google Project Zero researcher. 24 product rows	What was disclosed, where and when; whether Less Likely holds
CVE-2026-92707, MessagePack-CSharp, denial of service, CVSS 5.3, Moderate, assigned by GitHub	Publicly Disclosed:Yes, Exploited:No, no exploitability rating. Network vector, no authentication, no user interaction. Credit reads Anonymous	Where it was disclosed. Absent from Microsoft's Notable CVEs table

How each source counts the three. Quoted wording is the source's own; counts are read from its page on 14 October 2026.

Source	Its wording	Count
Microsoft release notes	Notable CVEs: Exploitation Detected; Publicly disclosed	2 listed (omits CVE-2026-92707)
BleepingComputer	Headline "3 zero-days"; text: one exploited, two publicly disclosed	3 (1 exploited)
The Hacker News	"Three vulnerabilities of note"	3 listed (1 exploited)
Rapid7	Exploitation for just one; public disclosure for two others	1 and 2
Zero Day Initiative	One "lone bug" under attack; two publicly known	1 and 2
SANS Internet Storm Center	One disclosed before the release, one exploited	1 and 1
Tenable	"Two zero days", one exploited	2
Action1	"Two zero-days"	2
Talos	One exploited in the wild	1
Krebs on Security	"Just one" zero day; names the .NET disclosure separately	1 (plus 1 disclosed)

Microsoft's own blog defines a zero-day vulnerability as a flaw for which no official patch or security update has been released. By that definition none of the three was a zero-day on release day, because the CVRF carries fix information for each: an update article for the first two, a package version for the MessagePack CVE. BleepingComputer writes that Microsoft classifies a zero-day as publicly disclosed or actively exploited when no official fix is available; I did not find that sentence on the two Microsoft pages I read. The label survives because it is short. It folds two different statements, exploited before release and disclosed before release, into one word, and it gives a Moderate-rated denial of service in an open-source library the same name as an exploited bypass.

Mark of the Web bypass: what the label hides and what Microsoft does not say

The friendly name is Mark of the Web bypass. Rapid7 reads it as Windows not providing the dialog "explaining that Windows protected their PC", and Action1 as a protection against unsafe downloaded files failing to warn the user. Both readings are fair as far as they go: they describe one missing prompt, not the vulnerability. Microsoft's record is a command injection weakness in the Windows Shell, scored 8.8, with confidentiality, integrity and availability impact all rated High and user interaction required. The label hides the gap between a prompt that does not appear and a rating of 8.8, and a team that hears only the label will treat it as a nuisance.

What Microsoft, CISA and the credit lines state about CVE-2026-96951, and what they do not (MSRC CVRF and Security Update Guide, CISA catalogue and CVE record, read 14 October 2026).

Topic	Stated	Not stated
Exploitation	Exploited:Yes, Exploitation Detected, in the CVRF and the Guide. Listed under Notable CVEs in Microsoft's release notes	How it is exploited, by whom, against whom, since when, how many victims, whether Microsoft saw it itself
Mechanism	Command injection (CWE-77) in Windows Shell lets an unauthorized attacker bypass a security feature over a network, evading Mark of the Web defenses. The FAQ's scenario: a crafted file by email or instant message, or a link or attachment the user must act on	What the file does; whether the bypass covers every file type and source
Affected	31 product rows: Windows 10 1607, 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2, 26H2, 26H1; Server 2012 R2, 2016, 2019, 2022, 2025; Outlook.com	Windows Server 2012 (not R2) has no row. Outlook.com has a release-notes row, not an update article
Fix	Nine update articles, including KB5127648 (Windows 11 24H2, 25H2, 26H2) and KB5126657 (Windows 10 21H2, 22H2). Every update row says a restart is required	Whether any interim step reduces exposure before the restart
CISA catalogue	Added 13 October, due 16 October, forensic triage flag Yes, known ransomware campaign use Unknown (read 14 October 2026)	Which campaigns. CISA's SSVC field in the CVE record reads Exploitation: none, stamped 8 October, before the listing (my reading)
Credit	Four credit lines: two name Fujitsu Limited, one reads that the researcher used Claude with Anthropic, one is a bare handle with no affiliation	Who found the in-the-wild use

Microsoft credits four reporters for this CVE and I name none of them. Microsoft's credit is the only source for that attribution, and it does not say who found the in-the-wild use. Anthropic sells the model that one credit line names, and the line does not say what the model did. The Hacker News says it is unclear how the bug is exploited, by whom and against whom; nothing I read from Microsoft, CISA, ZDI, Rapid7, Tenable or Talos fills that in.

Whether Exploitation Less Likely holds for CVE-2026-108398 the data cannot say. It is Microsoft's prediction at release, recorded beside the statement that the flaw was publicly disclosed, and the two fields are independent. The Hacker News quotes Action1's president calling it dangerous as a post-compromise technique; that is a patch-management vendor's opinion, not a field in the data. Its exploitation scenario needs an authenticated attacker already on the machine, which is why it is a different kind of risk from the Shell bug.

Risk cohorts: a map that leaves out the exploited CVE

On 13 October Microsoft published a post on risk cohorts, calling them provisional groupings that are "not official Microsoft vulnerability categories" and do "not replace the assessment of individual CVEs". Its table lists 15 cohorts totalling 1,118 CVEs (derived), and BleepingComputer's five largest (136, 135, 131, 109, 103) match it. Microsoft's PDF mapping lists 1,119 CVEs across 16 cohorts: a sixteenth, in the PDF only, holds one Internet Explorer CVE. ZDI welcomes the idea as bulletins brought back at group level.

Matching the PDF to the release data gives three results (derived). First, 298 of the 1,416 Microsoft-assigned CVE ids, 21.0 per cent, are in no cohort: all of SharePoint (36), SQL Server (22) and Exchange (7), all 8 Windows Shell CVEs, Windows Search (29), .NET (25) and the 7 cloud CVEs that need no customer action. Second, the exploited CVE-2026-96951 and the publicly disclosed CVE-2026-108398 are among the 298, and the GitHub-assigned MessagePack CVE is in no cohort either. Third, size does not rank risk: the largest cohort, filesystems, storage and backup (136), has no Critical CVE and 4 rated Exploitation More Likely, while core and kernel privilege boundaries (109) has 28, the most of any group.

Microsoft says cohorts do not replace careful review of high-severity or actively exploited vulnerabilities, and the post is candid about that. The risk is a team using the map as the queue. The post's own worked examples also do not match its list, as the table shows; I cannot tell whether the examples use a different cut of the data.

Microsoft's worked examples against its own cohort list, counted from its PDF and the release data (derived, read 14 October 2026).

Figure	Microsoft's post, worked example	Its table and PDF, counted
Office document and mail clients: CVEs	119	135 in the table and the PDF
Office cohort: rated Critical	23	25 by the CVRF, 34 by the Guide
Office cohort: no user interaction	17	16 (CVSS vector UI:N)
Remote-access and RDP deployments: CVEs	64	65 in the table and the PDF

Four labels that do the work of a decision, and what the record shows.

Label	What it suggests	What the record shows
Patch Tuesday size	A measure of the work	Seven totals from 1,407 to 1,417; one Windows 11 build takes 1,008 of 1,020 CVEs from one update
Zero-day	The CVEs to fix first	Three flagged CVEs, one exploited, one a local bypass, one a Moderate denial of service
Mark of the Web bypass	A missing prompt	A command injection weakness rated 8.8, exploited, with no detail on use
Risk cohort	A priority list	A provisional grouping with 298 CVEs in no cohort, the exploited one among them

The UK: the clocks, and what a small organisation on Home or Pro should check

Cyber Essentials Requirements for IT Infrastructure v3.3, dated April 2026 (v3.3 is the version I could open; the NCSC overview page I read names none), require in-scope software to be licensed and supported, removed when unsupported or taken out of scope, and updated within 14 days of release where the vendor calls the fixed flaws critical or high risk, the CVSS v3 base score is 7 or above, or no severity detail is given. It adds that a single update covering any critical or high-risk issue must be installed within 14 days. For this release the CVE count does not enter: 70 CVE ids are Critical and 1,049 of 1,410 carry a base score of 7.0 or above on at least one product row (derived), so the monthly Windows update is inside the clock whichever total is right. Fourteen days from 13 October is Tuesday 27 October.

The clocks that apply to this release, dates derived from release day Tuesday 13 October 2026 (read 14 October 2026).

Clock	Date (derived)	Source
CISA catalogue due date for CVE-2026-96951, US federal agencies, 3 days	Fri 16 October	CISA catalogue entry; BOD 26-04. Not binding on UK organisations
NCSC best practice: internet-facing services and software, 5 days	Sun 18 October	NCSC vulnerability management, principle 1
NCSC: operating system and applications, 7 days, phased, for example 10% of the estate a day	Tue 20 October	The same page
Cyber Essentials v3.3: 14 days for critical or high-risk fixes. NCSC internal or air-gapped: 14 days	Tue 27 October	CE requirements for IT infrastructure v3.3; NCSC
NCSC table for exploited vulnerabilities: under 24, 48 or 72 hours, with a Cyber Incident Response review	Depends on four answers	NCSC, responding to active exploitation

The NCSC's table for exploited vulnerabilities asks four things: is it in CISA's catalogue, is the product internet accessible, can exploitation be automated, and can the attacker take total control. The three rows it prints start with catalogue yes and total control yes and give under 24 hours, under 48 hours or under 72 hours, each with an assured incident response review. For CVE-2026-96951 the first answer is yes, and CISA's own CVE-record data gives Automatable: no and Technical Impact: total. Internet accessibility depends on your estate; for a device that receives mail and chat files it is arguable. With yes, the row is under 48 hours. With no, that combination is not printed, so the 7-day operating system timescale and CISA's 16 October date are the benchmarks I would use (my reading). The NCSC also warns that the catalogue reports only exploitation that has already happened. Our earlier briefing on the catalogue's deadlines is CISA added 34 flaws in September, and 26 came with a three day deadline.

End-of-updates dates as Microsoft states them (Windows message centre, release information, lifecycle and consumer ESU pages, read 14 October 2026) and what to check.

Product	Microsoft states	Check
Windows 11 24H2 Home and Pro	End of updates 13 October 2026; the October update is the last. Move to 26H2 or 25H2. 24H2 Enterprise and Education stay supported to 12 October 2027	List every Home or Pro device on 24H2. Cyber Essentials needs licensed and supported software, so ask your certification body how it treats them
Windows 10 Enterprise LTSB 2016	End of updates 13 October 2026; move to Windows 11 Enterprise LTSC 2024; ESU available	Tills, kiosks, lab and plant machines
Windows 10 22H2	General channel: end of updates. Consumer ESU to 12 October 2027: free with PC settings sync, 1,000 Rewards points or US$30 once; not for commercial scenarios, not offered on domain-joined, Entra-joined or MDM-enrolled devices. Commercial ESU US$61 a device in year one, doubling	Krebs's free extra year holds for one consumer route only. Treat the Windows 10 fix (KB5126657) as reaching enrolled devices only (my reading)
Windows Server 2012 R2	ESU year 3 ends 14 October 2026 (06:59 PT on the lifecycle page). The CVRF lists KB5126836 for 2012 R2 and no row for 2012	Move or isolate
Office 2021	Retirement date 14 October 2026 (06:59 PT on the lifecycle page)	Inventory and plan the move

UK GDPR Article 32(1) asks controllers and processors for measures that give a level of security appropriate to the risk, taking account of the state of the art and cost, including a process for regularly testing and evaluating them. The ICO's guide says the law does not define the measures and that no one size fits all, and advises acting on test findings or recording a valid reason for not doing so. None of that sets a patching deadline. What a risk-based duty needs is an order of work you can explain: a queue sorted by exploitation status, exposure and the data on the device can be defended, and one sorted by release size is harder to (my reading). The ICO page carries a banner saying the guide is under review after the Data (Use and Access) Act.

What to do, in the order worth doing

What could not be verified

• Microsoft's 1,413 and 1,414 do not reproduce from the CVRF fields; I do not know which Microsoft meant.
• The counting rules for BleepingComputer (partly stated), Tenable, ZDI, Talos, Action1 and Krebs are my reconstructions. Only the SANS and BleepingComputer tables match Microsoft's data id for id.
• The CVRF and the Security Update Guide disagree on severity for 12 records, and the Guide has no entry for CVE-2026-88164. I do not know which is current.
• How CVE-2026-96951 is exploited, by whom, against whom and how many times: not stated by Microsoft, CISA or any source I read.
• Krebs's figures of 1,261 CVEs in 2020 and more than 4,000 in 2026, and ZDI's comparison of 15 Microsoft zero-days this year with 17 in 2023, are the outlets' and were not checked. A Fortra figure of 26 Microsoft entries in the CISA catalogue this year fits my count of 27 with a 2026 CVE id including today's addition (derived).
• I did not verify what the Mariner tag expands to, and I did not read Cyber Essentials question sets. Whether an assessor treats Windows 11 24H2 Home and Pro as unsupported is for the assessor.
• Cohort Critical and More Likely counts are my matches of Microsoft's PDF to its own flags; the cohorts themselves are Microsoft's and provisional.

The question that exposes the gap

ZDI's October review says teams that triage by sheer CVE count instead of exploitability are burning cycles on the wrong bugs. The data in this briefing shows how hard it is even to agree the count. So when this month's patching is reported, does the report open with how many CVEs the release contained, or with how many hours it took the one exploited CVE to reach every device that opens email attachments?

Key facts