Cut-paper illustration of a calendar page with the 13th circled in red, a small brass shield badge resting on the page, and a storm of paper envelopes and shields looming behind it.

Tomorrow, October 13, is Patch Tuesday. As of today, October's entire patch haul stands at four updates fixing exactly one CVE. September shipped sixty updates and, depending on which tracker you trust, somewhere between 964 and 1,169 of them. Both counts are records.

If your patch team feels relieved, it should not. The quiet month is when attention drifts, and attackers know that as well as you do.

The one CVE that did ship

On October 2, Microsoft broke its own schedule to ship out-of-band security updates for Exchange Server, fixing CVE-2026-96940, an elevation-of-privilege flaw rated 8.8. Weak authorization lets an attacker who already has a low-privilege account read other users' mailboxes in the same organization. There is no cross-tenant access, and the attacker cannot send mail or modify anything. Reading is enough. Corporate mailboxes hold credentials, financial documents, legal threads, and internal strategy, and everyone reading this knows it.

Exchange Online customers do nothing. Microsoft applied a service-side fix to the cloud. On-premises admins have four packages to install, one per branch:

Exchange build Fixed in build KB
Exchange Server SE RTM 15.02.2562.053 KB5129955
Exchange Server 2019 CU15 15.02.1748.053 KB5129956
Exchange Server 2019 CU14 15.02.1544.048 KB5129957
Exchange Server 2016 CU23 15.01.2507.075 KB5129958

Microsoft's exploitability rating on this one is "Exploitation More Likely." No active exploitation had been observed at disclosure, and the flaw was found by a Microsoft researcher, not in the wild. But the "More Likely" rating is why the fix shipped eleven days before Patch Tuesday. It is Microsoft's way of saying exploit code is coming, and the disclosure itself hands attackers the starting notes. One analyst's read, which I think is fair, is to treat that rating as a 72-hour patch-or-mitigate deadline.

Two operational details are easy to miss. First, on Exchange 2016 and 2019, these updates are only served to organizations enrolled in ESU Period 2. No enrollment, no patch through normal channels. Second, Microsoft's own guidance covers the management tools too: workstations running Exchange Management Tools should get the matching V2 update so clients and servers stay compatible. If your Exchange estate cannot absorb an out-of-band update within days, that is itself a finding worth escalating.

A quiet count is not a quiet threat

Two things about CVE counts that a working sysadmin should keep in mind.

First, the counters disagree. Senserva counts 1,169 CVEs for September with 118 of them critical. Another tracker lands near 964 with 113 critical. Both call it a record, and the gap between them does not matter. What matters is that a record month was followed by a near-empty one, and nobody's risk went to zero in between.

Second, the only flaw shipping this month is rated "Exploitation More Likely," not "Exploitation Detected." That rating deserves the fastest response, not the slowest, because it is the window where patching is a race instead of a cleanup. The history of that rating is not kind. "More likely" flaws keep turning into "actively exploited" flaws, usually shortly after public disclosure makes the bug legible.

The deeper problem with a quiet month is attention, not arithmetic. September demanded triage. October asks for nothing, and that is exactly when unpatched September flaws sit the longest. Even Senserva's own tracker warns that the CISA KEV list measures older flaws being actively exploited elsewhere, not whether anything new is under attack. An empty KEV column for October is not an all-clear. It is a blank form.

What a quiet Patch Tuesday is actually for

The good read on September's record month came from VentureBeat: severity alone cannot decide what gets patched first. Exposure has to. Borrowing that framing, here are three questions worth answering before tomorrow's cycle:

  1. Are September's exploited flaws actually remediated, or just marked done? Two flaws were already being exploited in September. Patched is not verified. Check the build number, check for signs of compromise, and close the ticket when the evidence says closed.
  2. What is exposed right now, and is it holding or widening? Report the trend, not the count. One reachable Exchange server sitting on an old cumulative update is a bigger risk than fifty patched workstations.
  3. Which backlog item does the light month fund? Pick one and move it:
Backlog item Why October is the month for it
EWS allow-list enforcement Enforcement landed October 10; confirm nothing broke and the allow list is actually complete
WDS deprecation planning You have years of runway, but runway only helps if you start walking
FortiMail implant hunts The patches shipped last week; implants survive patching, so verify instead of assuming
Office sprawl cleanup The October forecast keeps flagging fragmented Office installs as the real operational risk

Notice that none of these come from October's CVE list. The light month pays down the debt the heavy month created. That is the whole point of having a cadence instead of a panic button.

The number to watch instead of the CVE count

Stop grading months by CVE volume. A quiet month with one "Exploitation More Likely" Exchange flaw and two lingering exploited September zero-days is not a safer month than September was. The number that matters is time from disclosure to verified remediation on reachable systems. No tracker computes that for you. It comes from your own inventory and your own logs.

Tomorrow will probably be boring. Boring is fine, as long as you spend it on the things September did not give you time for.

Sources