一个月修 1413 个漏洞：用「风险分组」给微软 2026 年 10 月补丁日分诊

微软 2026 年 10 月的补丁日修复了 1,413 个 CVE：Windows 1,102 个、Office 134 个、开发者工具 61 个、SharePoint Server 36 个，Exchange Server、Azure、Defender 等产品也一并打了补丁。单这一个月，就超过了微软在整个 2025 年修掉的漏洞总数，并把 2026 年累计数推过 4,000。这 1,413 个里面，有一个正在被在野利用。不过这次发布里更值得看的是它给队列带来的一种新组织方式——哪怕你以后再不看发布说明，这套方式也值得抄。

被在野利用的那个漏洞绕过的，正是「网络标记」这道防线

先看数字有多大

按发布信息，微软 2026 年 10 月补丁日修复了 1,413 个 CVE，其中 1,102 个影响 Windows、134 个影响 Office、61 个影响开发者工具、36 个影响 SharePoint Server，同批还修复了 Exchange Server、Azure、Defender 等。两组对比能说明量级：这一个月的总量超过微软在整个 2025 年修补的漏洞数，并把 2026 年年初至今的数字推过 4,000。这种规模的队列不是靠「读一遍」能完成的。问题也不再是「哪些重要」，而是「固定的人力小时数究竟能按什么顺序清掉」。

# Exploited first, always. Intersect CISA KEV with what you actually run.
import json, urllib.request

KEV = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
ASSETS = {"windows-server-2022": ["CVE-2026-96951"], "sharepoint-2019": ["CVE-2026-108398"]}

with urllib.request.urlopen(KEV, timeout=30) as resp:
    kev = json.load(resp)

exploited = {v["cveID"]: v for v in kev["vulnerabilities"]}
print("KEV entries:", len(exploited))

for asset, cves in ASSETS.items():
    for cve in cves:
        entry = exploited.get(cve)
        if entry:
            print(asset, "|", cve, "| due:", entry.get("dueDate"),
                  "| known ransomware use:", entry.get("knownRansomwareCampaignUse"))

# CVE-2026-96951 landed in KEV on October 13, 2026; federal agencies were given
# until October 16. Your own SLA should have been tighter than that, not looser.

正在被利用的那一个：CVE-2026-96951

CVE-2026-96951 是一个 Windows shell 安全特性绕过漏洞，评分 8.8（满分 10），可让攻击者绕过「网络标记」（Mark of the Web）。网络标记是 Windows 给从互联网下载的文件打的标签，正是它提示 Defender SmartScreen 和 Office 受保护视图去限制自动执行。绕过它，就意味着恶意文件可以在没有常规警告的情况下启动。微软描述的攻击方式是：通过邮件或即时消息发送构造好的文件，说服用户主动操作——这是这类漏洞的标准投放路径。该漏洞由富士通、Anthropic 与一位独立研究者分别报告。CISA 于 10 月 13 日将其加入「已知被利用漏洞」目录，要求联邦机构在 10 月 16 日前完成处置。

# Cohorts are a classification you own, not a vendor feed. Keep the rules in a file.
import json
from collections import Counter

RULES = [
    ("filesystems, storage and backup", ["ntfs", "refs", "storage", "backup", "vss"]),
    ("graphics, media and content processing", ["gdi", "directwrite", "codec", "image", "media"]),
    ("office document and mail clients", ["outlook", "word", "excel", "office", "onenote"]),
    ("core and kernel privilege boundaries", ["kernel", "win32k", "ntoskrnl", "privilege"]),
    ("installation, deployment and update services", ["msi", "clickonce", "update", "installer"]),
    ("remote-access and RDP deployments", ["rdp", "rdp client", "remote desktop", "gateway"]),
    ("authentication, credentials and cryptography", ["kerberos", "schannel", "lsass", "credential"]),
    ("networking and protocol stack", ["tcp", "dns", "dhcp", "tls", "smb", "http.sys"]),
]

def cohort(title, summary):
    text = (title + " " + summary).lower()
    hits = [name for name, words in RULES if any(w in text for w in words)]
    return hits[0] if hits else "unclassified"

month = [
    {"id": "CVE-2026-96951", "title": "Windows Shell Security Feature Bypass",
     "summary": "attacker evades mark of the web protections"},
    {"id": "CVE-2026-108398", "title": "Windows Defender Application Control Bypass",
     "summary": "wdac enforcement bypass"},
    {"id": "CVE-2026-92707", "title": "MessagePack-CSharp Denial of Service",
     "summary": "developer tools and .net library"},
]

counts = Counter(cohort(c["title"], c["summary"]) for c in month)
for name, n in counts.most_common():
    print(n, name)

# On the real release you feed 1,413 rows through this and get a work plan,
# not 1,413 individual decisions.

1,413 条 CVE 最需要的不是决心，而是容量

为什么队列突然爆炸

这波暴涨被主要归因于「用 AI 在自家代码里发现漏洞」——这项能力让攻击者变快，如今也让补丁发布变大。独立追踪的月度节奏同样刺眼：据 ThreatDown 统计，2026 年 9 月补丁日前后厂商共处置了 998 个 CVE，而去年同期是 96 个。这次发布里还有两条是「先公开、后修复」：CVE-2026-108398 可绕过 Windows Defender 应用程序控制（WDAC）的强制执行；CVE-2026-92707 是 Visual Studio 与 .NET 所用 MessagePack-CSharp 组件中的拒绝服务漏洞。预公开场景下没有补丁可打，只能靠你自己的检测顶住。

# A cohort is only useful if you can answer its shared question from your inventory.
import json

CMDB = {
    "fields": ["os_build", "installed_software", "internet_facing", "backup_agent",
               "rdp_roles", "browser_used_by_staff", "delivery_mechanism"],
}

COHORT_QUESTIONS = {
    "graphics, media and content processing":
        "internet_facing",
    "office document and mail clients":
        "delivery_mechanism",
    "remote-access and RDP deployments":
        "rdp_roles",
    "filesystems, storage and backup":
        "backup_agent",
}

def coverage(cmdb, questions):
    report = {}
    for cohort, field in questions.items():
        report[cohort] = "answerable" if field in cmdb["fields"] else "MISSING FIELD: " + field
    return report

for k, v in coverage(CMDB, COHORT_QUESTIONS).items():
    print(("OK   " if v == "answerable" else "GAP  ") + k + " -> " + v)

# The gap lines are the actual output of this exercise: they are the fields
# you cannot answer, which means those cohorts cannot be triaged at all.

风险分组：这次发布里最有用的部分

微软引入了「风险分组」（risk cohorts）：把需要同类客户评估的 CVE 归到一组。分组不是根因，也不是严重性区间；组内成员共享的是「一个关于你环境的问题」。给出的示例还带了数量：Windows 文件系统、存储与备份 136 个；Office 文档与邮件客户端 135 个；图形、媒体与内容处理 131 个；核心与内核权限边界 109 个；安装、部署与更新服务 103 个；设备与外设接口 76 个；DNS 与地址基础设施 76 个；远程访问与 RDP 部署 65 个；身份认证与加密 61 个；网络与协议栈 53 个；虚拟化与容器主机 45 个；文件共享 39 个；终端管理与安全控件 38 个；Web、RPC 与消息服务 27 个。微软特别强调这些是探索性的，不是官方分类，也不会改变更新指引。

# Mark of the Web is the control CVE-2026-96951 defeats. Verify it is still enforced.
# PowerShell, on a representative endpoint.
$zone = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap"

# 1. Zone 3 (Internet) files should be tagged and warned about on open.
Get-ItemProperty -Path $zone -Name "*" |
  Where-Object { $_.PSObject.Properties.Name -notlike "PS*" } |
  Select-Object -First 15

# 2. Confirm Attachment Manager policy is not silently relaxing the warning.
$am = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments"
if (Test-Path $am) { Get-ItemProperty $am } else { "no Attachment Manager policy set" }

# 3. Confirm the October cumulative update for this build is installed.
Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-14) } |
  Select-Object HotFixID, InstalledOn | Format-Table -AutoSize

# A bypass is only exploitable if the file arrives already de-tagged.
# If MoTW is disabled by policy anywhere, that host belongs at the front of the wave.

按「共享问题」分组，而不是按 CVSS 分数排序

一天之内怎么跑起来

顺着这套东西落下来的流程很短。第一步，先把「已知被利用漏洞」目录里的条目全部筛出来并优先处理，因为在野利用本身就已经回答了优先级问题。第二步，挑出那些「你手里的资产清单能回答其共享问题」的分组，并且只回答一次：哪些资产会处理不受信任的媒体、哪些承担 RDP 角色、哪些在备份未被校验的数据。第三步，把答不上来的分组反过来当成清单缺口——你答不上来的分组，也是你无法诚实地把它降级的那个分组。第四步，按分组而不是按产品排期，让一个维护窗口覆盖一组「有共同理由一起打补丁」的机器。整套动作按月循环，补丁日就不再是一个事件。

# Finally: turn the queue into waves, constrained by the people who can test it.
import math

COHORTS = [
    ("exploited in the wild", 1, 4),
    ("remote-access and RDP deployments", 65, 8),
    ("office document and mail clients", 135, 12),
    ("graphics, media and content processing", 131, 10),
    ("core and kernel privilege boundaries", 109, 16),
    ("filesystems, storage and backup", 136, 16),
]

def plan(cohorts, testers=3, cves_per_tester_day=6, window_days=14, paused_services=2):
    capacity = testers * cves_per_tester_day * window_days
    capacity //= paused_services
    total = sum(cves for _, cves, _ in cohorts)
    waves, remaining = [], capacity
    for name, cves, _risk in cohorts:
        share = max(1, math.ceil(cves / total * capacity))
        waves.append((name, cves, share, "fits" if share <= remaining else "overflow"))
        remaining -= share
    return waves, capacity

waves, capacity = plan(COHORTS)
print("testing capacity this window:", capacity, "CVE-reviews")
for row in waves:
    print(row)

# 1,413 CVEs and 3 testers is a capacity problem, not a discipline problem.
# Publish the capacity number next to the cohort counts.

不要从这些数字里得出的结论

风险分组只是起点不是决定，微软自己也写明了：每个 CVE 仍需按活跃利用情况、严重性、攻击向量、用户交互与产品专属指引逐条复核。分组省掉的是重复的环境分析，而不是分析本身。还有两种常见误读值得提前挡住。第一，发布量大不等于产品变差了，它意味着「发现」变便宜了，对厂商也一样。第二，低 CVSS 分数不是「可以忽略」的理由：一个低危发现如果和你还没打的另一个发现串起来，就能变成一条完整的高危利用链——分诊要看可达影响，把分数当输入之一，而不是当判决。