Patch Tuesday Just Hit 1,411 Flaws. Coalition Bets On A Handful Of Alerts.

Estimated reading time: 8 minutes

Microsoft fixed 1,411 flaws this week, its fourth record release in five months. Cyber insurer Coalition says it sent 49 zero-day alerts in the three months to 1 August, and most policyholders got none. Its picks show how vulnerability prioritization works, and what an insurer’s alerts can’t see.

Microsoft fixed 1,411 security flaws on 13 October, BleepingComputer counted. It rated 70 critical, and attackers were already exploiting one. It was the fourth record-breaking Patch Tuesday in five months.

By BleepingComputer’s count, June set the first record at 200, passing the previous high of 177 that Trend Micro’s Zero Day Initiative recorded in 2025. July reached 570, August eased to 400, and September hit 966. Before the surge, Microsoft typically shipped about 100 fixes a month, Coalition says.

Counts vary by tracker. BleepingComputer counts only flaws Microsoft releases on Patch Tuesday itself. In October, that left out 348 flaws fixed earlier in the month. Tenable’s counts run slightly lower: 198 in June, 569 in July and 1,407 in October.

CINI glossary: Patch Tuesday is the second Tuesday of each month, when Microsoft releases security fixes for its products. Each flaw gets a public tracking number called a CVE (Common Vulnerabilities and Exposures) ID.

Microsoft points to AI. In May, it said its engineers had used an internal AI system, codenamed MDASH, to find 16 of that month’s flaws. In July, it told customers to expect more security updates in each release. Britain’s National Cyber Security Centre has warned organizations to prepare for a wave of urgent updates.

Exploit-writing is speeding up too. Anthropic’s Mythos Preview model can build working exploits for newly disclosed flaws in hours, Axios reported in June. Coalition’s post says warnings of a “vulnpocalypse” now crowd conference agendas and headlines.

Vulnerability Prioritization At A Cyber Insurer

Coalition sells cyber insurance and Coalition Control, a risk management platform. It scans policyholders’ internet-facing systems. When a serious flaw appears, it emails the policyholders whose systems look exposed. It calls these Zero-Day Alerts.

Coalition sent 49 between 1 May and 1 August, it said in a 14 October blog post by Ryan Chadwick. That window closed before the September and October releases. Ninety-four percent of policyholders received none. Of those who did, 91% received just one.

Coalition says its alert count has risen every quarter, with a sharp jump this year. Coalition did not say how many it sent in earlier quarters, so the 49 has no baseline.

The 94% also reflects what Coalition’s scans can see. Many small firms run little that faces the internet. Coalition also scans each applicant when it quotes, and it typically requires critical findings to be fixed before a policy starts. So some exposures are fixed before cover begins.

Coalition argues “the vulnerability surge is manageable.” Its case for vulnerability prioritization is that teams should stop chasing hundreds of flaws labeled critical. They should fix the few attackers actually use.

To back the point, Coalition cites Root Evidence, which found that from 2018 to 2025, fewer than 2.2% of newly published flaws had confirmed exploitation, even as annual volume grew 2.5 times. Two caveats apply. A steady share of a growing pile means the number of exploited flaws grew too. And the data stops at 2025, before the surge in AI-found flaws and faster exploit-writing described above.

Microsoft has started offering its own help. With the October release, it grouped related flaws into 15 “risk cohorts,” BleepingComputer reported. The largest held 136 flaws in Windows filesystems, storage and backup. The cohorts sort flaws by the part of the system they affect. Microsoft says they do not necessarily show which flaws are most dangerous. It calls the approach experimental.

What Coalition’s Zero-Day Alerts Flagged In July

On July’s Patch Tuesday, Coalition sent two alerts covering four flaws. Tenable counted 569 flaws that day, and Microsoft rated 56 of them critical. Of the four Coalition flagged, three were in SharePoint Server and one was in Windows Message Queuing. Only two carried Microsoft’s critical rating.

Microsoft rated one SharePoint flaw, CVE-2026-56164, “moderate,” its second-lowest severity tier, with a severity score of 5.3 out of 10. Attackers were already exploiting it. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog the same day. The National Vulnerability Database later scored it 9.8.

That means any security team watching CISA’s free catalog got the same signal that day. Coalition’s stronger case lies in the flaw it paired with. CVE-2026-56164 grants the Site Owner privileges that a second, critical SharePoint flaw, CVE-2026-58644, needs to run code remotely. Together, they form a chain. Coalition says CISA added CVE-2026-58644 to its catalog two days later.

Chaining flaws “was once labor intensive for attackers,” Coalition writes. AI agents now automate it, it says.

July’s release also held a second exploited flaw, CVE-2026-56155, in Active Directory Federation Services, a Microsoft sign-in service that is often reachable from the internet. Coalition’s post lists no alert for it, and Coalition did not say why.

Zero-Day Alerts And Small Businesses

Fifty-nine percent of the policyholders Coalition alerted have fewer than 25 employees. For small firms, a Patch Tuesday of nearly 600 flaws “could present a month-long challenge,” Coalition says.

The raw count overstates that job. For a firm whose computers install Microsoft’s monthly update automatically, 1,411 fixes arrive the same way 100 did. The harder cases are servers a firm runs itself, such as SharePoint, and that is where Coalition’s alerts point.

Coalition did not say what share of all its policyholders have fewer than 25 employees. Without that figure, the 59% cannot show whether small firms are more exposed than larger ones.

Where Vulnerability Prioritization Stops

Coalition says its alerts supplement a policyholder’s own patching. Three limits explain why.

The first is visibility. Coalition “regularly scans the external footprint of policyholders,” its help pages say. A flaw on an internal server sits outside that view.

The second is timing. CVE-2026-56164 was under attack before Microsoft shipped a fix. Mandiant’s M-Trends 2026 put the mean time to exploit at minus seven days in 2025. On average, attackers moved before a patch existed, as Cyber Insurance News reported.

The third is follow-through. Coalition did not say how many alerted policyholders patched, whether alerts reduced claims, or whether ignoring an alert affects cover. Its help pages say scan findings do not change a policyholder’s terms during the policy period, though fixing them helps at renewal. They do not say whether that applies to Zero-Day Alerts. The post’s disclaimer says nothing in it changes or forms part of any policy, and that the alerts do not replace a policyholder’s own patching.

Some carriers have written that question into their wording. Chubb’s Neglected Software Exploit endorsement gives policyholders a 45-day grace period. After that, a growing share of the risk shifts to them, as Cyber Insurance News reported.

Outside-in scanning shows what changes between renewals. Andrew Horkan of Cyber Tzar made that case on the Cyber Insurance News podcast. A company can be compliant in May and exposed in June.

Censys data reported this week shows how patching behaves without a push. Before late October 2024, a median 1.9% of returning Cleo file-transfer servers upgraded each month. A critical flaw’s disclosure pushed that rate to 38.4%. After a second fix and reports of active exploitation, 63% upgraded by January 2025.

Coalition’s 49 alerts show where an insurer chose to look. The next number worth publishing is how many policyholders acted on them.

FAQ – Vulnerability Prioritization

What are Coalition’s Zero-Day Alerts?

Emails Coalition sends to policyholders when a serious new flaw affects systems its scans can see from the internet. Each alert includes steps to fix it.

How many Zero-Day Alerts did Coalition send?

Coalition sent 49 between 1 May and 1 August 2026. It says 94% of policyholders received none.

How big is Patch Tuesday now?

Microsoft fixed 1,411 flaws on 13 October 2026, by BleepingComputer’s count. July’s release, the subject of Coalition’s alerts, fixed 569 by Tenable’s count and 570 by BleepingComputer’s.

Why did Coalition flag a flaw Microsoft rated moderate?

The SharePoint flaw CVE-2026-56164 was already being exploited, and the US Cybersecurity and Infrastructure Security Agency listed it as exploited the same day. It also grants privileges that a second, critical flaw needs, so the two can be chained.

Do Zero-Day Alerts replace patching?

No. Coalition says the alerts supplement a policyholder’s own patching. They cover only what its external scans can see.

Why is Patch Tuesday getting bigger?

Microsoft says it is using AI to find flaws in its own code, and it has told customers to expect more updates in each release.

Editorial note: 17 October 2026: An earlier version attributed the 2.2% exploitation figure to Coalition’s own data; it comes from Root Evidence, which Coalition cited. It also overstated Microsoft’s account of its MDASH system and mixed monthly counts from several trackers. The article now uses BleepingComputer’s counts and adds detail on Coalition’s alerts.

Related Cyber Insurance Posts

• Criminals Run AI On Stolen Keys. Some Insurers Now Cap The Bill
• Patch Management And Cyber Insurance: What The Adobe Reader Zero-Day Reveals(Opens in a new browser tab)
• Beazley Security Launches Exposure Management To Counter AI-Assisted Attack Risk(Opens in a new browser tab)
• The Video Wasn’t Fake. Nobody Could Prove What Happened to It. That’s a Cyber Insurance Problem.(Opens in a new browser tab)
• Black Kite 2026: Financial Services Faces A Two-Front Cyber Storm(Opens in a new browser tab)