Alongside October Patch Tuesday, MSRC published guidance that groups CVEs by shared deployment, exposure or trust-boundary questions, so one assessment covers many CVEs. MSRC is explicit that cohorts don't replace per-CVE assessment or change update guidance: exploitation status and severity still decide priority.