October 2026 Patch Tuesday
Microsoft's October 2026 security release, released Oct 13, 2026: every CVE with its severity, CVSS score, fixing KBs and whether it is exploited in the wild, cross-checked against the CISA KEV catalog. Rebuilt from the MSRC API every week, so later revisions show up here too.
- 1,456Microsoft CVEs
- 1Exploited (MSRC or CISA KEV)
- 1Publicly disclosed
- 88Critical
- 249Chromium CVEs for Edge
Patch these first
Exploited or in CISA KEV, then publicly disclosed, then Critical with CVSS 9 or higher.
| CVE | Vulnerability | Severity | CVSS | Status |
|---|---|---|---|---|
| CVE-2026-96951 | Windows Shell Security Feature Bypass Vulnerability | Important | 8.8 | Exploited KEV, due 2026-10-16 |
| CVE-2026-108398 | .NET Framework Security Feature Bypass Vulnerability | Important | 8.8 | Disclosed |
| CVE-2026-96207 | Microsoft Partner Center Elevation of Privilege Vulnerability | Critical | 10 | |
| CVE-2026-94510 | Microsoft Bookings Elevation of Privilege Vulnerability | Critical | 9.9 | |
| CVE-2026-100202 | Windows Message Queuing Queue Manager Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-100219 | Microsoft QUIC Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-105016 | Microsoft QUIC Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-70147 | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-70153 | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-70242 | Microsoft Office Outlook Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-70291 | Microsoft Office Outlook Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-70300 | Microsoft Office Word Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-77900 | Azure App Service Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-88131 | Microsoft Dataverse Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-88156 | Microsoft Office Outlook Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-88178 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-96934 | Windows DHCP Server Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-97016 | Microsoft Office Outlook Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-97749 | Microsoft Office Outlook Remote Code Execution Vulnerability | Critical | 9.8 | |
| CVE-2026-97814 | Windows Text Shaping Remote Code Execution Vulnerability | Critical | 9.8 |
By product
Every CVE
Loading the full list…
| CVE | Vulnerability | Severity | CVSS | Status | KBs |
|---|
About this data
From Microsoft's CVRF document for October 2026 (last revised Oct 20, 2026), rebuilt Oct 20, 2026. KEV status from the CISA catalog as of Oct 20, 2026. Third-party open-source CVEs that ship only in Azure Linux are left out. Always confirm against the MSRC entry before acting. Download the raw JSON.