Microsoft's security release of 13 October 2026
Patch Tuesday, October 2026
As of , CISA lists one of the 1,407 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2026-96951, Windows Shell Security Feature Bypass.
On CISA's list of exploited vulnerabilities
- CVE-2026-96951Windows Shell Security Feature Bypass. Listed by CISA on 13 October 2026, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 1,407 CVEs |
| On CISA's list of exploited vulnerabilities | 1 CVE |
| CISA's SSVC exploitation: active | none |
| CISA's SSVC exploitation: proof of concept | none |
| CISA's SSVC exploitation: none | 1,390 CVEs |
| Not assessed by CISA's SSVC | 17 CVEs |
| Critical by CVSS (9.0 or more) | 61 CVEs |
| EPSS 0.10 or more | none |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2026-96951Windows Shell Security Feature Bypass | None | Patch nowListed | 8.8 High | 0.02 |
| 2 | CVE-2026-85900Microsoft Office SharePoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 3 | CVE-2026-100214Microsoft Dynamics 365 Business Central Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 4 | CVE-2026-70049Microsoft Configuration Manager Elevation of Privilege | None | Not on CISA's list | 8.0 High | 0.02 |
| 5 | CVE-2026-87692Microsoft Exchange Server Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.02 |
| 6 | CVE-2026-88091Windows Management Instrumentation Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.02 |
| 7 | CVE-2026-96186Microsoft Windows Media Foundation Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.02 |
| 8 | CVE-2026-69634Windows iSCSI Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 9 | CVE-2026-69639Windows libarchive Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 10 | CVE-2026-69705Windows iSCSI Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 11 | CVE-2026-69883Windows iSCSI Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 12 | CVE-2026-69886Windows Imaging Component Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 13 | CVE-2026-70024Windows Internet Information Services Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 14 | CVE-2026-70096Windows Rich Text Edit Control Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 15 | CVE-2026-70147Microsoft PostScript Printer Driver Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 16 | CVE-2026-70153Microsoft PostScript Printer Driver Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 17 | CVE-2026-70157Windows System Information Console Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 18 | CVE-2026-70242Microsoft Office Outlook Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 19 | CVE-2026-70291Microsoft Office Outlook Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 20 | CVE-2026-70300Microsoft Office Word Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 21 | CVE-2026-83517Microsoft Windows Media Foundation Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 22 | CVE-2026-83519Windows Error Reporting Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 23 | CVE-2026-83578Microsoft PowerShell Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 24 | CVE-2026-83693Windows Error Reporting Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 25 | CVE-2026-83748Windows Error Reporting Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 26 | CVE-2026-83770Windows Text Shaping Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 27 | CVE-2026-83780Windows CCFFilter Driver Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 28 | CVE-2026-83782Windows Shell Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 29 | CVE-2026-83862Windows Network Load Balancing Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 30 | CVE-2026-83869Windows Domain Name Service Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 31 | CVE-2026-83910RPC Runtime Library Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 32 | CVE-2026-83935Microsoft XML Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 33 | CVE-2026-84015Remote Access Point-to-Point Protocol (PPP) EAP-TLS Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 34 | CVE-2026-85792Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 35 | CVE-2026-85806Network Policy Server (NPS) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 36 | CVE-2026-85809Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 37 | CVE-2026-85814Microsoft Windows Media Foundation Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 38 | CVE-2026-85928Windows Volume Manager Extension Driver Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 39 | CVE-2026-88102Microsoft Failover Cluster Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 40 | CVE-2026-88156Microsoft Office Outlook Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 41 | CVE-2026-88178Microsoft Office PowerPoint Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 42 | CVE-2026-96096Windows Media Player Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 43 | CVE-2026-96113Windows Domain Name Service Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 44 | CVE-2026-96219Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 45 | CVE-2026-96320Windows DHCP Server Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 46 | CVE-2026-96864Microsoft Failover Cluster Virtual Driver Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 47 | CVE-2026-96909Windows BitLocker Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 48 | CVE-2026-96924Windows OLE Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 49 | CVE-2026-96934Windows DHCP Server Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 50 | CVE-2026-97016Microsoft Office Outlook Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 51 | CVE-2026-97749Microsoft Office Outlook Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 52 | CVE-2026-97805Windows Partition Management Driver Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 53 | CVE-2026-97814Windows Text Shaping Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 54 | CVE-2026-97815Windows Error Reporting Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 55 | CVE-2026-97816Microsoft OpenSSH for Windows Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 56 | CVE-2026-100202Windows Message Queuing Queue Manager Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 57 | CVE-2026-100219Microsoft QUIC Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 58 | CVE-2026-100222Network Policy Server (NPS) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 59 | CVE-2026-102210Windows Text Shaping Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 60 | CVE-2026-105010Microsoft Windows Search Component Elevation of Privilege | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 61 | CVE-2026-105016Microsoft QUIC Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 62 | CVE-2026-102238Visual Studio Code Remote Code Execution | None | Not on CISA's list | 9.6 Critical | 0.01 |
| 63 | CVE-2026-88092ASP.NET Core Tampering | None | Not on CISA's list | 9.4 Critical | 0.01 |
| 64 | CVE-2026-70279Microsoft Exchange Server Spoofing | None | Not on CISA's list | 9.3 Critical | 0.01 |
| 65 | CVE-2026-70188ASP.NET Core Security Feature Bypass | None | Not on CISA's list | 9.1 Critical | 0.01 |
| 66 | CVE-2026-105008Windows Schannel Spoofing | None | Not on CISA's list | 9.0 Critical | 0.01 |
| 67 | CVE-2026-65674Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 68 | CVE-2026-69326Graphic Fonts Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 69 | CVE-2026-69370Visual Studio Code Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 70 | CVE-2026-69521Windows iSCSI Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 71 | CVE-2026-69765Windows Storport Miniport Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 72 | CVE-2026-69943Microsoft Office SharePoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 73 | CVE-2026-69985Windows libarchive Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 74 | CVE-2026-70007.NET Framework Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 75 | CVE-2026-70035.NET Framework Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 76 | CVE-2026-70068Windows Client-Side Caching (CSC) Service Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 77 | CVE-2026-70069Windows DHCP Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 78 | CVE-2026-70089Windows GDI Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 79 | CVE-2026-70149Windows Client Side Caching driver (csc.sys) Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 80 | CVE-2026-70158Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 81 | CVE-2026-70167Windows Domain Name Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 82 | CVE-2026-70174.NET Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 83 | CVE-2026-70210Windows OLE DB Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 84 | CVE-2026-70215Microsoft Office PowerPoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 85 | CVE-2026-70246Microsoft Office SharePoint Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 86 | CVE-2026-70254Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 87 | CVE-2026-70256Microsoft Office Outlook Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 88 | CVE-2026-70257Microsoft Office Outlook Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 89 | CVE-2026-70258Microsoft Windows Media Foundation Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 90 | CVE-2026-70262WebDAV Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 91 | CVE-2026-70266Microsoft Office SharePoint Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 92 | CVE-2026-70268Microsoft Office Word Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 93 | CVE-2026-70275Windows CD-ROM File System Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 94 | CVE-2026-70282Microsoft Office Outlook Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 95 | CVE-2026-70287Microsoft Office Word Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 96 | CVE-2026-70297Skype for Business Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 97 | CVE-2026-70301Microsoft Office Word Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 98 | CVE-2026-70302Microsoft Office Word Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 99 | CVE-2026-70343Microsoft MPEG-2 Video Extension Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 100 | CVE-2026-77496Windows Imaging Component Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 13 October 2026, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.