Microsoft's security release of 13 October 2026
Patch Tuesday, October 2026, page 15
As of , CISA lists one of the 1,407 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2026-96951, Windows Shell Security Feature Bypass.
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1401 | CVE-2026-70075Windows Virtualization-Based Security (VBS) Enclave Security Feature Bypass | None | Not on CISA's list | 4.4 Medium | 0.00 |
| 1402 | CVE-2026-70280Windows Hello Security Feature Bypass | Not assessed | Not on CISA's list | 4.4 Medium | 0.00 |
| 1403 | CVE-2026-83926Windows Hello Security Feature Bypass | None | Not on CISA's list | 4.4 Medium | 0.00 |
| 1404 | CVE-2026-102221Secure Boot Security Feature Bypass | None | Not on CISA's list | 4.4 Medium | 0.00 |
| 1405 | CVE-2026-105720Microsoft Office SharePoint Elevation of Privilege | None | Not on CISA's list | 4.3 Medium | 0.00 |
| 1406 | CVE-2026-70116Windows Resilient File System (ReFS) Security Feature Bypass | None | Not on CISA's list | 4.2 Medium | 0.00 |
| 1407 | CVE-2026-83766Windows Hyper-V Security Feature Bypass | None | Not on CISA's list | 4.2 Medium | 0.00 |