Microsoft's security release of 13 October 2026
Patch Tuesday, October 2026, page 2
As of , CISA lists one of the 1,407 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2026-96951, Windows Shell Security Feature Bypass.
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 101 | CVE-2026-77902Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 102 | CVE-2026-77910Microsoft Exchange Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 103 | CVE-2026-83520.NET Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 104 | CVE-2026-83523Windows Image Acquisition Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 105 | CVE-2026-83642Windows Domain Name Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 106 | CVE-2026-83643Windows Error Reporting Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 107 | CVE-2026-83688Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 108 | CVE-2026-83725Microsoft Windows Search Component Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 109 | CVE-2026-83759Windows Encrypting File System (EFS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 110 | CVE-2026-83771Windows Camera Frame Server Monitor Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 111 | CVE-2026-83777Windows Bluetooth Service Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 112 | CVE-2026-83778Microsoft Internet Messaging API Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 113 | CVE-2026-83784Windows Encrypting File System (EFS) Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 114 | CVE-2026-83789Windows SMB Client Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 115 | CVE-2026-83797Windows Partition Management Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 116 | CVE-2026-83851Windows Partition Management Driver Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 117 | CVE-2026-83874Windows Event Tracing Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 118 | CVE-2026-83889Windows DNS Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 119 | CVE-2026-83891Microsoft Office Word Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 120 | CVE-2026-83923Microsoft OpenSSH for Windows Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 121 | CVE-2026-83928Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 122 | CVE-2026-83929Windows GDI Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 123 | CVE-2026-83934Windows GDI+ Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 124 | CVE-2026-85339Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 125 | CVE-2026-85363.NET Framework Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 126 | CVE-2026-85817Microsoft PowerShell Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 127 | CVE-2026-85903Windows Domain Name Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 128 | CVE-2026-85931Windows Distributed File System (DFS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 129 | CVE-2026-85936Windows Shell Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 130 | CVE-2026-87697.NET Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 131 | CVE-2026-88075Configuration Manager Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 132 | CVE-2026-88112Windows Domain Name Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 133 | CVE-2026-88114Windows Domain Name Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 134 | CVE-2026-88115Windows Server for NFS Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 135 | CVE-2026-88116Windows Domain Name Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 136 | CVE-2026-88136Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 137 | CVE-2026-88142Windows Background Intelligent Transfer Service (BITS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 138 | CVE-2026-88144Microsoft Office PowerPoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 139 | CVE-2026-88145Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 140 | CVE-2026-88150Microsoft Office Word Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 141 | CVE-2026-88155Microsoft Office SharePoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 142 | CVE-2026-88157Microsoft OpenSSH for Windows Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 143 | CVE-2026-88159Windows Background Intelligent Transfer Service (BITS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 144 | CVE-2026-88163Microsoft Office SharePoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 145 | CVE-2026-88165Windows Active Directory Domain Services Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 146 | CVE-2026-88166Microsoft Office SharePoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 147 | CVE-2026-88186Microsoft Office Word Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 148 | CVE-2026-88196Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 149 | CVE-2026-88197Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 150 | CVE-2026-88198Microsoft Office SharePoint Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 151 | CVE-2026-88200Microsoft Office SharePoint Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 152 | CVE-2026-88202Microsoft Office Word Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 153 | CVE-2026-88219RPC Runtime Library Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 154 | CVE-2026-96044Microsoft Office SharePoint Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 155 | CVE-2026-96202Windows Raw Image Extension Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 156 | CVE-2026-96224.NET Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 157 | CVE-2026-96230ASP.NET Core Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 158 | CVE-2026-96235.NET Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 159 | CVE-2026-96251Microsoft PowerShell Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 160 | CVE-2026-96943Windows Raw Image Extension Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 161 | CVE-2026-96952Microsoft Windows Media Foundation Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 162 | CVE-2026-97003Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 163 | CVE-2026-97004Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 164 | CVE-2026-97007Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 165 | CVE-2026-97008Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 166 | CVE-2026-97010Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 167 | CVE-2026-97011Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 168 | CVE-2026-97012Microsoft Office Outlook Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 169 | CVE-2026-97017Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 170 | CVE-2026-97738Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 171 | CVE-2026-97739Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 172 | CVE-2026-97741Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 173 | CVE-2026-97742Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 174 | CVE-2026-97745Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 175 | CVE-2026-97746Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 176 | CVE-2026-97747Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 177 | CVE-2026-97748Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 178 | CVE-2026-97750Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 179 | CVE-2026-97751Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 180 | CVE-2026-97752Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 181 | CVE-2026-97753Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 182 | CVE-2026-97754Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 183 | CVE-2026-97755Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 184 | CVE-2026-97756Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 185 | CVE-2026-97757Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 186 | CVE-2026-97758Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 187 | CVE-2026-97759Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 188 | CVE-2026-97761Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 189 | CVE-2026-97762Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 190 | CVE-2026-97763Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 191 | CVE-2026-97765Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 192 | CVE-2026-97766Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 193 | CVE-2026-97767Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 194 | CVE-2026-97768Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 195 | CVE-2026-97769Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 196 | CVE-2026-97770Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 197 | CVE-2026-97771Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 198 | CVE-2026-97772Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 199 | CVE-2026-97773Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 200 | CVE-2026-97775Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |