Microsoft's security release of 13 October 2026
Patch Tuesday, October 2026, page 3
As of , CISA lists one of the 1,407 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2026-96951, Windows Shell Security Feature Bypass.
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 201 | CVE-2026-97776Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 202 | CVE-2026-97777Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 203 | CVE-2026-97778Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 204 | CVE-2026-97780Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 205 | CVE-2026-97781Microsoft Office OneNote Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 206 | CVE-2026-100209Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 207 | CVE-2026-100210Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 208 | CVE-2026-100211Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 209 | CVE-2026-100212Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 210 | CVE-2026-100220Windows Media Video Decoder Remote Code Execution | Not assessed | Not on CISA's list | 8.8 High | 0.01 |
| 211 | CVE-2026-102203RPC Runtime Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 212 | CVE-2026-102217WebDAV Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 213 | CVE-2026-102225Windows Text Shaping Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 214 | CVE-2026-102226Dynamics Business Central Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 215 | CVE-2026-102235Visual Studio Code Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 216 | CVE-2026-102849Microsoft Office Access Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 217 | CVE-2026-102850Microsoft Office Access Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 218 | CVE-2026-102855Microsoft Office Visio Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 219 | CVE-2026-102856Microsoft Office Visio Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 220 | CVE-2026-102857Microsoft Office Visio Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 221 | CVE-2026-102858Microsoft Office OneNote Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 222 | CVE-2026-102860Microsoft Office SharePoint Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 223 | CVE-2026-102861Microsoft Office SharePoint Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 224 | CVE-2026-102862Microsoft Office SharePoint Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 225 | CVE-2026-102863Microsoft Office SharePoint Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 226 | CVE-2026-102869.NET and Visual Studio Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 227 | CVE-2026-102870ASP.NET Core Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 228 | CVE-2026-103572Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 229 | CVE-2026-103575Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 230 | CVE-2026-105007Windows NDIS Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 231 | CVE-2026-105591Microsoft Office Access Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 232 | CVE-2026-105593Microsoft Office Access Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 233 | CVE-2026-105595Microsoft Office Access Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 234 | CVE-2026-105596Microsoft Office Access Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 235 | CVE-2026-105597Microsoft Office Access Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 236 | CVE-2026-105598Microsoft Office Access Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 237 | CVE-2026-105716Microsoft Office Access Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 238 | CVE-2026-105717Microsoft Office Access Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 239 | CVE-2026-105718Microsoft Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 240 | CVE-2026-105727Microsoft Dynamics 365 Business Central Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 241 | CVE-2026-108400HEVC Video Extensions Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 242 | CVE-2026-108458Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 243 | CVE-2026-108463Windows SmartScreen Security Feature Bypass | None | Not on CISA's list | 8.8 High | 0.01 |
| 244 | CVE-2026-108467Microsoft PostScript Printer Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 245 | CVE-2026-69802Network Device Enrollment Service (NDES) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 246 | CVE-2026-69913Windows TCP/IP Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 247 | CVE-2026-70013Windows iSCSI Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 248 | CVE-2026-70038Windows iSCSI Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 249 | CVE-2026-70062Windows libarchive Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 250 | CVE-2026-70111Windows Kernel Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.01 |
| 251 | CVE-2026-70127Windows Domain Name Service Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 252 | CVE-2026-70175ASP.NET Core Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.01 |
| 253 | CVE-2026-70187Windows Remote Desktop Services Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 254 | CVE-2026-70197.NET Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 255 | CVE-2026-70229Windows Active Directory Domain Services Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 256 | CVE-2026-70269Microsoft Office Word Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 257 | CVE-2026-70571Microsoft Exchange Server Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 258 | CVE-2026-83522Windows IKE Extension Spoofing | None | Not on CISA's list | 8.1 High | 0.01 |
| 259 | CVE-2026-83674Active Directory Federation Services (AD FS) Spoofing | None | Not on CISA's list | 8.1 High | 0.01 |
| 260 | CVE-2026-83746Skype for Business Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.01 |
| 261 | CVE-2026-83844Windows Paint Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 262 | CVE-2026-83914Microsoft XML Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 263 | CVE-2026-84012Windows Remote Desktop Services Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 264 | CVE-2026-85371Network Policy Server (NPS) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 265 | CVE-2026-85799Network Policy Server (NPS) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 266 | CVE-2026-85926Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 267 | CVE-2026-88094Azure Storage Library Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.01 |
| 268 | CVE-2026-88117Windows DHCP Server Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 269 | CVE-2026-88119Windows DHCP Server Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 270 | CVE-2026-88120Windows DHCP Server Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 271 | CVE-2026-88171Windows DHCP Server Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 272 | CVE-2026-88173Windows Background Intelligent Transfer Service (BITS) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 273 | CVE-2026-88185Microsoft Office Word Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 274 | CVE-2026-97783Microsoft Office SharePoint Spoofing | None | Not on CISA's list | 8.1 High | 0.01 |
| 275 | CVE-2026-100218Remote Desktop Gateway Service Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 276 | CVE-2026-102866Microsoft Office SharePoint Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.01 |
| 277 | CVE-2026-105005Windows Schannel Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 278 | CVE-2026-108457Microsoft Windows PDF Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 279 | CVE-2026-108460Windows Message Queuing Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 280 | CVE-2026-69363Windows Error Reporting Elevation of Privilege | None | Not on CISA's list | 8.0 High | 0.01 |
| 281 | CVE-2026-85881Microsoft Office Graphics Elevation of Privilege | None | Not on CISA's list | 8.0 High | 0.01 |
| 282 | CVE-2026-69718Windows Update Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 283 | CVE-2026-85359Windows Performance Monitor Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 284 | CVE-2026-85864Python Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 285 | CVE-2026-96220Windows Assigned Access Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 286 | CVE-2026-97798Windows Error Reporting Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 287 | CVE-2026-85888Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 7.7 High | 0.01 |
| 288 | CVE-2026-88081Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 7.7 High | 0.01 |
| 289 | CVE-2026-58280.NET Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 290 | CVE-2026-69454Microsoft Azure Attestation service and Device Health Attestation Service Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 291 | CVE-2026-69577Microsoft Azure Attestation service and Device Health Attestation Service Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 292 | CVE-2026-69651.NET Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 293 | CVE-2026-69976Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 294 | CVE-2026-69984Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 295 | CVE-2026-69986Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 296 | CVE-2026-69987Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 297 | CVE-2026-69988Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 298 | CVE-2026-69991Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 299 | CVE-2026-69992Remote Desktop Services Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 300 | CVE-2026-69994Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |