Microsoft's security release of 13 October 2026
Patch Tuesday, October 2026, page 4
As of , CISA lists one of the 1,407 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2026-96951, Windows Shell Security Feature Bypass.
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 301 | CVE-2026-69995Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 302 | CVE-2026-69996Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 303 | CVE-2026-69997Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 304 | CVE-2026-69998Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 305 | CVE-2026-70004Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 306 | CVE-2026-70006Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 307 | CVE-2026-70012Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 308 | CVE-2026-70014Windows Cryptographic Services Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 309 | CVE-2026-70031Windows iSCSI Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 310 | CVE-2026-70033Windows Remote Desktop Gateway (RD Gateway) Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 311 | CVE-2026-70058Windows DHCP Server Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 312 | CVE-2026-70079Windows DNS Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 313 | CVE-2026-70082Windows DNS Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 314 | CVE-2026-70095Windows iSCSI Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 315 | CVE-2026-70133Windows SMB Server Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 316 | CVE-2026-70155Windows DNS Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 317 | CVE-2026-70159ASP.NET Core Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 318 | CVE-2026-70163Microsoft OpenSSH for Windows Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 319 | CVE-2026-70179ASP.NET Core Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 320 | CVE-2026-70181ASP.NET Core Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 321 | CVE-2026-70186ASP.NET Core Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 322 | CVE-2026-70202Microsoft Office SharePoint Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 323 | CVE-2026-70207Network Policy Server (NPS) Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 324 | CVE-2026-70251Microsoft Office SharePoint Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 325 | CVE-2026-70281Microsoft Office Outlook Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 326 | CVE-2026-83516Windows Local Security Authority Subsystem Service (LSASS) Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 327 | CVE-2026-83635Role: DNS Server Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 328 | CVE-2026-83645Active Directory Federation Services (AD FS) Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 329 | CVE-2026-83647Windows Active Directory Domain Services Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 330 | CVE-2026-83655Network Policy Server (NPS) Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 331 | CVE-2026-83665Windows DHCP Server Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 332 | CVE-2026-83670Function Discovery Service (fdwsd.dll) Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 333 | CVE-2026-83677Windows DHCP Client Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 334 | CVE-2026-83754Microsoft OpenSSH for Windows Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 335 | CVE-2026-83795Windows Internet Key Exchange (IKE) Extension Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 336 | CVE-2026-83843Windows Internet Key Exchange (IKE) Extension Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 337 | CVE-2026-83855Windows WLAN Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 338 | CVE-2026-83856Windows Event Logging Service Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 339 | CVE-2026-83860Windows GDI Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 340 | CVE-2026-84008.NET Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 341 | CVE-2026-84017Windows Routing and Remote Access Service (RRAS) Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 342 | CVE-2026-85319Active Directory Federation Services (AD FS) Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 343 | CVE-2026-85321Active Directory Federation Services (AD FS) Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 344 | CVE-2026-85322Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 345 | CVE-2026-85324Active Directory Federation Services (AD FS) Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 346 | CVE-2026-85334Windows Message Queuing Queue Manager Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 347 | CVE-2026-85353Windows Print Spooler Components Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 348 | CVE-2026-85808Windows Routing and Remote Access Service (RRAS) Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 349 | CVE-2026-85891Azure HDInsight Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 350 | CVE-2026-87716Windows Storage Spaces Controller Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 351 | CVE-2026-88206Microsoft Office SharePoint Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 352 | CVE-2026-96071Windows Media Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 353 | CVE-2026-96232.NET Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 354 | CVE-2026-96233ASP.NET Core Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 355 | CVE-2026-96236ASP.NET Core Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 356 | CVE-2026-96237.NET Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 357 | CVE-2026-96245Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 358 | CVE-2026-96246Network Policy Server (NPS) Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 359 | CVE-2026-96248Windows Host Guardian Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 360 | CVE-2026-96325Windows SMB Server Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 361 | CVE-2026-96861Network Device Enrollment Service (NDES) Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 362 | CVE-2026-96866Network Device Enrollment Service (NDES) Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 363 | CVE-2026-96945Windows Failover Cluster Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 364 | CVE-2026-96958.NET Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 365 | CVE-2026-96959.NET Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 366 | CVE-2026-96960.NET Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 367 | CVE-2026-97788Active Directory Federation Services (AD FS) Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 368 | CVE-2026-97789Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 369 | CVE-2026-97801.NET Framework Tampering | None | Not on CISA's list | 7.5 High | 0.01 |
| 370 | CVE-2026-97830Windows Internet Information Services Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 371 | CVE-2026-102192Windows Failover Cluster Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 372 | CVE-2026-103558Windows Routing and Remote Access Service (RRAS) Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 373 | CVE-2026-103569Windows IKE Extension Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 374 | CVE-2026-103577Microsoft QUIC Security Feature Bypass | None | Not on CISA's list | 7.5 High | 0.01 |
| 375 | CVE-2026-105592Microsoft Office Access Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 376 | CVE-2026-105599Microsoft Office PowerPoint Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 377 | CVE-2026-105714Microsoft Office Access Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 378 | CVE-2026-105715Microsoft Office Word Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 379 | CVE-2026-105723Windows Distributed File System (DFS) Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 380 | CVE-2026-105728Dynamics Business Central Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 381 | CVE-2026-108131Active Directory Federation Services (AD FS) Spoofing | None | Not on CISA's list | 7.5 High | 0.01 |
| 382 | CVE-2026-83511Active Directory Federation Services (AD FS) Spoofing | None | Not on CISA's list | 7.4 High | 0.01 |
| 383 | CVE-2026-85922Azure Key Vault Security Feature Bypass | None | Not on CISA's list | 7.4 High | 0.01 |
| 384 | CVE-2026-96222Active Directory Federation Services (AD FS) Spoofing | None | Not on CISA's list | 7.4 High | 0.01 |
| 385 | CVE-2026-102234Visual Studio Code Security Feature Bypass | None | Not on CISA's list | 7.4 High | 0.01 |
| 386 | CVE-2026-105013Microsoft Office SharePoint Remote Code Execution | None | Not on CISA's list | 7.4 High | 0.01 |
| 387 | CVE-2026-88204Microsoft Office SharePoint Spoofing | Not assessed | Not on CISA's list | 7.3 High | 0.01 |
| 388 | CVE-2026-70267Microsoft Office SharePoint Remote Code Execution | None | Not on CISA's list | 7.2 High | 0.01 |
| 389 | CVE-2026-85798Windows Distributed File System (DFS) Remote Code Execution | None | Not on CISA's list | 7.2 High | 0.01 |
| 390 | CVE-2026-69452Windows Enterprise App Management Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 391 | CVE-2026-97782Microsoft Office SharePoint Tampering | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 392 | CVE-2026-102229Visual Studio Code Information Disclosure | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 393 | CVE-2026-85841Windows DHCP Server Remote Code Execution | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 394 | CVE-2026-67626Microsoft SQL Server Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 395 | CVE-2026-69922Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 396 | CVE-2026-69940Windows Client for NFS Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 397 | CVE-2026-69955Windows Client for NFS Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 398 | CVE-2026-69968Windows libarchive Tampering | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 399 | CVE-2026-69973Windows libarchive Tampering | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 400 | CVE-2026-70072Windows Netlogon Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |