Microsoft's security release of 13 October 2026
Patch Tuesday, October 2026, page 5
As of , CISA lists one of the 1,407 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2026-96951, Windows Shell Security Feature Bypass.
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 401 | CVE-2026-70119Windows DNS Remote Code Execution | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 402 | CVE-2026-70166Windows DNS Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 403 | CVE-2026-70170Windows Kernel Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 404 | CVE-2026-70206Microsoft Office Word Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 405 | CVE-2026-70219Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 406 | CVE-2026-70244Windows DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 407 | CVE-2026-70259Microsoft Office SharePoint Information Disclosure | Not assessed | Not on CISA's list | 6.5 Medium | 0.01 |
| 408 | CVE-2026-70263Microsoft Office Word Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 409 | CVE-2026-70298Microsoft Office SharePoint Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 410 | CVE-2026-83515RPC Runtime Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 411 | CVE-2026-83521Windows IKE Extension Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 412 | CVE-2026-83648Windows Active Directory Domain Services Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 413 | CVE-2026-83649Windows Local Security Authority Subsystem Service (LSASS) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 414 | CVE-2026-83651Windows GDI Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 415 | CVE-2026-83667Windows Active Directory Domain Services Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 416 | CVE-2026-83683Windows Encrypting File System (EFS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 417 | CVE-2026-83685Windows Internet Key Exchange (IKE) Extension Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 418 | CVE-2026-83703Windows Wi-Fi Driver Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 419 | CVE-2026-83888Windows CD-ROM Driver Elevation of Privilege | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 420 | CVE-2026-83906Windows Shell Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 421 | CVE-2026-84007Remote Desktop Gateway Service Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 422 | CVE-2026-85331Windows Device Association Service Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 423 | CVE-2026-85337Windows Remote Desktop Client Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 424 | CVE-2026-85797Windows GDI Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 425 | CVE-2026-85805Microsoft PowerShell Security Feature Bypass | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 426 | CVE-2026-85821Windows Universal Disk Format File System Driver (UDFS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 427 | CVE-2026-85840Windows Event Viewer Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 428 | CVE-2026-85847Windows Print Spooler Components Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 429 | CVE-2026-85859Windows Message Queuing Queue Manager Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 430 | CVE-2026-85873Skype for Business Elevation of Privilege | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 431 | CVE-2026-85932Microsoft Office SharePoint Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 432 | CVE-2026-88122Role: DNS Server Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 433 | CVE-2026-88123Role: DNS Server Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 434 | CVE-2026-88125Role: DNS Server Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 435 | CVE-2026-88129Role: DNS Server Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 436 | CVE-2026-88130Role: DNS Server Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 437 | CVE-2026-88137WebDAV Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 438 | CVE-2026-88151Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 439 | CVE-2026-88153Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 440 | CVE-2026-88154Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 441 | CVE-2026-88167Microsoft Office Word Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 442 | CVE-2026-88169Microsoft Office Word Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 443 | CVE-2026-88172Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 444 | CVE-2026-88175Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 445 | CVE-2026-88183Microsoft Office PowerPoint Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 446 | CVE-2026-88184Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 447 | CVE-2026-88190Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 448 | CVE-2026-88192Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 449 | CVE-2026-88195Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 450 | CVE-2026-88201Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 451 | CVE-2026-88203Microsoft Office PowerPoint Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 452 | CVE-2026-94506Microsoft Office Access Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 453 | CVE-2026-96204Azure Arc Elevation of Privilege | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 454 | CVE-2026-96229.NET Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 455 | CVE-2026-96303Microsoft PowerShell Security Feature Bypass | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 456 | CVE-2026-97740Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 457 | CVE-2026-97743Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 458 | CVE-2026-97760Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 459 | CVE-2026-97779Microsoft Office Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 460 | CVE-2026-97813Windows Hyper-V Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 461 | CVE-2026-97817Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 462 | CVE-2026-97819Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 463 | CVE-2026-97820Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 464 | CVE-2026-97821Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 465 | CVE-2026-97822Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 466 | CVE-2026-97823Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 467 | CVE-2026-97824Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 468 | CVE-2026-97825Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 469 | CVE-2026-97826Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 470 | CVE-2026-97827Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 471 | CVE-2026-97828Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 472 | CVE-2026-97829Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 473 | CVE-2026-97831Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 474 | CVE-2026-97832Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 475 | CVE-2026-97833Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 476 | CVE-2026-97834Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 477 | CVE-2026-97835Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 478 | CVE-2026-97836Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 479 | CVE-2026-97837Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 480 | CVE-2026-97838Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 481 | CVE-2026-97839Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 482 | CVE-2026-97840Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 483 | CVE-2026-97841Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 484 | CVE-2026-97842Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 485 | CVE-2026-97843Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 486 | CVE-2026-97844Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 487 | CVE-2026-102199Microsoft Windows Codecs Library Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 488 | CVE-2026-102865Microsoft Office SharePoint Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 489 | CVE-2026-102867Microsoft Office Word Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 490 | CVE-2026-103576Active Directory Federation Services (AD FS) Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 491 | CVE-2026-105719Microsoft SharePoint Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 492 | CVE-2026-108127Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 493 | CVE-2026-108128Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 494 | CVE-2026-108129Role: DNS Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 495 | CVE-2026-66822.NET Information Disclosure | None | Not on CISA's list | 5.9 Medium | 0.01 |
| 496 | CVE-2026-69982Active Directory Federation Services (AD FS) Security Feature Bypass | Not assessed | Not on CISA's list | 5.9 Medium | 0.01 |
| 497 | CVE-2026-70005Active Directory Federation Services (AD FS) Security Feature Bypass | Not assessed | Not on CISA's list | 5.9 Medium | 0.01 |
| 498 | CVE-2026-70162.NET Denial of Service | None | Not on CISA's list | 5.9 Medium | 0.01 |
| 499 | CVE-2026-70196ASP.NET Core Denial of Service | None | Not on CISA's list | 5.9 Medium | 0.01 |
| 500 | CVE-2026-85790Microsoft QUIC Information Disclosure | None | Not on CISA's list | 5.9 Medium | 0.01 |