Microsoft's security release of 13 October 2026
Patch Tuesday, October 2026, page 9
As of , CISA lists one of the 1,407 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2026-96951, Windows Shell Security Feature Bypass.
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 801 | CVE-2026-88072Windows Host Guardian Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 802 | CVE-2026-88074Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 803 | CVE-2026-88080Windows Installer Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 804 | CVE-2026-88093Desktop Window Manager Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 805 | CVE-2026-88100Windows Storage Spaces Controller Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 806 | CVE-2026-88101Microsoft Input Method Editor (IME) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 807 | CVE-2026-88105Windows Broadcast DVR User Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 808 | CVE-2026-88109Microsoft Office Click-To-Run Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 809 | CVE-2026-88118Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 810 | CVE-2026-88126WebDAV Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 811 | CVE-2026-88128Windows DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 812 | CVE-2026-88133Windows Portable Device Enumerator Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 813 | CVE-2026-88134Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 814 | CVE-2026-88135WebDAV Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 815 | CVE-2026-88147Windows Secure Socket Tunneling Protocol (SSTP) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 816 | CVE-2026-88152Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 817 | CVE-2026-88168Windows Bind Filter Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 818 | CVE-2026-88177Windows DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 819 | CVE-2026-88179Windows DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 820 | CVE-2026-88180Windows DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 821 | CVE-2026-88181Windows DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 822 | CVE-2026-88182Microsoft Windows Search Component Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 823 | CVE-2026-88188Windows DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 824 | CVE-2026-88189Windows DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 825 | CVE-2026-88191Microsoft Windows Search Component Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 826 | CVE-2026-88193Microsoft Scripting Engine Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 827 | CVE-2026-88194Windows DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 828 | CVE-2026-88210Microsoft Office Word Security Feature Bypass | None | Not on CISA's list | 7.8 High | 0.00 |
| 829 | CVE-2026-96108Desktop Window Manager Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 830 | CVE-2026-96118Windows Graphics Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 831 | CVE-2026-96217Windows NTFS Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 832 | CVE-2026-96223Windows Hyper-V Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 833 | CVE-2026-96225.NET Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 834 | CVE-2026-96231.NET Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 835 | CVE-2026-96243Windows WalletService Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 836 | CVE-2026-96244Windows Internal System User Profile Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 837 | CVE-2026-96249Windows Win32 Kernel Subsystem Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 838 | CVE-2026-96306Windows Sysmain Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 839 | CVE-2026-96308Windows Installer Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 840 | CVE-2026-96309Windows Subsystem for Linux Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 841 | CVE-2026-96312Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 842 | CVE-2026-96317Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 843 | CVE-2026-96318Windows Resume Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 844 | CVE-2026-96324Microsoft Windows Search Component Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 845 | CVE-2026-96843WebDAV Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 846 | CVE-2026-96847WebDAV Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 847 | CVE-2026-96856Windows Management Instrumentation Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 848 | CVE-2026-96862Windows Spaceport.sys Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 849 | CVE-2026-96867Windows NTFS Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 850 | CVE-2026-96911Microsoft Windows Search Component Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 851 | CVE-2026-96912Windows Client License Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 852 | CVE-2026-96915Windows Kernel-Mode Drivers Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 853 | CVE-2026-96916Windows NTFS Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 854 | CVE-2026-96918Windows NTFS Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 855 | CVE-2026-96920Windows Program Compatibility Assistant Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 856 | CVE-2026-96928Windows NTFS Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 857 | CVE-2026-96929Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 858 | CVE-2026-96931Windows NTFS Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 859 | CVE-2026-96933Windows COM+ Event System Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 860 | CVE-2026-96946Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 861 | CVE-2026-96947Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 862 | CVE-2026-96950Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 863 | CVE-2026-96953Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 864 | CVE-2026-96995Microsoft Office Word Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 865 | CVE-2026-96996Microsoft Office Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 866 | CVE-2026-96997Microsoft Office OneNote Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 867 | CVE-2026-97001Microsoft Office Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 868 | CVE-2026-97009Microsoft Office Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 869 | CVE-2026-97792Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 870 | CVE-2026-97794Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 871 | CVE-2026-97799Windows Audio Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 872 | CVE-2026-97800Windows Mobile Broadband Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 873 | CVE-2026-97803Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 874 | CVE-2026-97804HID Class Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 875 | CVE-2026-97806Windows Broadcast DVR User Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 876 | CVE-2026-97807Windows Broadcast DVR User Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 877 | CVE-2026-97809Windows Broadcast DVR User Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 878 | CVE-2026-97811Microsoft OpenSSH for Windows Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 879 | CVE-2026-100215Microsoft Graphics Component Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 880 | CVE-2026-100217Windows Group Policy Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 881 | CVE-2026-102196Windows Broadcast DVR User Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 882 | CVE-2026-102201Microsoft Windows Media Foundation Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 883 | CVE-2026-102202Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 884 | CVE-2026-102204Microsoft Microsoft Defender for Endpoint Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 885 | CVE-2026-102205Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 886 | CVE-2026-102215Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 887 | CVE-2026-102216Windows StateRepository API Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 888 | CVE-2026-102218Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 889 | CVE-2026-102220Windows VHD miniport driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 890 | CVE-2026-102227Windows Resilient File System (ReFS) Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 891 | CVE-2026-102233Visual Studio Code Security Feature Bypass | Not assessed | Not on CISA's list | 7.8 High | 0.00 |
| 892 | CVE-2026-103553Windows Partition Management Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 893 | CVE-2026-103568Windows Credential Providers Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 894 | CVE-2026-105003HID Class Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 895 | CVE-2026-105004Windows Overlay Filter Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 896 | CVE-2026-108130Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 897 | CVE-2026-108133Windows Modern Device Management (MDM) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 898 | CVE-2026-108136Microsoft Windows Search Component Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 899 | CVE-2026-102231Visual Studio Code Security Feature Bypass | Not assessed | Not on CISA's list | 7.7 High | 0.00 |
| 900 | CVE-2026-69789Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.00 |