Home › Microsoft Patch Tuesday › October 2026

Microsoft Patch Tuesday, October 2026

·

Microsoft's October 2026 security release, published October 13, 2026: 55 updates fixing 1,771 CVEs, ranked by confirmed exploitation, ransomware use, and severity. Provided by Senserva.

Microsoft's Severity ratings

Of the 1,771 CVEs in Microsoft's October 2026 release document, Microsoft rated 174 Critical, 1,438 Important, 133 Moderate and 24 Low; 2 carry no rating. Source: MSRC CVRF 2026-Oct, read 2026-10-15, recorded automatically from Microsoft's document.

Still active now. 1 CVE from this release is on the Senserva hot list today (as of 2026-10-15), still ranked among the most dangerous vulnerabilities right now by confirmed exploitation, ransomware use, EPSS, and severity. See the current hot list.
55
Updates (KBs)
1,771
CVEs fixed
1
Exploited zero-day
1
On the CISA KEV list
174
Critical, rated by Microsoft

Severity, as Microsoft rates it

Critical 174Important 1,438Moderate 133Low 24No rating 2

That covers 1,769 of the 1,771; the remaining 2 carry no Severity rating at all.

Zero-days in this release

CVE-2026-96951Windows ShellCVSS 8.8Exploited
CVE-2026-108398.NET FrameworkCVSS 8.8Publicly disclosed
CVE-2026-92707MessagePack-CSharpCVSS 5.3Publicly disclosed

Actively exploited CVEs (CISA KEV)

CVE-2026-96951Windows Shell Security Feature Bypass VulnerabilityCVSS 8.8Exploited Hot now

Other high-risk CVEs (CVSS 8.8+)

CVE-2026-100202Windows Message Queuing Queue Manager Remote Code Execution VulnerabilityCVSS 9.8
CVE-2026-100219Microsoft QUIC Remote Code Execution VulnerabilityCVSS 9.8
CVE-2026-100222Network Policy Server (NPS) Remote Code Execution VulnerabilityCVSS 9.8
CVE-2026-102210Windows Text Shaping Remote Code Execution VulnerabilityCVSS 9.8
CVE-2026-105010Microsoft Windows Search Component Elevation of Privilege VulnerabilityCVSS 9.8
CVE-2026-105016Microsoft QUIC Remote Code Execution VulnerabilityCVSS 9.8
CVE-2026-69634Windows iSCSI Remote Code Execution VulnerabilityCVSS 9.8
CVE-2026-69639Windows libarchive Remote Code Execution VulnerabilityCVSS 9.8
CVE-2026-69705Windows iSCSI Remote Code Execution VulnerabilityCVSS 9.8
CVE-2026-69883Windows iSCSI Remote Code Execution VulnerabilityCVSS 9.8
CVE-2026-69886Windows Imaging Component Remote Code Execution VulnerabilityCVSS 9.8
CVE-2026-70024Windows Internet Information Services Remote Code Execution VulnerabilityCVSS 9.8

Products fixed this month

Windows Server 2012 R2 (2)Windows Server 2012 R2 (Server Core installation) (2)Windows 10 Version 1607 for 32-bit Systems (2)Windows 10 Version 1607 for x64-based Systems (2)Windows Server 2016 (2)Windows Server 2016 (Server Core installation) (2)Windows Server 2012 (2)Windows Server 2012 (Server Core installation) (2)Microsoft Exchange Server 2019 Cumulative Update 14 (2)Microsoft Exchange Server 2016 Cumulative Update 23 (2)

Every update in this release

All 55 update articles, worst first: anything on the CISA KEV list, then by highest CVSS. Each row links our page for the update, Microsoft's support article, and the Update Catalog for a standalone download.

UpdateSeverityMax CVSSCVEs fixedProductsAlso
KB5126653 ExploitedCritical9.8965Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based SystemsSupport · Catalog
KB5127648 ExploitedCritical9.81,009Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems, and 3 moreSupport · Catalog
KB5126646 ExploitedCritical9.81,041Windows Server 2025, Windows Server 2025 (Server Core installation)Support · Catalog
KB5127646 ExploitedCritical9.8997Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based SystemsSupport · Catalog
KB5126651 ExploitedCritical9.8918Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, and 1 moreSupport · Catalog
KB5126657 ExploitedCritical9.8899Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems, and 3 moreSupport · Catalog
KB5126655 ExploitedCritical9.8977Windows Server 2022, Windows Server 2022 (Server Core installation)Support · Catalog
KB5126836 ExploitedCritical9.8649Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)Support · Catalog
KB5126868 ExploitedCritical9.8769Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows Server 2016, and 3 moreSupport · Catalog
KB5126835Critical9.8612Windows Server 2012, Windows Server 2012 (Server Core installation)Support · Catalog
KB5130034Critical9.828.NET 8.0 installed on Windows, .NET 8.0 installed on Linux, .NET 8.0 installed on Mac OS, and 1 moreSupport · Catalog
KB5130035Critical9.831.NET 9.0 installed on Windows, .NET 9.0 installed on Linux, .NET 9.0 installed on Mac OS, and 1 moreSupport · Catalog
KB5130036Critical9.431.NET 10.0 installed on Windows, .NET 10.0 installed on Linux, .NET 10.0 installed on Mac OS, and 1 moreSupport · Catalog
KB5128897Critical9.36Microsoft Exchange Server 2019 Cumulative Update 14Support · Catalog
KB5128898Critical9.36Microsoft Exchange Server 2016 Cumulative Update 23Support · Catalog
KB5128895Critical9.36Microsoft Exchange Server Subscription Edition RTMSupport · Catalog
KB5128896Critical9.35Microsoft Exchange Server 2019 Cumulative Update 15Support · Catalog
KB5002927High8.837Microsoft SharePoint Server Subscription EditionSupport · Catalog
KB5127666High8.819Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 version 1809Support · Catalog
KB5127685High8.819Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 1809, Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019Support · Catalog
KB5127683High8.818Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 21H2, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 22H2Support · Catalog
KB5127687High8.819Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022Support · Catalog
KB5127667High8.818Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012Support · Catalog
KB5127668High8.818Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2Support · Catalog
KB5127684High8.818Microsoft .NET Framework 4.8 on Windows 10 version 1607, Microsoft .NET Framework 4.8 on Windows Server 2016Support · Catalog
KB5127686High8.818Microsoft .NET Framework 4.8 on Windows Server 2012Support · Catalog
KB5127688High8.818Microsoft .NET Framework 4.8 on Windows Server 2012 R2Support · Catalog
KB5127689High8.819Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 21H2, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 22H2Support · Catalog
KB5127690High8.819Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 24H2, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 25H2, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025Support · Catalog
KB5127691High8.818Microsoft .NET Framework 4.8.1 on Windows 11 version 26H1Support · Catalog
KB5127692High8.819Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 23H2Support · Catalog
KB5127693High8.819Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022Support · Catalog
KB5127694High8.819Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 26H2Support · Catalog
KB5127696High8.816Microsoft .NET Framework 3.5 on Windows 11 version 26H1Support · Catalog
KB5127660High8.817Microsoft .NET Framework 3.5 on Windows Server 2012Support · Catalog
KB5127664High8.817Microsoft .NET Framework 3.5 on Windows Server 2012 R2Support · Catalog
KB5131692High8.83Skype for Business Server Subscription Edition CU1Support · Catalog
KB5132779High8.83Skype for Business Server 2015 CU13Support · Catalog
KB5131693High8.83Skype for Business Server 2019 CU8Support · Catalog
KB5126934High8.822Microsoft SQL Server 2022 for x64-based Systems (CU27)Support · Catalog
KB5126967High8.822Microsoft SQL Server 2025 for x64-based Systems (CU9)Support · Catalog
KB5128495High8.820Microsoft SQL Server 2019 for x64-based Systems (GDR)Support · Catalog
KB5128493High8.822Microsoft SQL Server 2022 for x64-based Systems (GDR)Support · Catalog
KB5128492High8.822Microsoft SQL Server 2025 for x64-based Systems (GDR)Support · Catalog
KB5128494High8.820Microsoft SQL Server 2019 for x64-based Systems (CU32), Microsoft SQL Server 2019 for x64-based Systems (CU 32)Support · Catalog
KB5002928High8.844Office Online ServerSupport · Catalog
KB5128496High8.813Microsoft SQL Server 2017 for x64-based Systems (CU31)Support · Catalog
KB5128497High8.813Microsoft SQL Server 2017 for x64-based Systems (GDR)Support · Catalog
KB5129957High8.81Microsoft Exchange Server 2019 Cumulative Update 14Support · Catalog
KB5129958High8.81Microsoft Exchange Server 2016 Cumulative Update 23Support · Catalog
KB5129955High8.81Microsoft Exchange Server Subscription Edition RTMSupport · Catalog
KB5129956High8.81Microsoft Exchange Server 2019 Cumulative Update 15Support · Catalog
KB5126649High7.82Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows Server 2016, and 1 moreSupport · Catalog
KB5127357High7.82Windows Server 2012, Windows Server 2012 (Server Core installation)Support · Catalog
KB5127356High7.82Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)Support · Catalog
Take this release to your AI

Composed from the October 2026 release data above. Copy it into Claude, ChatGPT, or Copilot. Free, no sign-in.

See every Patch Tuesday, all months  |  The live Microsoft patch tracker

← September 2026

Now see your own patch state.

Senserva reads your Microsoft 365, Intune, Defender, and Entra ID environment and turns this release into your list: every update still missing, on every device, ranked by what attackers are actually exploiting. The 650+ configuration checks come with it.

1Find it2Fix it3Prove it
Start my free patch auditAll you do is register.
Reference: Microsoft CVE and vulnerability management, ranked by real-world risk, and the Microsoft patching guide.
Data notice: this page is provided as is, for informational purposes only, without warranty of any kind. Senserva, LLC does not guarantee the accuracy, completeness, or timeliness of third-party data (MSRC, NVD, CISA KEV, EPSS) and accepts no liability for actions taken based on it; verify against the authoritative Microsoft advisory before acting. Built daily with Senserva Trustworthy AI. All use of this data is subject to the Senserva EULA.