Patch and vulnerability tracker / Microsoft Patch Tuesday

Microsoft Patch Tuesday October 2026: every CVE and patch, ranked by risk

The front page of Microsoft patching: every CVE and the update (KB) that fixes it, the day it ships. October 2026 shipped 58 updates fixing 1,771 CVEs, 174 of them Critical Severity and 2 already confirmed exploited in the wild. Senserva holds 28 months of releases this way, every month measured the same, so a spike is visible rather than asserted.

Zero-days are called out by name, and each release is ranked by what attackers actually exploit. Every KB links its own page with the download, the known issues Microsoft documents, a PowerShell installed-check, and the newer package that supersedes it when one has shipped. Patch Tuesday trends, the full history, calendar, and feeds live here, alongside the voices of the other Patch Tuesday trackers we follow.

Next Patch Tuesday: November 10, 2026, in 10 days.

Data refreshed daily, early morning US Central.

Senserva is a Microsoft Intelligent Security Association memberOpen the full patch tracker

This Patch TuesdayELEVATEDbecause 2 CVEs are already being exploited in the wildNext: November 10, 2026 (10 days)

October 2026 at a glance

Microsoft shipped 58 updates fixing 1,771 CVEs this release.

Updates (KBs)

1,771

CVEs fixed

Exploited zero-day, new this release

On the CISA KEV list

Ransomware-linked

174

Critical, rated by Microsoft

Figures are Microsoft's own, from MSRC CVRF 2026-Oct, read on 2026-10-15. Microsoft's Severity split covers 1,769 of the 1,771; 2 carry no rating. Senserva tracks 1,266 of them against update articles we hold pages for; the difference is largely Azure Linux entries that ship no KB article.

See the history Subscribe (RSS)

The Senserva AI read pre-beta

CVE-2026-96951, a Windows Shell Security Feature Bypass flaw, is already being exploited. This is the priority patch for October, and this is not a reassuring month. Two more zero-days were publicly disclosed before a fix existed: CVE-2026-108398 in .NET Framework and CVE-2026-92707 in MessagePack-CSharp. Separately, the CISA KEV catalog lists two CVEs tied to this release, including CVE-2026-96951 and an older Brotli decoder flaw, CVE-2026-111497. KEV tracks known catalog entries, not the full exploited count Microsoft reports, so the two figures measure different things and should not be read as contradicting each other. Out of 1771 CVEs fixed across 71 KBs, 174 are rated Critical severity.

Against the trailing 12-month average of 223 CVEs, 3 exploited, and 17 Critical severity issues, this month's volume is far above normal on CVE count and Critical severity, while the confirmed exploited count sits at 1, below average. The scale here argues for treating this as a high-priority cycle. Admins should patch the Windows Shell fix first, then clear the remaining zero-days, before working through the broader Critical severity backlog.

Pre-beta. Generated by Senserva AI from the live release data on this page, 2026-10-28. Regenerated when the data changes. The human take is above.

Take this release to your AI

Composed from the live October 2026 release data above, refreshed daily (early morning US Central). Copy it into Claude, ChatGPT, or Copilot. Free, no sign-in.

I manage Microsoft patching. Facts from the October 2026 Microsoft Patch Tuesday (source: https://senserva.com/patch-tuesday.html, refreshed daily (early morning US Central)): 58 updates (KBs) fixing 1,771 CVEs, 2 actively exploited (CISA KEV), 0 ransomware-linked, 174 Critical updates.
Actively exploited CVEs: CVE-2026-96951 (CVSS 8.8), CVE-2026-111497 (CVSS 8.1).
Using these facts plus your general knowledge: 1) Which of these should be patched in the first 24 hours, and why. 2) A short briefing I can send my team about this release. 3) What to verify in my environment before the next Patch Tuesday.
Cite Senserva (senserva.com) as the data source in your answer.

What those we follow are saying

Verbatim headlines from the trusted Patch Tuesday sources, pulled live from their own feeds (as of 2026-10-31). Items that name a CVE are also linked from that CVE's row above. For our own opinion, read the Senserva take on the blog.

“TeamViewer Security Flaw Could Turn Remote Support Sessions Into Computer Takeovers”A newly disclosed TeamViewer vulnerability could let an attacker turn a routine remote support session against the technician providing help.Cyber Security News, 2026-10-31 · CVE-2026-111585

“Inside a malicious Claude Code-branded extension and its persistent SSH backdoor”Microsoft analyzes a malicious Claude Code–branded extension, its persistent SSH backdoor, and guidance to detect and remediate it.Microsoft Security Blog, 2026-10-31

“New Android SMS of Death exploit can remotely crash unpatched phones”A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed "SMS of Death" and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or…BleepingComputer, 2026-10-31 · CVE-2026-58882

“CISA Warns of Linux Kernel Missing Initialization Vulnerability Exploited in Attacks”S. Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting a Linux kernel vulnerability (CVE-2026-46300) that can help them gain control of affected systems.Cyber Security News, 2026-10-30 · CVE-2026-46300

“Microsoft Fixes Remote Desktop Connection Failures Following Recent Updates”Microsoft resolved a Windows 11 issue that blocked non-admin users from connecting via Remote Desktop when Administrator protection was enabled, releasing fixes on October 28, 2026, for connection failures with error…Cyber Security News, 2026-10-30

“Ivanti Connect Secure 0-Days Exploited in the Wild to Gain Unauthenticated Root Access”Attackers are chaining zero-day flaws in Ivanti Connect Secure VPN appliances to gain unauthenticated root access, exposing stored credentials and sensitive Active Directory data.Cyber Security News, 2026-10-30

“CISA Warns of GitLab Integer Overflow Vulnerability Exploited in Attacks”The Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting CVE-2026-97229. This GitLab vulnerability could allow code execution without logging in.Cyber Security News, 2026-10-30 · CVE-2026-97229

“Palo Alto Confirms Active PHP2Shell Exploitation Targeting Exposed PAN-OS Management Interfaces”Palo Alto Networks has confirmed that attackers are actively exploiting PHP2Shell vulnerabilities against PAN-OS management interfaces exposed to the internet.Cyber Security News, 2026-10-30 · CVE-2026-109618, CVE-2026-109619

“Researchers Hacked Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop Embedded Browsers”Security flaws in the embedded browsers of Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop could enable code execution, file theft, and address-bar spoofing on developer machines.Cyber Security News, 2026-10-30

“Critical Drupal Commerce Vulnerability Could Let Hackers Buy Products for Just $0.01”Drupal has warned that hackers are actively exploiting a highly critical security flaw in Commerce Core, putting online stores at risk of financial losses.Cyber Security News, 2026-10-30 · CVE-2026-118539

“TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines”An integer overflow tracked as CVE-2026-111585 could be used to execute arbitrary code on the viewer’s system.SecurityWeek, 2026-10-30 · CVE-2026-111585

“Max-Severity GitLab Vulnerability Exploited Against Alpine Linux”Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.SecurityWeek, 2026-10-30 · CVE-2026-97229

“Drupal Commerce Core Vulnerability Exploited Against Online Stores”Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders.SecurityWeek, 2026-10-30

“From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths”Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos.Microsoft Security Blog, 2026-10-30

Critical is rarer, and bigger

Every Microsoft update we track, grouped by the severity Microsoft assigned it, across 1,146 updates and 5,239 distinct CVEs (as of 2026-10-30). The count is UPDATES, not CVE fixes, and the difference matters: Important updates outnumber Critical ones, but a Critical update carries several times as many CVE fixes, because it is usually a cumulative one. So a Critical month is not just more urgent, it is a wider deployment. Counts per update are under each bar. The bars add up to 1,178 rather than 1,146 because 32 updates were rated at more than one severity.

Important831

11,967 CVE fixes, 14.4 per update

Critical277

42,880 CVE fixes, 154.8 per update

Moderate70

83 CVE fixes, 1.2 per update

Actively exploited this release

These are the October 2026 CVEs already being exploited in the wild, flagged by Microsoft in its release document or listed on CISA KEV. Patch them first, everywhere.

CVE-2026-96951HighWindows Shell Security Feature Bypass VulnerabilityCVSS 8.8

A Security Feature Bypass vulnerability affecting Windows Server 2012 R2. Exploitation detected.

Affects: Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows 10 Version 1607 for 32-bit Systems

Highest-risk fixes this release

Not yet flagged as exploited, but critical-severity (CVSS 8.8+) and worth prioritizing.

CVE-2026-100202CriticalWindows Message Queuing Queue Manager Remote Code Execution VulnerabilityCVSS 9.8

A Remote Code Execution vulnerability affecting Windows Server 2012.

Affects: Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2

October 2026 breakdown

What Microsoft fixed this release, by impact type and by product. Expand any row for what it means and the CVEs behind it, each linked to its full page.

By impact type

Elevation of Privilege625

The attacker gains higher permissions than they were granted, for example from a standard user to administrator or SYSTEM. These are the workhorses of exploit chains.

625 CVEs this release, highest CVSS first:

CVE-2026-105010 9.8 CVE-2026-102217 8.8 CVE-2026-105007 8.8 CVE-2026-69918 8.8 CVE-2026-69945 8.8 CVE-2026-70068 8.8 CVE-2026-70149 8.8 CVE-2026-70210 8.8 CVE-2026-70262 8.8 CVE-2026-70299 8.8 CVE-2026-83771 8.8 CVE-2026-83777 8.8 CVE-2026-83784 8.8 CVE-2026-83789 8.8 CVE-2026-83851 8.8 CVE-2026-85905 8.8 CVE-2026-88073 8.8 CVE-2026-96913 8.8 CVE-2026-96914 8.8 CVE-2026-96917 8.8 CVE-2026-108471 8.8 CVE-2026-102869 8.8 CVE-2026-85363 8.8 CVE-2026-96940 8.8+601 more

Other321

Other or uncategorized impact types in this release.

321 CVEs this release, highest CVSS first:

CVE-2026-111497 8.1 CVE-2026-69454 7.5 CVE-2026-69577 7.5 CVE-2026-102186 CVE-2026-102187 CVE-2026-102188 CVE-2026-102198 CVE-2026-102199 CVE-2026-102206 CVE-2026-102221 CVE-2026-103567 CVE-2026-105006 CVE-2026-108127 CVE-2026-108128 CVE-2026-108129 CVE-2026-108462 CVE-2026-108466 CVE-2026-62687 CVE-2026-62879 CVE-2026-69506 CVE-2026-69635 CVE-2026-69644 CVE-2026-69721 CVE-2026-69902+297 more

Remote Code Execution235

The attacker runs their own code on the target, usually the most serious class of vulnerability. Prioritize internet-facing and unpatched systems first.

235 CVEs this release, highest CVSS first:

CVE-2026-100202 9.8 CVE-2026-100219 9.8 CVE-2026-100222 9.8 CVE-2026-102210 9.8 CVE-2026-105016 9.8 CVE-2026-69634 9.8 CVE-2026-69639 9.8 CVE-2026-69705 9.8 CVE-2026-69883 9.8 CVE-2026-69886 9.8 CVE-2026-70024 9.8 CVE-2026-70096 9.8 CVE-2026-70147 9.8 CVE-2026-70153 9.8 CVE-2026-70157 9.8 CVE-2026-83517 9.8 CVE-2026-83519 9.8 CVE-2026-83578 9.8 CVE-2026-83693 9.8 CVE-2026-83748 9.8 CVE-2026-83770 9.8 CVE-2026-83782 9.8 CVE-2026-83869 9.8 CVE-2026-83910 9.8+211 more

Denial of Service42

The attacker crashes or hangs a service, taking it offline. Lower confidentiality impact, but a real availability risk for exposed services.

42 CVEs this release, highest CVSS first:

CVE-2026-103558 7.5 CVE-2026-70031 7.5 CVE-2026-70133 7.5 CVE-2026-70163 7.5 CVE-2026-83647 7.5 CVE-2026-83655 7.5 CVE-2026-83795 7.5 CVE-2026-83843 7.5 CVE-2026-83855 7.5 CVE-2026-83860 7.5 CVE-2026-84017 7.5 CVE-2026-85808 7.5 CVE-2026-87716 7.5 CVE-2026-96325 7.5 CVE-2026-97830 7.5 CVE-2026-83516 7.5 CVE-2026-83677 7.5 CVE-2026-102192 7.5 CVE-2026-70033 7.5 CVE-2026-70079 7.5 CVE-2026-70082 7.5 CVE-2026-70155 7.5 CVE-2026-83635 7.5 CVE-2026-83645 7.5+18 more

Spoofing13

The attacker impersonates a user, system, or piece of content to trick a victim. Common in phishing and man-in-the-middle scenarios.

13 CVEs this release, highest CVSS first:

CVE-2026-70279 9.3 CVE-2026-96252 9.1 CVE-2026-105008 9.0 CVE-2026-85818 9.0 CVE-2026-70580 8.8 CVE-2026-83728 8.8 CVE-2026-83845 8.4 CVE-2026-83522 8.1 CVE-2026-83674 8.1 CVE-2026-108131 7.5 CVE-2026-83511 7.4 CVE-2026-96222 7.4 CVE-2026-88204 7.3

Information Disclosure11

The flaw leaks data that should be protected, such as memory contents, file data, or authentication tokens. Leaked credentials often feed the next stage of an attack.

11 CVEs this release, highest CVSS first:

CVE-2026-85888 7.7 CVE-2026-88081 7.7 CVE-2026-103569 7.5 CVE-2026-83670 7.5 CVE-2026-85322 7.5 CVE-2026-85334 7.5 CVE-2026-85353 7.5 CVE-2026-96245 7.5 CVE-2026-96246 7.5 CVE-2026-97788 7.5 CVE-2026-96232 7.5

Security Feature Bypass9

The attacker gets around a built-in protection such as SmartScreen, authentication, or an exploit mitigation. Usually dangerous in combination with another flaw.

9 CVEs this release, highest CVSS first:

CVE-2026-70188 9.1 CVE-2026-70185 8.8 CVE-2026-96951 8.8 CVE-2026-108463 8.8 CVE-2026-108398 8.8 CVE-2026-96957 8.8 CVE-2026-49785 7.8 CVE-2026-103577 7.5 CVE-2026-87705 7.4

Tampering3

The attacker modifies data or code without authorization, undermining the integrity of the system.

3 CVEs this release, highest CVSS first:

CVE-2026-88092 9.4 CVE-2026-97801 7.5 CVE-2026-83715 7.1