Patch and vulnerability tracker / Microsoft Patch Tuesday

Microsoft Patch Tuesday October 2026: every CVE and patch, ranked by risk

The front page of Microsoft patching: every CVE and the update (KB) that fixes it, the day it ships. October 2026 shipped 4 updates fixing 1 CVEs, graded by Severity. Senserva holds 28 months of releases this way, every month measured the same, so a spike is visible rather than asserted.

Zero-days are called out by name, and each release is ranked by what attackers actually exploit. Every KB links its own page with the download, the known issues Microsoft documents, a PowerShell installed-check, and the newer package that supersedes it when one has shipped. Patch Tuesday trends, the full history, calendar, and feeds live here, alongside the voices of the other Patch Tuesday trackers we follow.

Next Patch Tuesday: October 13, 2026, in 3 days.

Data refreshed twice a day, morning and afternoon US Central.

Senserva is a Microsoft Intelligent Security Association memberOpen the full patch tracker

This Patch TuesdayMODERATEbecause no CVEs from this release are on CISA KEV yetNext: October 13, 2026 (3 days)

October 2026 at a glance

Microsoft shipped 4 updates fixing 1 CVEs this release.

Updates (KBs)

CVEs fixed

Exploited zero-day, new this release

On the CISA KEV list

Ransomware-linked

Critical, rated by Microsoft

See the history Subscribe (RSS)

The Senserva AI read pre-beta

This month's release is small and narrow: 4 updates covering 1 CVE across Exchange Server builds (2019 CU14, 2019 CU15, 2016 CU23, and Subscription Edition RTM). Microsoft rates no CVEs as Critical severity, and none are listed as zero-days or as already being exploited. The CISA KEV catalog shows zero entries this month, but that measures older CVEs being actively exploited elsewhere, not whether anything new here is under attack, so it should not be read as a sign of a quiet threat landscape overall. Given the single CVE, patch priority is straightforward: apply the Exchange Server updates to whichever of the four builds you run, with no need to triage across competing fixes.

Compared to the trailing 12-month average of 232 CVEs, 3 exploited, and 19 rated Critical severity, this month is far below normal volume. That makes it an easy month operationally, but it does not reduce exposure from unpatched prior-month CVEs still active in the wild. Admins should treat this as a light maintenance cycle, not a reason to ease up on tracking exploitation activity from earlier releases.

Pre-beta. Generated by Senserva AI from the live release data on this page, 2026-10-04. Regenerated when the data changes. The human take is above.

Take this release to your AI

Composed from the live October 2026 release data above, refreshed twice a day (morning and afternoon US Central). Copy it into Claude, ChatGPT, or Copilot. Free, no sign-in.

I manage Microsoft patching. Facts from the October 2026 Microsoft Patch Tuesday (source: https://senserva.com/patch-tuesday.html, refreshed twice a day (morning and afternoon US Central)): 4 updates (KBs) fixing 1 CVEs, 0 actively exploited (CISA KEV), 0 ransomware-linked, 0 Critical updates.
Using these facts plus your general knowledge: 1) Which of these should be patched in the first 24 hours, and why. 2) A short briefing I can send my team about this release. 3) What to verify in my environment before the next Patch Tuesday.
Cite Senserva (senserva.com) as the data source in your answer.

What those we follow are saying

Verbatim headlines from the trusted Patch Tuesday sources, pulled live from their own feeds (as of 2026-10-10). Items that name a CVE are also linked from that CVE's row above. For our own opinion, read the Senserva take on the blog.

“Microsoft Teams to Warn Users About Malicious Links Hidden in QR Codes”Microsoft is extending Teams security to detect malicious links hidden inside QR codes and warn users after a message has been delivered.Cyber Security News, 2026-10-10

“Citrix Urges NetScaler ADC and Gateway Customers to Patch for New Critical RCE Vulnerability”Citrix has urged customers to patch a critical security flaw in NetScaler ADC and NetScaler Gateway that could allow remote code execution or cause a denial of service.Cyber Security News, 2026-10-09 · CVE-2026-107406

“React Server Components Flaw Lets Attackers Freeze Next.js Servers With a Single POST Request”js servers by sending a specially crafted POST request to a Server Function endpoint.Cyber Security News, 2026-10-09 · CVE-2026-23870

“Microsoft Says PKI, HSMs and Security Appliances Must Prepare for Post-Quantum Authentication”Microsoft is urging organizations to prepare their certificate systems for post-quantum authentication, warning that public key infrastructure (PKI), hardware security modules (HSMs), and security appliances need…Cyber Security News, 2026-10-09

“PoC Released for Telegram Desktop Flaw Enabling One-Click File Account Takeover”A public proof of concept has exposed a flaw in Telegram Desktop that could let attackers steal local files and take over accounts after a user clicks a crafted external link. 6 (High).Cyber Security News, 2026-10-09 · CVE-2026-107181

“Citrix Urges Immediate Patching of Critical NetScaler Vulnerability”The security defect, tracked as CVE-2026-107406, could lead to remote code execution or denial-of-service.SecurityWeek, 2026-10-09 · CVE-2026-107406

“Unpatched AhsayCBS Vulnerabilities Exploited in the Wild”The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands.SecurityWeek, 2026-10-09 · CVE-2026-105133, CVE-2026-105134

“October 2026 Patch Tuesday forecast: Time for an Office cleanup”September 2026 Patch Tuesday set an all-time record with 973 CVEs addressed across the Microsoft portfolio.Help Net Security, 2026-10-09 · CVE-2026-85880, CVE-2026-81963

“High-severity NVIDIA vulnerability lets unauthenticated attackers crash GPU monitoring”Hundreds of internet-exposed graphics processing unit (GPU) servers were open to a high-severity flaw in NVIDIA’s DCGM Exporter (CVE-2026-47483) that lets unauthenticated attackers crash the monitoring service and may…Help Net Security, 2026-10-09 · CVE-2026-47483

“Hackers get $1,262,000 for 98 zero-days at Pwn2Own Ireland”The Pwn2Own Ireland 2026 hacking contest has concluded, with hackers collecting $1,262,000 in rewards after exploiting 98 zero-day flaws.BleepingComputer, 2026-10-09

“Microsoft: Outdated Windows devices will stop receiving security updates”Microsoft says devices running unsupported versions of Windows will stop receiving security updates after next year's Windows Update certificate rotation.BleepingComputer, 2026-10-09

“Max severity SonicWall SMA1000 flaw now exploited in attacks”Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago.BleepingComputer, 2026-10-09 · CVE-2026-102255

“Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto”Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners.BleepingComputer, 2026-10-09

“PoC Released for Critical LMCache Flaw Enabling Unauthenticated Remote Code Execution”A proof-of-concept (PoC) exploit has been released for a critical vulnerability in LMCache that can allow unauthenticated remote code execution on exposed distributed deployments. 9.Cyber Security News, 2026-10-08 · CVE-2026-105192

Critical is rarer, and bigger

Every Microsoft update we track, grouped by the severity Microsoft assigned it, across 1,092 updates and 3,971 distinct CVEs (as of 2026-10-08). The count is UPDATES, not CVE fixes, and the difference matters: Important updates outnumber Critical ones, but a Critical update carries several times as many CVE fixes, because it is usually a cumulative one. So a Critical month is not just more urgent, it is a wider deployment. Counts per update are under each bar. The bars add up to 1,109 rather than 1,092 because 17 updates were rated at more than one severity.

Important779

9,558 CVE fixes, 12.3 per update

Critical260

22,892 CVE fixes, 88.0 per update

Moderate70

83 CVE fixes, 1.2 per update

Actively exploited this release

These are the October 2026 CVEs already being exploited in the wild, flagged by Microsoft in its release document (CISA KEV usually catches up within days). Patch them first, everywhere.

No CVE from the October 2026 release is reported as exploited yet, by Microsoft or on the CISA KEV list. That can change within days of release, so check back, and patch the highest-risk items below in the meantime.

Highest-risk fixes this release

Not yet flagged as exploited, but critical-severity (CVSS 8.8+) and worth prioritizing.

CVE-2026-96940HighMicrosoft Exchange Server Elevation of Privilege VulnerabilityCVSS 8.8

An Elevation of Privilege vulnerability affecting Microsoft Exchange Server 2019 Cumulative Update 14.

Affects: Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server Subscription Edition RTM

October 2026 breakdown

What Microsoft fixed this release, by impact type and by product. Expand any row for what it means and the CVEs behind it, each linked to its full page.

By impact type

Elevation of Privilege1

The attacker gains higher permissions than they were granted, for example from a standard user to administrator or SYSTEM. These are the workhorses of exploit chains.