← gociux.comall Patch Tuesdays

Patch Tuesday · October 2026

Patch Tuesday October 2026: 1,407 Microsoft CVEs, 1 exploited, 77 critical

, Gociux · 13 Oct 2026 · generated from Microsoft's security update API · 3 min read

1,407CVEs fixed
1exploited
77critical
1publicly disclosed

Microsoft's October 2026 release (published 13 Oct 2026) fixes 1,407 Microsoft CVEs across Windows, Office, Azure and server products. 1 is already exploited in the wild, which makes it the first thing to deploy. 1 more was publicly disclosed before a fix existed. 77 are rated critical and 108 are assessed as more likely to be exploited. CISA has already added 1 of them to its Known Exploited Vulnerabilities catalog.

Patch order: exploited first, then publicly disclosed, then critical remote code execution on internet-facing systems, then everything Microsoft marks "exploitation more likely". The list below is in that order. Use stack check for Microsoft CVEs CISA has confirmed exploited over time.

Patch first (10)

CVE-2026-96951EXPLOITEDCISA KEVCVSS 8.8

Windows Shell Security Feature Bypass Vulnerability

Important · Security Feature Bypass · Windows Shell

CVE-2026-108398DISCLOSEDCVSS 8.8

.NET Framework Security Feature Bypass Vulnerability

Important · Security Feature Bypass · .NET Framework

CVE-2026-70229CVSS 8.1

Windows Active Directory Domain Services Remote Code Execution Vulnerability

Critical · Remote Code Execution · Active Directory Domain Services

CVE-2026-70571CVSS 8.1

Microsoft Exchange Server Remote Code Execution Vulnerability

Critical · Remote Code Execution · Microsoft Exchange Server

CVE-2026-100202CVSS 9.8

Windows Message Queuing Queue Manager Remote Code Execution Vulnerability

Critical · Remote Code Execution · Windows Message Queuing Queue Manager

CVE-2026-100219CVSS 9.8

Microsoft QUIC Remote Code Execution Vulnerability

Critical · Remote Code Execution · Microsoft QUIC

CVE-2026-105016CVSS 9.8

Microsoft QUIC Remote Code Execution Vulnerability

Critical · Remote Code Execution · Microsoft QUIC

CVE-2026-70147CVSS 9.8

Microsoft PostScript Printer Driver Remote Code Execution Vulnerability

Critical · Remote Code Execution · Microsoft PostScript Printer Driver

CVE-2026-70153CVSS 9.8

Microsoft PostScript Printer Driver Remote Code Execution Vulnerability

Critical · Remote Code Execution · Microsoft PostScript Printer Driver

CVE-2026-70242CVSS 9.8

Microsoft Office Outlook Remote Code Execution Vulnerability

Critical · Remote Code Execution · Microsoft Office Outlook

By impact

ImpactCVEs
Elevation of Privilege674
Remote Code Execution314
Information Disclosure252
Denial of Service71
Security Feature Bypass40
Tampering29
Spoofing27

Most-patched components

ComponentCVEs
Microsoft Office Excel69
Role: DNS Server52
Windows Kernel46
Windows Installer38
Windows Win32 Kernel Subsystem36
Microsoft Office SharePoint36
Microsoft Windows Search Component29
Windows NTFS26
.NET25
Microsoft Office Word22

How this is made: built automatically from Microsoft's October 2026 release via the MSRC CVRF API. Counted: CVEs assigned by Microsoft and first published on release day; third-party CVEs Microsoft republishes (Chromium for Edge, Linux and Azure Linux packages, open-source libraries) and later re-releases are excluded, so totals can differ slightly from other trackers. Cross-checked against the CISA KEV catalog. Severity, impact and exploitation status are Microsoft's own assessments at release time and can change; always confirm in the Security Update Guide before scheduling changes.

← September 2026all Patch Tuesdays →

Patching on evidence, every month?

We wire Microsoft's monthly release, CISA KEV and EPSS into your vulnerability workflow, so the few updates that matter ship first, with deadlines an auditor accepts.

Get in touch →