Microsoft released its October 2026 security updates on October 13, 2026. This release fixes 1411 vulnerabilities, with 78 rated Critical. It includes 3 zero-days: 1 already exploited by attackers and 2 publicly disclosed before a fix. Patch those first.
- 1411 patches
- 78 Critical
- 3 zero-days
- 1 exploited
In plain English
Patch Tuesday for October 2026 has not been publicly documented by the major security sources yet. Small businesses should keep an eye on Microsoft's Security Update Guide when it becomes available and plan to test and deploy updates promptly. In the meantime, ensure you have a reliable backup strategy and that your antivirus and endpoint protection are up to date. Review any advisories from your software vendors as soon as they are published.
Zero-day vulnerabilities
Exploited by attackers or publicly disclosed before the fix. Treat these as urgent.
| CVE | What it affects | Type | CVSS | Status |
|---|---|---|---|---|
| CVE-2026-96951 | Windows Shell Security Feature Bypass Vulnerability | Security Feature Bypass | 8.8 | Exploited |
| CVE-2026-108398 | .NET Framework Security Feature Bypass Vulnerability | Security Feature Bypass | 8.8 | Publicly disclosed |
| CVE-2026-92707 | MessagePack-CSharp Denial of Service Vulnerability | Denial of Service | 5.3 | Publicly disclosed |
Critical vulnerabilities
Highest severity scores first.
| CVE | What it affects | Type | CVSS | Status |
|---|---|---|---|---|
| CVE-2026-100202 | Windows Message Queuing Queue Manager Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-100219 | Microsoft QUIC Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-105016 | Microsoft QUIC Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-21413 | Raw Image Extension Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-70147 | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-70153 | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-70242 | Microsoft Office Outlook Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-70291 | Microsoft Office Outlook Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-70300 | Microsoft Office Word Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-88156 | Microsoft Office Outlook Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-88178 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-96934 | Windows DHCP Server Remote Code Execution Vulnerability | Remote Code Execution | 9.8 |
And 66 more Critical fixes. The full list is in Microsoft’s release notes below.
What kinds of problems were fixed
| Type | Count |
|---|---|
| Elevation of Privilege | 674 |
| Remote Code Execution | 315 |
| Information Disclosure | 252 |
| Denial of Service | 72 |
| Security Feature Bypass | 40 |
| Tampering | 29 |
| Spoofing | 27 |
| Not a Vulnerability | 1 |
What we recommend
- Patch anything marked as exploited first, ideally within days.
- Then roll out the Critical fixes, starting with internet-facing systems, domain controllers and email servers.
- Test on a small group before pushing to everyone, and keep a way to roll back.
- Check that endpoint protection and backups are healthy before you patch.
Short on time? Talk to Synova and we will help you prioritize and roll out the updates safely.
Counts are vulnerabilities (CVEs) first published on Patch Tuesday. Microsoft also published 348 fixes earlier in the month (mostly Edge and other browser components), which are not included above. Microsoft sometimes revises a release after launch, so this page updates itself. Last updated November 3, 2026, 2:14 AM EST. Independent check: NIST's vulnerability database lists 1407 Microsoft CVEs for that day, which matches our count. CISA's known-exploited list already includes 1 of the 1 exploited vulnerabilities. Source: Microsoft Security Update Guide, October 2026 release notes.