IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Patch Tuesday

What Microsoft fixes on the second Tuesday of every month – straight from the official Security Update Guide: number of vulnerabilities, critical and already exploited ones (zero-days), affected products and the history of the last 24 months.

1,475vulnerabilities fixed (CVEs)
94of them critical
1exploited (zero-day)
1publicly disclosed
Tue, 10 Nov 2026Next Patch Tuesday
in 10 days and 2 hours

Patch Tuesday October 2026

1,416 of them published on Patch Tuesday (Tue, 13 Oct 2026), the rest added during the month. The month also contains 1,900 CVEs from other issuers that Microsoft ships in its own products (e.g. Chromium in Edge, Linux in Azure Linux) – they are not counted here. Microsoft Security Update Guide

Already exploited (zero-days)

CVE-2026-96951ImportantCVSS 8.8Exploited (zero-day)KEVSecurity feature bypass

Windows Shell: Security feature bypass via command injection

A command injection flaw in the Windows Shell allows an unauthorized remote attacker to bypass a security feature. The affected feature is Mark of the Web, which marks files from outside the local network. Microsoft reports active exploitation, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog. No authentication is needed, but a user must interact, for example by opening a crafted file received by email or instant message.

Windows, Windows ESU (Extended Security Updates), Microsoft Office, Browser (Edge) · KB5126836 KB5126868 KB5126651 KB5126657 · MSRC

Publicly disclosed beforehand

Critical vulnerabilities (94)

CVE-2026-110063CriticalCVSS 10.0Public exploitElevation of privilege

Microsoft VM Inspector for Azure VMs: Elevation of privilege via link following

VM Inspector for Azure Virtual Machines contains an improper link resolution flaw (CWE-59, link following) before file access. A network-based attacker without privileges or user interaction could exploit it to elevate privileges, and the CVSS base score is 10.0 (Critical). Microsoft states that the issue has already been fully mitigated on its side and requires no customer action; the NVD entry was still awaiting analysis at the time of research.

Azure · MSRC

CVE-2026-83938CriticalCVSS 10.0Public exploitElevation of privilege

Microsoft Azure Kubernetes Configuration Service: Elevation of privilege via missing authentication

Microsoft Azure Kubernetes Configuration Service contains a missing authentication check for a critical function (CWE-306). According to the CVE record, an unauthenticated attacker with network access can elevate privileges, with a CVSS 3.1 base score of 10.0 (Critical). Microsoft states that the issue has been fully mitigated on its service side and that customers have no action to take.

Azure · MSRC

CVE-2026-96207CriticalCVSS 10.0Elevation of privilege

Microsoft Partner Center: Improper certificate validation enables privilege escalation

Microsoft Partner Center, Microsoft's cloud-hosted management portal for partners and resellers, contains an improper certificate validation flaw (CWE-295). According to Microsoft, a network-reachable attacker without privileges and without user interaction can elevate privileges, with high impact on confidentiality and integrity (CVSS 10.0). Customers cannot patch the service themselves, because Microsoft applies the fix on its side. The main risk for SMEs is indirect, through their managed service provider or IT partner whose Partner Center access could be affected.

Azure · MSRC

CVE-2026-97785CriticalCVSS 10.0Public exploitElevation of privilege

Microsoft Entra application proxy: Elevation of privilege via improper authentication

Microsoft Entra application proxy (formerly Azure AD Application Proxy) publishes on-premises web applications to remote users. Improper authentication (CWE-287) allows an unauthenticated attacker over the network to elevate privileges. Microsoft rates the flaw critical (CVSS 3.1 base score 10.0) and states that customers need to take no action. No exploitation or public proof of concept was found in the sources retrieved.

Azure · MSRC

CVE-2026-94510CriticalCVSS 9.9Elevation of privilege

Microsoft Bookings: Authorization bypass through user-controlled key

Microsoft Bookings, a cloud service for online scheduling and customer bookings in Microsoft 365, contains an authorization bypass caused by a user-controlled key (CWE-639). An unauthenticated attacker on the network can exploit it to elevate privileges, with a changed scope and high integrity impact according to the CVSS vector. Microsoft applies the fix on its own service, so customers have no patch to install.

Apps · MSRC

CVE-2026-100202CriticalCVSS 9.8Remote code execution

Microsoft Windows Message Queuing: Remote code execution via use-after-free

Windows Message Queuing (MSMQ) Queue Manager in several supported Windows client and server versions contains a use-after-free flaw (CWE-416). An unauthenticated attacker with network access to the MSMQ service can execute code remotely, and the CVSS base score is 9.8 (critical). MSMQ is not installed by default, so exposure depends on whether it is installed and reachable over the network (by default TCP/1801).

Windows, Windows ESU (Extended Security Updates) · KB5126835 KB5126836 KB5126868 KB5126651 · MSRC

CVE-2026-100219CriticalCVSS 9.8Remote code execution

Microsoft Windows QUIC: Remote code execution via use-after-free

A use-after-free flaw in the Microsoft QUIC transport of Windows 11 and Windows Server allows an unauthenticated remote attacker to execute code. The attacker only needs to send crafted network traffic to an affected service that uses QUIC. The CVSS base score is 9.8 (critical), and the risk depends on whether QUIC services (UDP 443) are enabled and reachable from untrusted networks.

Windows · KB5126655 KB5126653 KB5127648 KB5126646 · MSRC

CVE-2026-105016CriticalCVSS 9.8Remote code execution

Microsoft QUIC: Heap-based buffer overflow enables remote code execution

A heap-based buffer overflow in Microsoft QUIC, the transport implementation used by Windows, .NET and Visual Studio, allows an unauthenticated attacker to execute code over the network. No user interaction or login is required, and the impact is rated total (confidentiality, integrity and availability) with a CVSS score of 9.8. Exposure depends mainly on whether Windows servers or .NET hosts that run QUIC or HTTP/3 services can be reached from untrusted networks.

Windows, Developer tools (.NET, Visual Studio …) · KB5126655 KB5126653 KB5127648 KB5126646 · MSRC

Show 86 more
CVE-2026-70147CriticalCVSS 9.8Remote code execution

Microsoft PostScript Printer Driver: Heap buffer overflow enables remote code execution

A heap-based buffer overflow in the Microsoft PostScript Printer Driver allows an unauthenticated attacker to execute code over the network. The flaw is triggered when the affected driver processes a specially crafted print job or packet sent to an affected print service. CVSS 3.1 rates it 9.8 (critical) with low attack complexity and no user interaction required, and CISA SSVC rates the technical impact as total.

Windows, Windows ESU (Extended Security Updates) · KB5127648 KB5126646 KB5126835 KB5126836 · MSRC

CVE-2026-70153CriticalCVSS 9.8Remote code execution

Microsoft Windows PostScript Printer Driver: Heap-based buffer overflow allows remote code execution

A heap-based buffer overflow in the Microsoft PostScript Printer Driver of Windows allows an unauthenticated attacker to execute code over the network. The CVSS score is 9.8 (critical). Exploitation requires no user interaction, for example by sending a specially crafted print job or packet to an affected print service.

Windows, Windows ESU (Extended Security Updates) · KB5126835 KB5126836 KB5126868 KB5126651 · MSRC

CVE-2026-70242CriticalCVSS 9.8Remote code execution

Microsoft Office Outlook: Remote code execution via heap-based buffer overflow

A heap-based buffer overflow in Microsoft Office Outlook allows an unauthenticated remote attacker to execute code on the affected system. According to Microsoft's CVE record, the attack requires no privileges and no user interaction, and Microsoft lists the Reading Pane as the trigger vector, so a crafted email may be sufficient. The CVSS base score is 9.8 (Critical). Microsoft has released security updates; no exploitation has been reported so far.

Microsoft Office · MSRC

CVE-2026-70291CriticalCVSS 9.8Remote code execution

Microsoft Office Outlook: Remote code execution via heap-based buffer overflow

A heap-based buffer overflow in Microsoft Office Outlook allows an unauthenticated attacker to execute code remotely over the network, with a CVSS 3.1 base score of 9.8 (critical). Microsoft's exploitability data rates it as unproven, and it is not publicly disclosed or known to be exploited. Research notes indicate that a crafted email may be triggered in the Reading Pane without user interaction, but Microsoft has not confirmed this preview vector, so the attack conditions remain partly unverified.

Microsoft Office · MSRC

CVE-2026-70300CriticalCVSS 9.8Remote code execution

Microsoft Office Word: Remote Code Execution via untrusted pointer dereference

An untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network. According to Microsoft, the Reading Pane (Preview Pane) is an attack vector, so a user may not need to open a malicious document. CVSS 9.8 (Critical); Microsoft and CISA SSVC assess automatable exploitation as possible, but no exploitation has been reported.

Microsoft Office · MSRC

CVE-2026-77900CriticalCVSS 9.8Remote code execution

Azure App Service: Missing authentication leads to remote code execution

Microsoft Azure App Service is affected by a missing authentication flaw (CWE-306) in a critical function. An unauthenticated attacker on the network could execute code, which would have a total impact on confidentiality, integrity and availability. Microsoft states that it has fully mitigated the issue on its platform, so customers have no action to take.

Azure · MSRC

CVE-2026-88131CriticalCVSS 9.8Remote code execution

Microsoft Dataverse: Remote code execution via deserialization

Microsoft Dataverse, the data platform behind Microsoft business applications, contains a deserialization flaw (CWE-502) that allows deserialization of untrusted data. According to the CVSS vector, an unauthenticated attacker with network access could execute code without user interaction, with a CVSS base score of 9.8. Microsoft states that the vulnerability has already been fully mitigated on its side and that no customer action is required.

Microsoft Dynamics · MSRC

CVE-2026-88156CriticalCVSS 9.8Remote code execution

Office Outlook: Remote code execution via stack-based buffer overflow

A stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. The vulnerability is rated critical (CVSS 9.8). Per the research notes, a specially crafted email may trigger code execution through the Preview Pane without the recipient opening or clicking anything; no authentication is required.

Microsoft Office · MSRC

CVE-2026-88178CriticalCVSS 9.8Remote code execution

Microsoft Office PowerPoint: Use-after-free leads to remote code execution

A use-after-free memory flaw (CWE-416) in Microsoft Office PowerPoint allows an unauthenticated attacker to execute code remotely over a network. Per the CVE record, the attack needs no login and no user privileges, and the CVSS base score is 9.8 (critical). Sources disagree on the attack path: Microsoft describes crafted presentations processed by an Office Online service, while CrowdStrike lists the Preview Pane as a vector, so a crafted file delivered by mail, download or a web-based Office service should be treated as a plausible risk.

Microsoft Office · MSRC

CVE-2026-96934CriticalCVSS 9.8Remote code execution

Microsoft Windows DHCP Server: Remote code execution via use after free

Microsoft has fixed a use-after-free vulnerability (CWE-416) in the Windows DHCP Server role. An unauthenticated attacker with network access can execute code on the server, and the CVSS score is 9.8 (critical). Microsoft rates exploitation as less likely and lists no public disclosure, but DHCP servers reachable from internal segments should be patched as a priority.

Windows, Windows ESU (Extended Security Updates) · KB5126836 KB5126868 KB5126651 KB5126646 · MSRC

CVE-2026-97016CriticalCVSS 9.8Remote code execution

Office Outlook: Remote code execution due to heap-based buffer overflow

A heap-based buffer overflow in Microsoft Office Outlook allows an unauthenticated attacker to execute code over the network, with a CVSS 3.1 base score of 9.8 (critical). Microsoft's advisory and the research notes indicate that a crafted email, processed through the preview pane, may be enough to trigger it without a click. The NVD record was still awaiting analysis in the sources reviewed, so the official scoring should be verified.

Microsoft Office · MSRC

CVE-2026-97749CriticalCVSS 9.8Remote code execution

Microsoft Office Outlook: Remote code execution via double free

A double free weakness (CWE-415) in Microsoft Office Outlook allows an unauthenticated remote attacker to execute code. Microsoft rates it Critical (CVSS 9.8) and describes it as network-reachable with no privileges and no user interaction. According to the advisory text cited in the research notes, simply viewing a crafted message in the Reading Pane could trigger it, so email is the main attack path.

Microsoft Office · MSRC

CVE-2026-97814CriticalCVSS 9.8Remote code execution

Windows: Heap-based buffer overflow in Text Shaping allows remote code execution

A heap-based buffer overflow in the Windows Text Shaping component allows an unauthorized attacker to execute code over a network. The vulnerability is rated CVSS 9.8 (critical), and according to the CVSS vector no authentication or user interaction is required. The attack surface is not identified in the sources, so exposure depends on which service processes untrusted input that reaches text rendering.

Windows, Windows ESU (Extended Security Updates) · KB5126835 KB5126836 KB5126868 KB5126651 · MSRC

CVE-2026-105014CriticalCVSS 9.1Public exploitRemote code execution

Microsoft Azure Pipelines: Remote code execution via command injection

Azure Pipelines, Microsoft's CI/CD platform, contains a command injection flaw (CWE-77) that allows an unauthenticated attacker to execute code over the network. According to the CVSS vector, no privileges or user interaction are needed and the impact on confidentiality and integrity is high. Microsoft documents this CVE as a cloud service issue for which no customer action is required; the scope for self-hosted agents and on-premises Azure DevOps Server is unknown.

Developer tools (.NET, Visual Studio …) · MSRC

Exploitation more likely according to Microsoft

CVE-2026-70279ImportantCVSS 9.3Spoofing

Microsoft Exchange Server: Cross-site scripting allows spoofing

Microsoft Exchange Server on-premises contains a cross-site scripting (XSS) flaw (CWE-79) that allows spoofing of Exchange web pages. An unauthenticated remote attacker can exploit it, but a victim must act, for example by clicking a crafted link, and the CVSS score is 9.3 (critical) with changed scope and high confidentiality and integrity impact. Microsoft's description states that the impact is spoofing rather than code execution. NVD analysis was still pending at publication.

Windows ESU (Extended Security Updates), Server software (Exchange, SharePoint …) · KB5128896 KB5128897 KB5128898 KB5128895 · MSRC

Show 24 more

Show all 1,475 CVEs of this month

By impact

  • Elevation of privilege687
  • Remote code execution350
  • Information disclosure262
  • Denial of service72
  • Security feature bypass43
  • Spoofing31
  • Tampering29
  • Other1

By product family

  • Windows1,122
  • Microsoft Office210
  • Developer tools (.NET, Visual Studio …)65
  • SQL Server22
  • Browser (Edge)18
  • Azure12
  • Windows ESU (Extended Security Updates)7
  • Microsoft Dynamics5

History of the last 24 months

  • Critical
  • High
  • Medium
  • Low
  • exploited (zero-day)
05001,0001,500November 2024: 97 CVE, 7 critical, 3 exploited (zero-day)3Nov 24December 2024: 75 CVE, 19 critical, 1 exploited (zero-day)1January 2025: 165 CVE, 13 critical, 3 exploited (zero-day)3February 2025: 66 CVE, 6 critical, 3 exploited (zero-day)3Feb 25March 2025: 65 CVE, 10 critical, 6 exploited (zero-day)6April 2025: 132 CVE, 17 critical, 1 exploited (zero-day)1May 2025: 80 CVE, 11 critical, 5 exploited (zero-day)5May 25June 2025: 72 CVE, 13 critical, 1 exploited (zero-day)1July 2025: 137 CVE, 17 critical, 1 exploited (zero-day)1August 2025: 116 CVE, 19 critical, 0 exploited (zero-day)Aug 25September 2025: 94 CVE, 13 critical, 0 exploited (zero-day)October 2025: 180 CVE, 18 critical, 2 exploited (zero-day)2November 2025: 71 CVE, 12 critical, 1 exploited (zero-day)1Nov 25December 2025: 65 CVE, 8 critical, 1 exploited (zero-day)1January 2026: 124 CVE, 17 critical, 2 exploited (zero-day)2February 2026: 61 CVE, 7 critical, 6 exploited (zero-day)6Feb 26March 2026: 97 CVE, 19 critical, 0 exploited (zero-day)April 2026: 181 CVE, 23 critical, 2 exploited (zero-day)2May 2026: 162 CVE, 46 critical, 3 exploited (zero-day)3May 26June 2026: 220 CVE, 49 critical, 0 exploited (zero-day)July 2026: 663 CVE, 75 critical, 3 exploited (zero-day)3August 2026: 457 CVE, 84 critical, 1 exploited (zero-day)1Aug 26September 2026: 998 CVE, 131 critical, 2 exploited (zero-day)2October 2026: 1,475 CVE, 94 critical, 1 exploited (zero-day)1Oct 26

Number of Microsoft CVEs per Patch Tuesday by severity; the red dot shows the number of vulnerabilities already exploited. Click a month for the details.

MonthCVECriticalExploited (zero-day)Publicly disclosedHighest CVSS
October 20261,475941110.0
September 20269981312010.0
August 2026457841310.0
July 2026663753110.0
June 2026220490410.0
May 2026162463310.0
April 2026181232110.0
March 202697190210.0
February 2026617639.8
January 202612417219.9
December 20256581210.0
November 202571121010.0
October 2025180182110.0
September 202594130110.0
August 2025116190110.0
July 202513717119.9
June 20257213119.8
May 202580115210.0
April 202513217109.9
March 20256510619.3
February 2025666329.0
January 202516513359.9
December 20247519119.8
November 2024977339.9

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed