October 2026 Patch Tuesday
Microsoft's October 2026 security release came out on Tuesday, October 13, 2026. Below: the updates for each Windows version, the holes that were already under attack, and the rest of the release.
Microsoft data read Last revised by Microsoft Oct 16, 2026
Windows 11 and Windows 10
| Update | Applies to | Build after update | CVEs |
|---|---|---|---|
| KB5127648Security Update | Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 Version 26H2 | 26100.9711, 26200.9711, 26300.9711 | 1009 |
| KB5127646Security Update | Windows 11 Version 26H1 | 28000.3231 | 997 |
| KB5126653Security Update | Windows 11 Version 23H2 | 22631.7652 | 965 |
| KB5126651Security Update | Windows 10 Version 1809, Windows Server 2019 | 17763.9376 | 918 |
| KB5126657Security Update | Windows 10 Version 21H2, Windows 10 Version 22H2 | 19044.7807, 19045.7807 | 899 |
| KB5126868Security Update | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016, Windows 10 Version 1607, Windows Server 2016 | 14393.9612 | 768 |
| KB5124008Security Update | Windows 11 Version 24H2, Windows 11 Version 25H2 | 26100.9445, 26200.9445 | 10 |
| KB5124012Security Update | Windows 11 Version 26H1 | 28000.2954 | 10 |
| KB5122880Security Update | Windows 11 Version 23H2 | 22631.7582 | 9 |
| KB5122876Security Update | Windows 10 Version 1809, Windows Server 2019 | 17763.9245 | 7 |
| KB5122878Security Update | Windows 10 Version 21H2, Windows 10 Version 22H2 | 19044.7725, 19045.7725 | 7 |
| KB5123099Security Update | Windows 10 Version 1607, Windows Server 2016 | 14393.9512 | 7 |
| KB5126649Security Update | Windows 10 Version 1607, Windows Server 2016 | 14393.9596 | 2 |
| KB5099538Security Update | Windows 10 Version 1809, Windows Server 2019 | 17763.9020 | 1 |
| KB5099539Security Update | Windows 10 Version 21H2, Windows 10 Version 22H2 | 19044.7548, 19045.7548 | 1 |
| KB5101650Security Update | Windows 11 Version 24H2, Windows 11 Version 25H2 | 26100.8875, 26200.8875 | 1 |
| KB5099414Security Update | Windows 11 Version 23H2 | 22631.7376 | 1 |
| KB5101649Security Update | Windows 11 Version 26H1 | 28000.2525 | 1 |
| KB5099535Security Update | Windows 10 Version 1607, Windows Server 2016 | 14393.9339 | 1 |
Already exploited when fixed
| CVE | Type | CVSS | Severity |
|---|---|---|---|
| CVE-2026-96951Windows Shell Security Feature Bypass Vulnerability | Security Feature Bypass | 8.8 | ExploitedImportant |
Publicly known before the fix
| CVE | Type | CVSS | Severity |
|---|---|---|---|
| CVE-2026-108398.NET Framework Security Feature Bypass Vulnerability | Security Feature Bypass | 8.8 | Important |
Critical fixes with the highest scores
| CVE | Type | CVSS | Severity |
|---|---|---|---|
| CVE-2026-96207Microsoft Partner Center Elevation of Privilege Vulnerability | Elevation of Privilege | 10.0 | Critical |
| CVE-2026-94510Microsoft Bookings Elevation of Privilege Vulnerability | Elevation of Privilege | 9.9 | Critical |
| CVE-2026-100202Windows Message Queuing Queue Manager Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | Critical |
| CVE-2026-100219Microsoft QUIC Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | Critical |
| CVE-2026-105016Microsoft QUIC Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | Critical |
| CVE-2026-70147Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | Critical |
| CVE-2026-70153Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | Critical |
| CVE-2026-70242Microsoft Office Outlook Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | Critical |
| CVE-2026-70291Microsoft Office Outlook Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | Critical |
| CVE-2026-70300Microsoft Office Word Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | Critical |
| CVE-2026-77900Azure App Service Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | Critical |
| CVE-2026-88131Microsoft Dataverse Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | Critical |
Servers and other products
| Update | Applies to | CVEs |
|---|---|---|
| KB5126646Security Update | Windows Server 2025 | 1041 |
| KB5126655Security Update | Windows Server 2022 | 977 |
| KB5126836Security Update | Windows Server 2012 R2 | 649 |
| KB5126835Security Update | Windows Server 2012 | 612 |
| KB5002928Security Update | Office Online Server | 44 |
| KB5002927Security Update | Microsoft SharePoint Server Subscription Edition | 36 |
| KB5130035Security Update | .NET 9.0 installed on Linux, .NET 9.0 installed on Mac OS, .NET 9.0 installed on Windows, ASP.NET Core 9.0 | 31 |
| KB5130036Security Update | .NET 10.0 installed on Linux, .NET 10.0 installed on Mac OS, .NET 10.0 installed on Windows, ASP.NET Core 10.0 | 31 |
| KB5130034Security Update | .NET 8.0 installed on Linux, .NET 8.0 installed on Mac OS, .NET 8.0 installed on Windows, ASP.NET Core 8.0 | 28 |
| KB5126934Security Update | Microsoft SQL Server 2022 (CU27) | 21 |
| KB5126967Security Update | Microsoft SQL Server 2025 (CU9) | 21 |
| KB5128493Security Update | Microsoft SQL Server 2022 (GDR) | 21 |
| KB5128492Security Update | Microsoft SQL Server 2025 (GDR) | 21 |
| KB5128495Security Update | Microsoft SQL Server 2019 (GDR) | 19 |
| KB5128494Security Update | Microsoft SQL Server 2019 (CU32) | 19 |
| KB5127666Security Update | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 version 1809 | 18 |
| KB5127685Security Update | Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 1809, Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019 | 18 |
| KB5127683Security Update | Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 21H2, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 22H2 | 18 |
| KB5127687Security Update | Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022 | 18 |
| KB5127667Security Update | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 | 18 |
| KB5127668Security Update | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2 | 18 |
| KB5127684Security Update | Microsoft .NET Framework 4.8 on Windows 10 version 1607, Microsoft .NET Framework 4.8 on Windows Server 2016 | 18 |
| KB5127686Security Update | Microsoft .NET Framework 4.8 on Windows Server 2012 | 18 |
| KB5127688Security Update | Microsoft .NET Framework 4.8 on Windows Server 2012 R2 | 18 |
| KB5127689Security Update | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 21H2, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 22H2 | 18 |
| KB5127690Security Update | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 24H2, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 25H2, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025 | 18 |
| KB5127691Security Update | Microsoft .NET Framework 4.8.1 on Windows 11 version 26H1 | 18 |
| KB5127692Security Update | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 23H2 | 18 |
| KB5127693Security Update | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022 | 18 |
| KB5127694Security Update | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 26H2 | 18 |
| KB5127696Security Update | Microsoft .NET Framework 3.5 on Windows 11 version 26H1 | 16 |
| KB5127660Security Update | Microsoft .NET Framework 3.5 on Windows Server 2012 | 16 |
| KB5127664Security Update | Microsoft .NET Framework 3.5 on Windows Server 2012 R2 | 16 |
| KB5128496Security Update | Microsoft SQL Server 2017 (CU31) | 12 |
| KB5128497Security Update | Microsoft SQL Server 2017 (GDR) | 12 |
| KB5122871Security Update | Windows Server 2025 | 8 |
| KB5122882Security Update | Windows Server 2022 | 7 |
| KB5123065Security Update | Windows Server 2012 | 7 |
| KB5123066Security Update | Windows Server 2012 R2 | 7 |
| KB5128897Security Update | Microsoft Exchange Server 2019 Cumulative Update 14 | 6 |
| KB5128898Security Update | Microsoft Exchange Server 2016 Cumulative Update 23 | 6 |
| KB5128895Security Update | Microsoft Exchange Server Subscription Edition RTM | 6 |
| KB5128896Security Update | Microsoft Exchange Server 2019 Cumulative Update 15 | 5 |
| KB5131692Security Update | Skype for Business Server Subscription Edition CU1 | 3 |
| KB5132779Security Update | Skype for Business Server 2015 CU13 | 3 |
| KB5131693Security Update | Skype for Business Server 2019 CU8 | 3 |
| KB5127357Security Update | Windows Server 2012 | 2 |
| KB5127356Security Update | Windows Server 2012 R2 | 2 |
| KB5099540Security Update | Windows Server 2022 | 1 |
| KB5099536Security Update | Windows Server 2025 | 1 |
| KB5099445Monthly Rollup | Windows Server 2012 | 1 |
| KB5099444Monthly Rollup | Windows Server 2012 R2 | 1 |
| KB5129957Security Update | Microsoft Exchange Server 2019 Cumulative Update 14 | 1 |
| KB5129958Security Update | Microsoft Exchange Server 2016 Cumulative Update 23 | 1 |
| KB5129955Security Update | Microsoft Exchange Server Subscription Edition RTM | 1 |
| KB5129956Security Update | Microsoft Exchange Server 2019 Cumulative Update 15 | 1 |
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
0 comments
…