Microsoft's October 2026 Patch Tuesday fixes 1,413 Microsoft CVEs. That is a new record, set only one month after September's previous high of 974, and it represents a jump of roughly 45%.   The release covers Windows, Microsoft 365 and Office, SharePoint Server, SQL Server, Exchange Server, Azure, Defender and developer tools. It also republishes one non-Microsoft CVE. Two of the fixes are zero-days: one is under active exploitation and the other has been publicly disclosed. 

Severity Breakdown for October 2026 Patch Tuesday 

Of the 1,408 CVEs with severity ratings, 78 are Critical, 1,329 are Important and one is Moderate. All 1,408 require customers to install an update. Sixty-five of the Critical flaws allow remote code execution (RCE). The other 13 involve elevation of privilege or spoofing.  Elevation of privilege leads with 673 CVEs. It is followed by remote code execution (315), information disclosure (252), denial of service (72), security feature bypass (40), tampering (29) and spoofing (27). The first two types make up about 70% of the release. That combination is dangerous because RCE gives an attacker initial access and privilege escalation turns that access into full control.  Windows accounts for 1,102 vulnerabilities across 39 updates. The rest break down as follows: Office (134 vulnerabilities, 11 updates), developer tools (61, 60), SharePoint Server (36, 1), other products (32, 25), SQL Server (22, 8), Azure (15, 20), Exchange Server (7, 8), Defender (4, 3) and Edge (0, 1). Together that comes to 1,414 vulnerabilities and 176 updates. Microsoft's own figures don't fully match. The release notes cite 1,413, the product breakdown totals 1,414 and the published CVE list contains 1,411. This article uses the release-notes figure. 

Two Zero-Days, Both Rated Important 

CVE-2026-96951 is a security feature bypass in Windows Shell, and attackers are actively exploiting it. It defeats Mark of the Web, which means malicious files arriving by email or chat can open without the usual warnings. Users still have to open the file, so the flaw works well alongside phishing. It should be patched on every Windows endpoint first. CVE-2026-108398 affects the .NET Framework. It has been publicly disclosed but has not been exploited. It could let an authenticated attacker bypass Windows Defender Application Control and run code inside a protected process. That makes it a concern for organizations that rely on allowlisting to contain intruders. Both flaws are rated only Important, which shows that exploit status should matter more than severity labels. Neither appeared in CISA's Known Exploited Vulnerabilities catalog at publication, although additions often follow within days.

Critical Flaws in Network, Identity and SharePoint Server 

Windows DHCP Server has five Critical RCE flaws: CVE-2026-96934, CVE-2026-88117, CVE-2026-88120, CVE-2026-88119 and CVE-2026-88171. The DHCP Client has one more (CVE-2026-70250). Several other network services also carry Critical RCEs: Microsoft QUIC (CVE-2026-105016, CVE-2026-100219), Remote Desktop Gateway (CVE-2026-70187), Message Queuing (CVE-2026-108460, CVE-2026-100202) and RMCAST (CVE-2026-69789). Systems reachable from outside the network should be patched early.  Identity services are affected too. Active Directory Domain Services (CVE-2026-70229) and NDES (CVE-2026-69802) have RCE flaws, and AD FS has two spoofing bugs (CVE-2026-108131, CVE-2026-96222). Exchange Server (CVE-2026-70571) and Windows Deployment Services (CVE-2026-88174) each have a Critical RCE. SharePoint Server has a Critical elevation-of-privilege flaw (CVE-2026-102866).  Hyper-V receives fixes for host-level RCE (CVE-2026-102214, CVE-2026-105733), which could put every guest VM at risk, and for privilege escalation (CVE-2026-108399). VBS Enclave has five Critical elevation-of-privilege flaws: CVE-2026-108471, CVE-2026-108130, CVE-2026-102211, CVE-2026-96914 and CVE-2026-88074. Four more affect the Windows Kernel, Graphics Kernel, ALPC and the WSL Linux kernel (CVE-2026-96913, CVE-2026-88073, CVE-2026-83917, CVE-2026-62840), and these could give an attacker SYSTEM or root access.  Office apps account for 34 Critical RCEs: 19 in Excel, 5 in Outlook, 4 in PowerPoint, 3 in Word and 3 in Visio. The Mark of the Web bypass makes these more dangerous. Another ten affect media and rendering components, including Media Foundation, GDI+, Codecs, Windows PDF, Text Shaping and Raw Image Extension (CVE-2026-96202, CVE-2026-96943). They can be triggered just by opening a crafted file, with no macros involved. The PostScript Printer Driver, which is often overlooked, has three more (CVE-2026-70153, CVE-2026-70147, CVE-2026-108467). 

Microsoft’s August 2026 Patch Tuesday release addresses roughly 400 security flaws across its products, including three Zero-days. One of the three is being actively exploited, while the other two were publicly disclosed before Microsoft issued fixes.  The August 2026 Patch Tuesday update includes 42 vulnerabilities rated “Critical.” Of those, 37 involve remote code execution, and five involve elevation of privilege. The vulnerability breakdown is approximately 176 elevation-of-privilege flaws, 11 security-feature bypasses, 110 remote-code-execution flaws, 86 information-disclosure issues, 12 denial-of-service vulnerabilities, and 21 spoofing vulnerabilities.  Although smaller than July’s 570-flaw release, the August 2026 Patch Tuesday remains unusually large. Microsoft has previously warned that security updates could increase as its AI-powered vulnerability discovery system identifies additional flaws across its software products. 

August 2026 Patch Tuesday Zero-days 

Microsoft defines a zero-day as a vulnerability that has been publicly disclosed or actively exploited before an official fix is available. The three Zero-days addressed in August 2026 are:  CVE-2026-68820 — Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability: This actively exploited flaw allows a locally authenticated attacker to trigger a race condition through a specially crafted application and obtain SYSTEM privileges without user interaction.  Microsoft credited Moshe Marelus and David Driker of Check Point. Check Point reported that North Korean Lazarus threat actors exploited the flaw in Zero-day attacks to deploy a new version of the FudModule kernel-mode rootkit. “During the intrusion, the threat actor exploited CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of FudModule, Lazarus’ kernel-mode rootkit,” Check Point said. Microsoft has not disclosed exploitation details.  CVE-2026-62832 — Windows User Profile Service Elevation of Privilege Vulnerability: This publicly disclosed flaw can allow an authenticated attacker with credentials for another local account to load another user’s registry hive, potentially access or modify data and gain administrator privileges. Microsoft credited an anonymous researcher. The details match the “LegacyHive” Zero-day disclosed last month by researcher Nightmare Eclipse.  CVE-2026-72971 — Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability: This publicly disclosed flaw involves improper link resolution and allows authenticated attackers to perform local tampering. Microsoft attributed its discovery to yhw and txz but did not identify where the vulnerability was disclosed. 

August 2026 Security Updates 

Microsoft’s August 2026 release consists of 421 Microsoft CVEs spanning Azure, Defender, Developer Tools, Exchange Server, Office, Office 2016, Other, SharePoint Server and Windows. Windows accounts for 236 vulnerabilities, Office for 98, SharePoint Server for 30, Developer Tools for 26, Azure for 17, Exchange Server for seven, Other for six, and Defender for one.  The release also republishes two non-Microsoft CVEs: CVE-2026-6726 and CVE-2026-6727, both tagged as Windows TPM issues by MITRE. FAQs are available for both, while no workarounds or mitigations are listed.  Separate non-security releases include Windows 11 KB5121003 and KB5120240 cumulative updates and the Windows 10 KB5120249 extended security update.