Microsoft Patch Tuesday, October 2026: the CVEs, page 15

Microsoft Patch Tuesday October 2026: the CVEs Microsoft published on 13 October 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Sep 2026, Aug 2026, Jul 2026, Jun 2026, May 2026, Apr 2026, Mar 2026, Feb 2026, Jan 2026, Dec 2025, Nov 2025, Oct 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 8.8CVE-2026-100209EPSS 0.9%2026-10-13

   Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

2. 7.3CVE-2026-100207EPSS 0.4%2026-10-13

   Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.

3. 7.1CVE-2026-100205EPSS 0.4%2026-10-13

   Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.

4. 7.0CVE-2026-100203EPSS 0.3%2026-10-13

   Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.

5. 9.8CVE-2026-100202EPSS 1.1%2026-10-13

   Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.

6. 7.0CVE-2026-100201EPSS 0.3%2026-10-13

   Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.

7. 7.0CVE-2026-100200EPSS 0.3%2026-10-13

   Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.