October 2026 Monthly Patch

CVE-2026-96207

Microsoft Partner Center Elevation of Privilege Vulnerability

10.0

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96207 (opens in new tab)

CVE-2026-94510

Microsoft Bookings Elevation of Privilege Vulnerability

9.9

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-94510 (opens in new tab)

CVE-2026-98370

xfrm: fix compat ALLOCSPI request use-after-free

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98370 (opens in new tab)

CVE-2026-98191

wifi: wlcore: release runtime PM ref on regdomain config failure

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98191 (opens in new tab)

CVE-2026-98192

wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98192 (opens in new tab)

CVE-2026-98351

wifi: virt_wifi: free skb when disconnected

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98351 (opens in new tab)

CVE-2026-98311

wifi: virt_wifi: don't transfer operstate before register

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98311 (opens in new tab)

CVE-2026-98188

wifi: p54: validate curve data length in the calibration curve converters

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98188 (opens in new tab)

CVE-2026-98187

wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98187 (opens in new tab)

CVE-2026-98186

wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98186 (opens in new tab)

CVE-2026-98331

wifi: mac80211: unlist vifs when their netdev is unregistered

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98331 (opens in new tab)

CVE-2026-98333

wifi: mac80211: reset the LED state when ifup fails

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98333 (opens in new tab)

CVE-2026-98332

wifi: mac80211: only operate on TDLS peers in the TDLS code

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98332 (opens in new tab)

CVE-2026-98327

wifi: mac80211: mesh: reset the CSA state when leaving

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98327 (opens in new tab)

CVE-2026-98326

wifi: mac80211: mesh: release the channel if start fails

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98326 (opens in new tab)

CVE-2026-98337

wifi: mac80211: don't start a ROC while scanning

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98337 (opens in new tab)

CVE-2026-98336

wifi: mac80211: don't offload TC setup on AP_VLAN interfaces

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98336 (opens in new tab)

CVE-2026-98329

wifi: mac80211: don't allow injecting frames wider than the chanctx

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98329 (opens in new tab)

CVE-2026-98328

wifi: mac80211: add HE 6 GHz capability in the scan elems len

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98328 (opens in new tab)

CVE-2026-98335

wifi: mac80211: abort chanswitch when leaving a mesh

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98335 (opens in new tab)

CVE-2026-98348

wifi: libipw: reject too-short association responses

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98348 (opens in new tab)

CVE-2026-98193

wifi: libipw: reject TKIP frames without a full MIC

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98193 (opens in new tab)

CVE-2026-98340

wifi: cfg80211: only group hidden BSSes with beacon entries

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98340 (opens in new tab)

CVE-2026-98338

wifi: cfg80211: ibss: ref BSS entry for joined event

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98338 (opens in new tab)

CVE-2026-98330

wifi: cfg80211: get the wiphy out of a dying network namespace

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98330 (opens in new tab)

CVE-2026-98341

wifi: cfg80211: don't free driver-owned scan requests

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98341 (opens in new tab)

CVE-2026-98339

wifi: cfg80211: don't filter by BSS type when removing stale entries

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98339 (opens in new tab)

CVE-2026-98345

wifi: cfg80211: check IP header size in cfg80211_classify8021d()

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98345 (opens in new tab)

CVE-2026-98255

tcp: exclude old ACKs from tcp fast path

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98255 (opens in new tab)

CVE-2026-98254

swiotlb: use the adjusted address for the highmem page lookup

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98254 (opens in new tab)

CVE-2026-98172

smb: client: fix smbd_connection leak on cifs_get_tcp_session() error

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98172 (opens in new tab)

CVE-2026-98167

smb: client: fix server->total_read for compound encrypted PDUs

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98167 (opens in new tab)

CVE-2026-98174

smb: client: fix rlist race and missing initialization

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98174 (opens in new tab)

CVE-2026-98168

smb: client: fix reparse buffer bounds in cifs_query_reparse_point()

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98168 (opens in new tab)

CVE-2026-98171

smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98171 (opens in new tab)

CVE-2026-98170

smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98170 (opens in new tab)

CVE-2026-98214

selinux: recheck intermediate backing files on mprotect()

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98214 (opens in new tab)

CVE-2026-98215

selinux: preserve user SID across nested backing files

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98215 (opens in new tab)

CVE-2026-98232

scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98232 (opens in new tab)

CVE-2026-98287

pppoatm: ensure a writable skb header and linear data

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98287 (opens in new tab)

CVE-2026-98282

powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98282 (opens in new tab)

CVE-2026-98251

openvswitch: avoid reallocating confirmed conntrack labels

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98251 (opens in new tab)

CVE-2026-98322

netfilter: nft_nat: fully initialise new_addr in netmap setup

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98322 (opens in new tab)

CVE-2026-98321

netfilter: nf_nat: unregister and release hooks on error

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98321 (opens in new tab)

CVE-2026-98320

netfilter: flowtable: hold reference on ct until flow is released

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98320 (opens in new tab)

CVE-2026-98238

net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98238 (opens in new tab)

CVE-2026-98288

net: stmmac: fix TSO header length truncation

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98288 (opens in new tab)

CVE-2026-98272

net: mvpp2: prevent buffer overflow in page_pool allocation

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98272 (opens in new tab)

CVE-2026-98275

net: ethernet: cortina: Ack RX overrun interrupt correctly

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98275 (opens in new tab)

CVE-2026-98301

net: bridge: mst: move switchdev call outside rcu

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98301 (opens in new tab)

CVE-2026-98304

net: bcmgenet: restore the hardware filters on open

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98304 (opens in new tab)

CVE-2026-98233

net/packet: clear RX owner on VNET header error

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98233 (opens in new tab)

CVE-2026-98317

neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98317 (opens in new tab)

CVE-2026-98207

mmc: spi: reset bytes_xfered before retrying CRC failures

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98207 (opens in new tab)

CVE-2026-98209

mmc: sdhci-of-aspeed: Remove children before releasing SDC resources

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98209 (opens in new tab)

CVE-2026-98211

mmc: mmci: Fix use-after-free in busy-timeout work

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98211 (opens in new tab)

CVE-2026-98212

mmc: hsq: Fix use-after-free in retry work

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98212 (opens in new tab)

CVE-2026-98303

ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98303 (opens in new tab)

CVE-2026-98199

hwmon: (pmbus/core) increase number of phases and add new mask

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98199 (opens in new tab)

CVE-2026-98363

firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98363 (opens in new tab)

CVE-2026-98368

esp: downgrade zerocopy managed frags before mutating skb frags

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98368 (opens in new tab)

CVE-2026-98319

drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98319 (opens in new tab)

CVE-2026-98180

drm/msm: RCU-free the scheduler-containing ring and VM objects

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98180 (opens in new tab)

CVE-2026-98181

drm/gud: fix out-of-bounds write in gud_plane_atomic_check()

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98181 (opens in new tab)

CVE-2026-98176

drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98176 (opens in new tab)

CVE-2026-98177

drm/amdkfd: Avoid integer underflow in EOP ring size calculation.

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98177 (opens in new tab)

CVE-2026-98179

drm/amdgpu: fix rmmio iounmap skipped on device removal

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98179 (opens in new tab)

CVE-2026-98270

drm/amdgpu: check ras and obj before dereference

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98270 (opens in new tab)

CVE-2026-98298

dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98298 (opens in new tab)

CVE-2026-98362

clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98362 (opens in new tab)

CVE-2026-98279

btrfs: handle lack of space when cleaning up verity items

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98279 (opens in new tab)

CVE-2026-98269

btrfs: abort transaction on failure to update inode for hole punching and reflinking

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98269 (opens in new tab)

CVE-2026-98249

arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98249 (opens in new tab)

CVE-2026-98289

af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98289 (opens in new tab)

CVE-2026-97814

Windows Text Shaping Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97814 (opens in new tab)

CVE-2026-100202

Windows Message Queuing Queue Manager Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-100202 (opens in new tab)

CVE-2026-96934

Windows DHCP Server Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96934 (opens in new tab)

CVE-2026-56857

Root.Mkdir(All) can follow junctions out of the root on Windows in os

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56857 (opens in new tab)

CVE-2026-21413

Raw Image Extension Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-21413 (opens in new tab)

CVE-2026-98253

RDMA/ucma: Serialize join and leave on copy_to_user failure

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98253 (opens in new tab)

CVE-2026-98323

RDMA/siw: Bound fragmented header copies by the remaining length

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98323 (opens in new tab)

CVE-2026-98365

RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98365 (opens in new tab)

CVE-2026-98352

RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98352 (opens in new tab)

CVE-2026-98353

RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98353 (opens in new tab)

CVE-2026-98252

RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98252 (opens in new tab)

CVE-2026-105016

Microsoft QUIC Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-105016 (opens in new tab)

CVE-2026-100219

Microsoft QUIC Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-100219 (opens in new tab)

CVE-2026-70153

Microsoft PostScript Printer Driver Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70153 (opens in new tab)

CVE-2026-70147

Microsoft PostScript Printer Driver Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70147 (opens in new tab)

CVE-2026-88178

Microsoft Office PowerPoint Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88178 (opens in new tab)

CVE-2026-97749

Microsoft Office Outlook Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97749 (opens in new tab)

CVE-2026-97016

Microsoft Office Outlook Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97016 (opens in new tab)

CVE-2026-88156

Microsoft Office Outlook Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88156 (opens in new tab)

CVE-2026-70291

Microsoft Office Outlook Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70291 (opens in new tab)

CVE-2026-70242

Microsoft Office Outlook Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70242 (opens in new tab)

CVE-2026-88131

Microsoft Dataverse Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88131 (opens in new tab)

CVE-2026-98283

KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98283 (opens in new tab)

CVE-2026-98221

KEYS: trusted: Fix tpm2_load_cmd() boundary check

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98221 (opens in new tab)

CVE-2026-98222

KEYS: encrypted: fix integer overflow of datablob_len

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98222 (opens in new tab)

CVE-2026-98203

Input: soc_button_array - check btns_desc->package.count

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98203 (opens in new tab)

CVE-2026-98206

Input: cyttsp5 - clamp the HID report size before memcpy

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98206 (opens in new tab)

CVE-2026-98217

IB/mlx4: Fix use-after-free on pkey sysfs registration failure

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98217 (opens in new tab)

CVE-2026-98295

Bluetooth: coredump: Quiesce dump work on unregister

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98295 (opens in new tab)

CVE-2026-98292

Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98292 (opens in new tab)

CVE-2026-77900

Azure App Service Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-77900 (opens in new tab)

CVE-2026-59797

Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-59797 (opens in new tab)

CVE-2026-56154

Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56154 (opens in new tab)

CVE-2026-57941

Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-57941 (opens in new tab)

CVE-2026-98263

ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98263 (opens in new tab)

CVE-2026-98308

ALSA: hda: trace PCM open only after assigning a stream

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98308 (opens in new tab)

CVE-2026-98316

ALSA: bcd2000: Fix race between rawmidi and disconnect

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-98316 (opens in new tab)

CVE-2026-69435

Azure SRE Agent Elevation of Privilege Vulnerability

9.6

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-69435 (opens in new tab)

CVE-2026-78663

Double flow control refund on HTTP/2 server streams in net/http

9.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-78663 (opens in new tab)

CVE-2026-96914

Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96914 (opens in new tab)

CVE-2026-108471

Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108471 (opens in new tab)

CVE-2026-102225

Windows Text Shaping Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-102225 (opens in new tab)

CVE-2026-96943

Windows Raw Image Extension Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96943 (opens in new tab)

CVE-2026-96202

Windows Raw Image Extension Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96202 (opens in new tab)

CVE-2026-100220

Windows Media Video Decoder Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-100220 (opens in new tab)

CVE-2026-96913

Windows Kernel Elevation of Privilege Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96913 (opens in new tab)

CVE-2026-105733

Windows Hyper-V Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-105733 (opens in new tab)

CVE-2026-102214

Windows Hyper-V Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-102214 (opens in new tab)

CVE-2026-88073

Windows Graphics Kernel Elevation of Privilege Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88073 (opens in new tab)

CVE-2026-83934

Windows GDI+ Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-83934 (opens in new tab)

CVE-2026-70250

Windows DHCP Client Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70250 (opens in new tab)

CVE-2026-96952

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96952 (opens in new tab)

CVE-2026-108467

Microsoft PostScript Printer Driver Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108467 (opens in new tab)

CVE-2026-102857

Microsoft Office Visio Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-102857 (opens in new tab)

CVE-2026-102856

Microsoft Office Visio Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-102856 (opens in new tab)

CVE-2026-102855

Microsoft Office Visio Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-102855 (opens in new tab)

CVE-2026-88144

Microsoft Office PowerPoint Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88144 (opens in new tab)

CVE-2026-70215

Microsoft Office PowerPoint Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70215 (opens in new tab)

CVE-2026-97780

Microsoft Office Excel Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97780 (opens in new tab)

CVE-2026-97778

Microsoft Office Excel Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97778 (opens in new tab)

CVE-2026-97765

Microsoft Office Excel Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97765 (opens in new tab)

CVE-2026-97759

Microsoft Office Excel Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97759 (opens in new tab)

CVE-2026-97755

Microsoft Office Excel Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97755 (opens in new tab)

CVE-2026-97745

Microsoft Office Excel Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97745 (opens in new tab)

CVE-2026-97739

Microsoft Office Excel Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-97739 (opens in new tab)

CVE-2026-100211

Microsoft Office Excel Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-100211 (opens in new tab)

CVE-2026-100210

Microsoft Office Excel Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-100210 (opens in new tab)

CVE-2026-100209

Microsoft Office Excel Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-100209 (opens in new tab)

CVE-2026-105718

Microsoft Excel Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-105718 (opens in new tab)

CVE-2026-108400

HEVC Video Extensions Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108400 (opens in new tab)

CVE-2026-83943

Azure API Center Information Disclosure Vulnerability

8.7

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-83943 (opens in new tab)

CVE-2026-70187

Windows Remote Desktop Services Remote Code Execution Vulnerability

8.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70187 (opens in new tab)

CVE-2026-108460

Windows Message Queuing Remote Code Execution Vulnerability

8.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108460 (opens in new tab)

CVE-2026-88174

Windows Deployment Services Remote Code Execution Vulnerability

8.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88174 (opens in new tab)

CVE-2026-88171

Windows DHCP Server Remote Code Execution Vulnerability

8.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88171 (opens in new tab)

CVE-2026-88120

Windows DHCP Server Remote Code Execution Vulnerability

8.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88120 (opens in new tab)

CVE-2026-88119

Windows DHCP Server Remote Code Execution Vulnerability

8.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88119 (opens in new tab)

CVE-2026-88117

Windows DHCP Server Remote Code Execution Vulnerability

8.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88117 (opens in new tab)

CVE-2026-70229

Windows Active Directory Domain Services Remote Code Execution Vulnerability

8.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70229 (opens in new tab)

CVE-2026-69802

Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability

8.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-69802 (opens in new tab)

CVE-2026-108457

Microsoft Windows PDF Remote Code Execution Vulnerability

8.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108457 (opens in new tab)

CVE-2026-88185

Microsoft Office Word Remote Code Execution Vulnerability

8.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88185 (opens in new tab)

CVE-2026-70269

Microsoft Office Word Remote Code Execution Vulnerability

8.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70269 (opens in new tab)

CVE-2026-102866

Microsoft Office SharePoint Elevation of Privilege Vulnerability

8.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-102866 (opens in new tab)

CVE-2026-70571

Microsoft Exchange Server Remote Code Execution Vulnerability

8.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-70571 (opens in new tab)

CVE-2026-88074

Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88074 (opens in new tab)

CVE-2026-108130

Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108130 (opens in new tab)

CVE-2026-100215

Microsoft Graphics Component Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-100215 (opens in new tab)

CVE-2026-83947

Azure Event Grid Spoofing Vulnerability

7.7

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-83947 (opens in new tab)

CVE-2026-69789

Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

7.5

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-69789 (opens in new tab)

CVE-2026-88207

Microsoft Office PowerPoint Remote Code Execution Vulnerability

7.5

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-88207 (opens in new tab)

CVE-2026-108131

Active Directory Federation Services (AD FS) Spoofing Vulnerability

7.5

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108131 (opens in new tab)

CVE-2026-96222

Active Directory Federation Services (AD FS) Spoofing Vulnerability

7.4

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96222 (opens in new tab)

CVE-2026-108399

Windows Hyper-V Elevation of Privilege Vulnerability

7.2

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108399 (opens in new tab)

CVE-2026-102211

Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

7.0

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-102211 (opens in new tab)

CVE-2026-83917

Windows ALPC Elevation of Privilege Vulnerability

7.0

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-83917 (opens in new tab)

CVE-2026-62840

Linux Kernel Elevation of Privilege Vulnerability

7.0

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-62840 (opens in new tab)

CVE-2026-108266

Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

TBD

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108266 (opens in new tab)

CVE-2026-108267

Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

TBD

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-108267 (opens in new tab)

CVE-2026-83632

Apache Thrift: C++ THttpTransport grows its line buffer without bound

TBD

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-83632 (opens in new tab)