Patch TuesdayMicrosoft's monthly security release, by update and product, as the Security Update Guide states it. Nothing is generated.
Your Windows releases from the fleet
- Windows 11, version 26H2 — KB5127648 (3025 CVEs, 3 exploited · build 10.0.26100.9711)
- Windows 11, version 25H2 — KB5127648 (3025 CVEs, 3 exploited · build 10.0.26100.9711), KB5124008 (20 CVEs · build 10.0.26200.9445), KB5101650 (2 CVEs · build 10.0.26200.8875)
- Windows 11, version 24H2 — KB5127648 (3025 CVEs, 3 exploited · build 10.0.26100.9711), KB5124008 (20 CVEs · build 10.0.26200.9445), KB5101650 (2 CVEs · build 10.0.26200.8875)
- Windows 11, version 23H2 — KB5126653 (965 CVEs, 1 exploited · build 10.0.22631.7652), KB5122880 (9 CVEs · build 10.0.22631.7582), KB5099414 (1 CVEs · build 10.0.22631.7376)
By update 150 in October 2026
| Update | Products | CVEs | Critical | Exploited |
|---|---|---|---|---|
| KB5127648 · 10.0.26100.9711 | Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 Version 26H2 | 3025 | 75 | 3 |
| KB5126657 · 10.0.19044.7807 | Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2, Windows 10 Version 22H2 for 32-bit Systems, Windows 10 Version 22H2 | 1798 | 44 | 2 |
| KB5126646 · 10.0.26100.33650 | Windows Server 2025, Windows Server 2025 (Server Core installation) | 1041 | 35 | 1 |
| KB5127646 · 10.0.28000.3231 | Windows 11 Version 26H1, Windows 11 version 26H1 | 997 | 25 | 1 |
| KB5126655 · 10.0.20348.5761 | Windows Server 2022, Windows Server 2022 (Server Core installation) | 977 | 33 | 1 |
| KB5126653 · 10.0.22631.7652 | Windows 11 Version 23H2 | 965 | 25 | 1 |
| KB5126651 · 10.0.17763.9376 | Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation) | 918 | 30 | 1 |
| KB5126868 · 10.0.14393.9612 | Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 | 770 | 27 | 1 |
| KB5126836 · 6.3.9600.23470 | Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) | 649 | 23 | 1 |
| Release Notes · 20260925.100 | Outlook.com, azl3 brotli 1.1.0-2 on Azure Linux 3.0, azl3 nodejs 24.21.0-1 on Azure Linux 3.0, Raw Image Extension on Windows 10 Version 1607, Raw Image Extension on Windows 10 Version 1607 for 32-bit Systems, Raw Image Extension on Windows 10 and 28 more | 23 | 8 | 1 |
| Release Notes · 154.0.4258.62 | Microsoft Edge (Chromium-based) | 19 | 2 | 1 |
| KB5126835 · 6.2.9200.26434 | Windows Server 2012, Windows Server 2012 (Server Core installation) | 612 | 21 | |
| Release Notes · 16.0.14334.20974 | Microsoft Office LTSC 2021 for 64-bit editions, Microsoft Office LTSC 2021 for 32-bit editions, Microsoft Office LTSC 2024 for 64-bit editions, Microsoft Office LTSC 2024 for 32-bit editions | 310 | 68 | |
| Release Notes · https://aka.ms/OfficeSecurityReleases | Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft 365 Apps for Enterprise for 32-bit Systems | 162 | 37 | |
| Release Notes · 16.114.26101123 | Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft Office 365 for Mac | 114 | 30 | |
| Release Notes · 18.11.2 | Microsoft Visual Studio 2026 version 18.11, Microsoft Visual Studio 2026 version 18.12, Microsoft Visual Studio 2026 version 18.10 | 51 | 4 | |
| Release Notes · 17.14.43 | Microsoft Visual Studio 2022 version 17.14 | 46 | 3 | |
| KB5002928 · 16.0.10417.20228 | Office Online Server | 44 | 13 | |
| KB5002927 · 16.0.20326.20190 | Microsoft SharePoint Server Subscription Edition | 36 | 2 | |
| Release Notes · 11.0.100-rc.3.26522.148 | .NET 11.0 installed on Windows, .NET 11.0 installed on Linux, .NET 11.0 installed on Mac OS, .NET 11.0 runtime installed on Windows, ASP.NET Core 11.0, .NET 11.0 runtime installed on Linux and 1 more | 34 | 2 | |
| KB5130035 · 9.0.21 | .NET 9.0 runtime installed on Windows, ASP.NET Core 9.0, .NET 9.0 runtime installed on Mac OS, .NET 9.0 runtime installed on Linux | 32 | 1 | |
| KB5130036 · 10.0.13 | ASP.NET Core 10.0, .NET 10.0 runtime installed on Windows, .NET 10.0 runtime installed on Mac OS, .NET 10.0 runtime installed on Linux | 32 | ||
| KB5130034 · 8.0.32 | .NET 8.0 runtime installed on Windows, ASP.NET Core 8.0, .NET 8.0 runtime installed on Mac OS, .NET 8.0 runtime installed on Linux | 29 | 1 | |
| KB5126934 · 16.0.4305.5 | Microsoft SQL Server 2022 for x64-based Systems (CU27) | 21 | ||
| KB5126967 · 17.0.5015.4 | Microsoft SQL Server 2025 for x64-based Systems (CU9) | 21 | ||
| KB5128492 · 17.0.1145.4 | Microsoft SQL Server 2025 for x64-based Systems (GDR) | 21 | ||
| KB5128493 · 16.0.1210.3 | Microsoft SQL Server 2022 for x64-based Systems (GDR) | 21 | ||
| KB5124008 · 10.0.26200.9445 | Windows 11 Version 25H2, Windows 11 Version 24H2 | 20 | 2 | |
| KB5128494 · 15.0.4500.2 | Microsoft SQL Server 2019 for x64-based Systems (CU32) | 19 | ||
| KB5128495 · 15.0.2200.2 | Microsoft SQL Server 2019 for x64-based Systems (GDR) | 19 | ||
| KB5127666 · 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 version 1809 | 18 | 1 | |
| KB5127689 · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 21H2, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 22H2 | 18 | 1 | |
| KB5127690 · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 24H2, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 25H2, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025 | 18 | 1 | |
| KB5127691 · 4.8.9363.0 | Microsoft .NET Framework 4.8.1 on Windows 11 version 26H1 | 18 | 1 | |
| KB5127692 · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 23H2 | 18 | 1 | |
| KB5127693 · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022 | 18 | 1 | |
| KB5127667 · 4.7.4150.0 | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 | 17 | 1 | |
| KB5127668 · 4.7.4150.0 | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2 | 17 | 1 | |
| KB5127685 · 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 | Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 1809, Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019 | 17 | 1 | |
| KB5127687 · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0 | Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022 | 17 | 1 |
110 more updates, mostly single products; the CVE table below names each.
CVEs 27 of 3238
All components
Mariner 1072Microsoft Edge (Chromium-based) 704Microsoft Office Excel 70Role: DNS Server 52Windows Kernel 46Microsoft Office Word 45Windows Installer 38Microsoft Office SharePoint 37Windows Win32 Kernel Subsystem 36Microsoft Windows Search Component 29.NET 27Windows NTFS 26SQL Server 22Windows Error Reporting 22
| CVE | Severity | CVSS | Component | Title | Update |
|---|---|---|---|---|---|
| CVE-2026-111497disclosed | Critical | 8.1 | .NET | Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder | Release Notes, KB5133964, KB5133965 +10 |
| CVE-2026-92707disclosed | Moderate | 5.3 | .NET | MessagePack-CSharp Denial of Service Vulnerability | Release Notes, Release Notes, Release Notes +5 |
| CVE-2026-70174 | Important | 8.8 | .NET | .NET Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +21 |
| CVE-2026-83520 | Important | 8.8 | .NET | .NET Remote Code Execution Vulnerability | Release Notes, KB5127689, KB5127690 +21 |
| CVE-2026-87697 | Important | 8.8 | .NET | .NET Remote Code Execution Vulnerability | Release Notes, KB5130036, KB5130034 +3 |
| CVE-2026-96224 | Important | 8.8 | .NET | .NET Remote Code Execution Vulnerability | Release Notes, Release Notes, Release Notes +21 |
| CVE-2026-96235 | Important | 8.8 | .NET | .NET Remote Code Execution Vulnerability | KB5130036, KB5130034, KB5130035 +3 |
| CVE-2026-96957 | Important | 8.8 | .NET | .NET Security Feature Bypass Vulnerability | KB5130036, Release Notes, Release Notes +1 |
| CVE-2026-70197 | Important | 8.1 | .NET | .NET and Visual Studio Remote Code Execution Vulnerability | Release Notes, Release Notes, KB5130036 +11 |
| CVE-2026-96225 | Important | 7.8 | .NET | .NET Elevation of Privilege Vulnerability | KB5130034, KB5130036, Release Notes +3 |
| CVE-2026-96231 | Important | 7.8 | .NET | .NET Elevation of Privilege Vulnerability | Release Notes, Release Notes, KB5130034 +3 |
| CVE-2026-58280 | Important | 7.5 | .NET | .NET Denial of Service Vulnerability | KB5130035, KB5130034, KB5130036 +21 |
| CVE-2026-69651 | Important | 7.5 | .NET | .NET Denial of Service Vulnerability | KB5127696, KB5127660, KB5127664 +21 |
| CVE-2026-84008 | Important | 7.5 | .NET | .NET Denial of Service Vulnerability | Release Notes, Release Notes, Release Notes +21 |
| CVE-2026-96232 | Important | 7.5 | .NET | .NET Information Disclosure Vulnerability | Release Notes, KB5130036, KB5130034 +3 |
| CVE-2026-96237 | Important | 7.5 | .NET | .NET Remote Code Execution Vulnerability | Release Notes, Release Notes, KB5130034 +2 |
| CVE-2026-96958 | Important | 7.5 | .NET | .NET Denial of Service Vulnerability | KB5127689, KB5127690, KB5127691 +20 |
| CVE-2026-96959 | Important | 7.5 | .NET | .NET Denial of Service Vulnerability | Release Notes, Release Notes, Release Notes +20 |
| CVE-2026-96960 | Important | 7.5 | .NET | .NET Denial of Service Vulnerability | Release Notes, Release Notes, Release Notes +20 |
| CVE-2026-70161 | Important | 7.3 | .NET | .NET Elevation of Privilege Vulnerability | Release Notes, KB5130035, KB5130036 +2 |
| CVE-2026-70190 | Important | 7.3 | .NET | .NET Elevation of Privilege Vulnerability | KB5130035, KB5130036, Release Notes +2 |
| CVE-2026-70165 | Important | 6.7 | .NET | .NET Elevation of Privilege Vulnerability | Release Notes, Release Notes, KB5130035 +2 |
| CVE-2026-96229 | Important | 6.5 | .NET | .NET Information Disclosure Vulnerability | Release Notes, Release Notes, Release Notes +3 |
| CVE-2026-96238 | Important | 6.5 | .NET | .NET Security Feature Bypass Vulnerability | KB5130035, Release Notes, KB5130034 +3 |
| CVE-2026-66822 | Important | 5.9 | .NET | .NET Information Disclosure Vulnerability | Release Notes, KB5130036, KB5130034 +3 |
| CVE-2026-70162 | Important | 5.9 | .NET | .NET Denial of Service Vulnerability | Release Notes, Release Notes, Release Notes +3 |
| CVE-2026-96234 | Important | 5.3 | .NET | .NET Information Disclosure Vulnerability | KB5130036, KB5130034, KB5130035 +3 |
Revised by Microsoft 2026-10-28. "Exploited" and "disclosed" are Microsoft's own words from the guide's exploitability index; a CVE's page carries NVD's, CISA's and the public exploit indexes' besides.