Microsoft Patch Tuesday October 2026: 348 CVEs, none exploited
Microsoft’s Patch Tuesday October 2026 release covers 348 CVEs, of which 104 are rated Critical, 90 Important, 132 Moderate and 22 Low. The release data lists no actively exploited zero-days and no publicly disclosed flaws, so there is no emergency deadline this month. The volume is still large, and most entries are third-party and Linux components shipped with Azure Linux rather than classic Windows bugs. Details are in the Microsoft Security Response Center release notes.
Zero-days and actively exploited flaws
The October data shows zero actively exploited vulnerabilities and zero publicly disclosed zero-days. No entry in this release is marked as exploited, and CISA KEV and EPSS data in our candidate set is empty for it. That can change after release, so recheck the CISA KEV catalog in the days after you deploy.
Why this matters
Analysis, not new facts: a month without zero-days lets teams patch by exposure instead of by emergency. The most realistic risk is internet-facing Apache HTTP Server instances and Linux hosts using the SMB client, because the Critical entries cluster there with a CVSS of 9.8. Two cloud-service flaws, in Partner Center and Bookings, have the highest scores of the month, so confirm with your Microsoft contacts whether any tenant action is required.
Patch first: top priorities
- CVE-2026-96207, Microsoft Partner Center elevation of privilege, CVSS 10.0, the highest score this month.
- CVE-2026-94510, Microsoft Bookings elevation of privilege, CVSS 9.9.
- CVE-2026-56154, Apache HTTP Server mod_rewrite use-after-free, CVSS 9.8, in a web server that is often internet-facing.
- CVE-2026-57941, Apache HTTP Server mod_http2 use-after-free and wild write, CVSS 9.8.
- CVE-2026-98167, Linux kernel SMB client flaw in compound encrypted PDUs, CVSS 9.8, one of five SMB client kernel fixes scored 9.8 (CVE-2026-98167 to CVE-2026-98174).
Critical vulnerabilities
| CVE | Product | Impact | CVSS |
|---|---|---|---|
| CVE-2026-96207 | Microsoft Partner Center | Elevation of privilege | 10.0 |
| CVE-2026-94510 | Microsoft Bookings | Elevation of privilege | 9.9 |
| CVE-2026-56154 | Apache HTTP Server | mod_rewrite use-after-free | 9.8 |
| CVE-2026-57941 | Apache HTTP Server | mod_http2 use-after-free | 9.8 |
| CVE-2026-59797 | Apache HTTP Server | mod_ssl SSLRequire allows an .htaccess file function | 9.8 |
| CVE-2026-56857 | Go os package | Root.Mkdir(All) can follow junctions out of the root on Windows | 9.8 |
| CVE-2026-78663 | Go net/http | Double flow control refund on HTTP/2 server streams | 9.1 |
| CVE-2026-98167 | Linux kernel SMB client | server total_read for compound encrypted PDUs | 9.8 |
| CVE-2026-98171 | Linux kernel SMB client | next_buffer use-after-free, NextCommand bounds | 9.8 |
| CVE-2026-98181 | Linux kernel drm/gud | Out-of-bounds write | 9.8 |
| CVE-2026-98186 | Linux kernel wifi mwifiex | Cipher OUI walk not bounded to the IE length | 9.8 |
| CVE-2026-83632 | Apache Thrift C++ | THttpTransport line buffer grows without bound | Not scored |
| CVE-2026-108266 | Privasys rustls fork | RA-TLS attestation not bound to the TLS session | Not scored |
This is a selection of the 104 Critical entries, not the full list. The release data does not describe a Windows attack vector for most of these, so check the advisory for each CVE against the products you run.
By the numbers
| Severity | Count |
|---|---|
| Critical | 104 |
| Important | 90 |
| Moderate | 132 |
| Low | 22 |
| Impact label | Count |
|---|---|
| Not disclosed in the data | 340 |
| Elevation of privilege | 4 |
| Remote code execution | 2 |
| Information disclosure | 1 |
| Spoofing | 1 |
| Product family (Azure Linux 3) | CVEs |
|---|---|
| kernel | 172 |
| httpd | 97 |
| openssh | 10 |
| golang | 9 |
| moby-engine | 8 |
| msgpack | 7 |
| telegraf | 7 |
| cups | 6 |
The kernel and httpd families account for 269 of the 348 CVEs. Note that the httpd family label also groups several unrelated libraries, so it is a grouping in the data, not only Apache itself.
What to do
- Inventory first: find Azure Linux 3 hosts, containers and any Apache HTTP Server instances, since they hold most of this month’s fixes.
- Patch internet-facing Apache HTTP Server hosts within the first rollout ring, ahead of internal servers.
- Update Linux kernels that use the SMB client or wireless and GPU drivers, and plan the reboots.
- Check Partner Center and Bookings in the MSRC guide and confirm whether any customer action is needed.
- Hunt for crashes in Apache worker processes and unexpected SMB client errors after patching, as a sign of attempted exploitation or a bad update.
- Recheck CISA KEV during the week. If any of these CVEs is added, move it to an emergency patch.
