October 2026
Microsoft shipped 240 fixes in its October 2026 security updates. 7 are Critical severity, under active exploitation, or were publicly disclosed before a fix shipped — those are listed below. The rest: 232 fixes to open-source packages bundled for Microsoft’s Azure Linux container distro, 0 Chromium fixes shipped through Microsoft Edge, and 1 lower-severity, non-exploited, non-publicly-disclosed fixes to Microsoft products — are counted here but not listed row by row.
Built by Daily CISO from Microsoft’s own update guide for this release (initial release October 2, 2026, last revised October 8, 2026); not an official Microsoft page. The full 240-fix list, including every Azure Linux and Edge/Chromium entry, is on Microsoft’s own page, linked above.
CVE-2026-96207: Microsoft Partner Center Elevation of Privilege Vulnerability
Critical
Microsoft Partner Center
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-94510: Microsoft Bookings Elevation of Privilege Vulnerability
Critical
Azure API Center
CVSS 9.9 · Microsoft says no customer action required
CVE-2026-77900: Azure App Service Remote Code Execution Vulnerability
Critical
Azure App Service for Linux
CVSS 9.8 · Microsoft says no customer action required
CVE-2026-88131: Microsoft Dataverse Remote Code Execution Vulnerability
Critical
Microsoft Dataverse
CVSS 9.8 · Microsoft says no customer action required
CVE-2026-69435: Azure SRE Agent Elevation of Privilege Vulnerability
Critical
Azure SRE Agent
CVSS 9.6 · Microsoft says no customer action required
CVE-2026-83943: Azure API Center Information Disclosure Vulnerability
Critical
Azure API Center
CVSS 8.7 · Microsoft says no customer action required
CVE-2026-83947: Azure Event Grid Spoofing Vulnerability
Critical
Azure Event Grid System
CVSS 7.7 · Microsoft says no customer action required