Recommendations for the October 2026 Regular Security Updates for the Microsoft Product Family

Microsoft addressed vulnerabilities in several products through its October 2026 regular security updates and security bulletins released on October 16.

• Affected products include Windows, Microsoft Edge (Chromium-based), Microsoft Office, .NET, ASP.NET Core, Visual Studio 2022/2026, Azure Linux, Microsoft Power Apps for Android, and Office Online Server.
• The vulnerabilities addressed include 17 Critical and 107 Important vulnerabilities.
• The main vulnerability types are remote code execution, privilege escalation, denial of service, and spoofing.
• Microsoft Power Apps includes CVE-2026-70213, an “Important”-rated remote code execution vulnerability.
• Microsoft Edge (Chromium-based) contains numerous vulnerabilities rated Critical, Important, Low, and Moderate, including remote code execution vulnerabilities (CVE-2026-85890, CVE-2026-85897, CVE-2026-96198, CVE-2026-96199), a remote code execution vulnerability caused by a double free (CVE-2026-83831), and a remote code execution vulnerability caused by type confusion (CVE-2026-85898).
• .NET includes critical-severity remote code execution vulnerabilities (CVE-2026-70197, CVE-2026-96237).
• ASP.NET Core includes critical-rated denial-of-service vulnerabilities (CVE-2026-70181, CVE-2026-70186).
• Active Directory Federation Services (AD FS) (a service that integrates user authentication) includes critical-level spoofing vulnerabilities (CVE-2026-108131, CVE-2026-96222).
• Windows includes a critical-rated remote code execution vulnerability in the Network Policy Server (NPS) (CVE-2026-85806), a privilege escalation vulnerability in the Windows CD-ROM Driver (CVE-2026-85377), a privilege escalation vulnerability in Windows Installer (CVE-2026-83708), a denial-of-service vulnerability in the Windows Kernel (CVE-2026-70170), a critical-rated remote code execution vulnerability in the Windows Raw Image Extension (CVE-2026-96202), and a privilege escalation vulnerability in the Windows Update Service (CVE-2026-70056), among others.
• Azure Linux includes a critical-rated privilege escalation vulnerability in the KEDA component (CVE-2026-77524) and several low-, moderate-, and important-rated vulnerabilities.
• Vulnerability Patches were provided through the regular security update on October 13, 2026, and additional security bulletins released on October 16, 2026.
• Microsoft recommended applying the updates via Windows Update’s automatic installation or through the product-specific guidance pages.