1419 vulnerabilities patched by Microsoft in the October 2026 Patch Tuesday release.
Severity Breakdown
- Critical: 77
- Important: 1337
- Low: 1
Actively Exploited (1)
CVE-2026-96951 — Windows Shell Security Feature Bypass Vulnerability
CVSS 8.8 | Windows Shell | Actively Exploited
Publicly Disclosed (2)
- CVE-2026-108398 — .NET Framework Security Feature Bypass Vulnerability (CVSS 8.8, .NET Framework) Advisory
- CVE-2026-92707 — MessagePack-CSharp Denial of Service Vulnerability (CVSS 5.3, .NET) Advisory
Exploitation More Likely (109)
- CVE-2026-70279 — Microsoft Exchange Server Spoofing Vulnerability (CVSS 9.3, Microsoft Exchange Server)
- CVE-2026-100214 — Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability (CVSS 8.8, Dynamics Business Central)
- CVE-2026-102217 — WebDAV Elevation of Privilege Vulnerability (CVSS 8.8, WebDAV)
- CVE-2026-69918 — Windows Core Messaging Elevation of Privilege Vulnerability (CVSS 8.8, Windows Core Messaging)
- CVE-2026-88159 — Windows Background Intelligent Transfer Service (BITS) Remote Code Execution Vulnerability (CVSS 8.8, Windows Background Intelligent Transfer Service (BITS))
- CVE-2026-96940 — Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Exchange Server)
- CVE-2026-70229 — Windows Active Directory Domain Services Remote Code Execution Vulnerability (CVSS 8.1, Active Directory Domain Services)
- CVE-2026-70571 — Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Exchange Server)
- CVE-2026-69673 — Windows Update Elevation of Privilege Vulnerability (CVSS 7.8, Windows Update)
- CVE-2026-69718 — Windows Update Elevation of Privilege Vulnerability (CVSS 7.8, Windows Update)
- CVE-2026-69733 — Windows Update Elevation of Privilege Vulnerability (CVSS 7.8, Windows Update)
- CVE-2026-69783 — Windows Update Elevation of Privilege Vulnerability (CVSS 7.8, Windows Update)
- CVE-2026-69880 — Desktop Window Manager Elevation of Privilege Vulnerability (CVSS 7.8, Desktop Window Manager)
- CVE-2026-69882 — Windows Update Elevation of Privilege Vulnerability (CVSS 7.8, Windows Update)
- CVE-2026-69923 — Windows AI Elevation of Privilege Vulnerability (CVSS 7.8, Windows AI)
- CVE-2026-69926 — Desktop Window Manager Elevation of Privilege Vulnerability (CVSS 7.8, Desktop Window Manager)
- CVE-2026-70054 — Windows NetBIOS Elevation of Privilege Vulnerability (CVSS 7.8, Windows NetBIOS)
- CVE-2026-70060 — Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Windows Win32 Kernel Subsystem)
- CVE-2026-70103 — Windows Error Reporting Elevation of Privilege Vulnerability (CVSS 7.8, Windows Error Reporting)
- CVE-2026-70104 — Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Windows Win32 Kernel Subsystem)
- +89 more
Executive Summary
Microsoft’s October 2026 Patch Tuesday is one of the largest on record, addressing 1,419 vulnerabilities across its product portfolio, with 77 rated Critical and 1,337 rated Important. One vulnerability is confirmed under active exploitation: CVE-2026-96951, a Windows Shell Security Feature Bypass with a CVSS score of 8.8. This zero-day allows attackers to circumvent security controls in the Windows Shell, and given confirmed in-the-wild exploitation, it should be treated as the top patching priority for all Windows endpoint teams. An additional 109 vulnerabilities carry Microsoft’s “Exploitation More Likely” assessment, signaling an unusually broad attack surface that threat actors may target in the near term.
Among the critical-severity findings, several demand immediate attention. CVE-2026-96207 in Microsoft Partner Center carries a perfect CVSS 10.0 and enables elevation of privilege, making it an urgent fix for any organization using Partner Center services. Two Microsoft QUIC remote code execution vulnerabilities (CVE-2026-100219 and CVE-2026-105016, both CVSS 9.8) affect network protocol handling and could be exploited without user interaction. Windows Message Queuing (CVE-2026-100202, CVSS 9.8) presents a network-facing RCE risk for servers with MSMQ enabled. Perhaps most concerning for end-user environments are two Microsoft Outlook RCE vulnerabilities (CVE-2026-70242 and CVE-2026-70291, both CVSS 9.8), which could allow code execution through malicious email content. Organizations running Microsoft PostScript Printer Drivers should also prioritize CVE-2026-70147 and CVE-2026-70153, both CVSS 9.8 RCEs that could be triggered through print operations.
The breadth of this release is notable. Microsoft Office Excel alone accounts for 69 vulnerabilities including 11 Critical, making it the most heavily affected product family. SharePoint, Office Word, and Hyper-V each carry multiple critical-severity issues. DNS Server roles received 52 patches, Windows Kernel 46, and Windows Installer 38, underscoring that both server and desktop infrastructure require attention. The 19 Remote Desktop Client patches are also worth flagging for organizations with remote workforces.
Security teams should prioritize in the following order: first, deploy the patch for the actively exploited Windows Shell zero-day (CVE-2026-96951) across all endpoints immediately. Second, address the Outlook RCEs and QUIC vulnerabilities, as these are network-reachable and require no authentication. Third, schedule accelerated patching for Excel and SharePoint given the volume of critical issues in those products. Server teams responsible for MSMQ, Hyper-V, and DNS infrastructure should coordinate patching windows this week rather than waiting for standard maintenance cycles. Given the 109 “Exploitation More Likely” designations, vulnerability management teams should expect weaponization attempts to emerge rapidly and should not defer any Critical-rated patches beyond the current cycle.
Critical Vulnerabilities
Microsoft Partner Center (1 Critical)
- CVE-2026-96207 — Microsoft Partner Center Elevation of Privilege Vulnerability (CVSS 10.0) Advisory
Microsoft Bookings (1 Critical)
- CVE-2026-94510 — Microsoft Bookings Elevation of Privilege Vulnerability (CVSS 9.9) Advisory
Windows Message Queuing Queue Manager (1 Critical)
- CVE-2026-100202 — Windows Message Queuing Queue Manager Remote Code Execution Vulnerability (CVSS 9.8) Advisory
Microsoft QUIC (2 Critical)
- CVE-2026-100219 — Microsoft QUIC Remote Code Execution Vulnerability (CVSS 9.8) Advisory
- CVE-2026-105016 — Microsoft QUIC Remote Code Execution Vulnerability (CVSS 9.8) Advisory
Windows Raw Image Extension (3 Critical)
- CVE-2026-21413 — Raw Image Extension Remote Code Execution Vulnerability (CVSS 9.8) Advisory
- CVE-2026-96202 — Windows Raw Image Extension Remote Code Execution Vulnerability (CVSS 8.8) Advisory
- CVE-2026-96943 — Windows Raw Image Extension Remote Code Execution Vulnerability (CVSS 8.8) Advisory
Microsoft PostScript Printer Driver (3 Critical)
- CVE-2026-70147 — Microsoft PostScript Printer Driver Remote Code Execution Vulnerability (CVSS 9.8) Advisory
- CVE-2026-70153 — Microsoft PostScript Printer Driver Remote Code Execution Vulnerability (CVSS 9.8) Advisory
- CVE-2026-108467 — Microsoft PostScript Printer Driver Remote Code Execution Vulnerability (CVSS 8.8) Advisory
Microsoft Office Outlook (5 Critical)
- CVE-2026-70242 — Microsoft Office Outlook Remote Code Execution Vulnerability (CVSS 9.8) Advisory
- CVE-2026-70291 — Microsoft Office Outlook Remote Code Execution Vulnerability (CVSS 9.8) Advisory
- CVE-2026-88156 — Microsoft Office Outlook Remote Code Execution Vulnerability (CVSS 9.8) Advisory
- CVE-2026-97016 — Microsoft Office Outlook Remote Code Execution Vulnerability (CVSS 9.8) Advisory
- CVE-2026-97749 — Microsoft Office Outlook Remote Code Execution Vulnerability (CVSS 9.8) Advisory
Azure App Service (1 Critical)
- CVE-2026-77900 — Azure App Service Remote Code Execution Vulnerability (CVSS 9.8) Advisory
Microsoft Dataverse (1 Critical)
- CVE-2026-88131 — Microsoft Dataverse Remote Code Execution Vulnerability (CVSS 9.8) Advisory
Microsoft Office PowerPoint (4 Critical)
- CVE-2026-88178 — Microsoft Office PowerPoint Remote Code Execution Vulnerability (CVSS 9.8) Advisory
- CVE-2026-70215 — Microsoft Office PowerPoint Remote Code Execution Vulnerability (CVSS 8.8) Advisory
- CVE-2026-88144 — Microsoft Office PowerPoint Remote Code Execution Vulnerability (CVSS 8.8) Advisory
- CVE-2026-88207 — Microsoft Office PowerPoint Remote Code Execution Vulnerability (CVSS 7.5) Advisory
Windows DHCP Server (5 Critical)
- CVE-2026-96934 — Windows DHCP Server Remote Code Execution Vulnerability (CVSS 9.8) Advisory
- CVE-2026-88117 — Windows DHCP Server Remote Code Execution Vulnerability (CVSS 8.1) Advisory
- CVE-2026-88119 — Windows DHCP Server Remote Code Execution Vulnerability (CVSS 8.1) Advisory
- CVE-2026-88120 — Windows DHCP Server Remote Code Execution Vulnerability (CVSS 8.1) Advisory
- CVE-2026-88171 — Windows DHCP Server Remote Code Execution Vulnerability (CVSS 8.1) Advisory
Windows Text Shaping (2 Critical)
- CVE-2026-97814 — Windows Text Shaping Remote Code Execution Vulnerability (CVSS 9.8) Advisory
- CVE-2026-102225 — Windows Text Shaping Remote Code Execution Vulnerability (CVSS 8.8) Advisory
Azure SRE Agent (1 Critical)
- CVE-2026-69435 — Azure SRE Agent Elevation of Privilege Vulnerability (CVSS 9.6) Advisory
Microsoft Office Excel (11 Critical)
- CVE-2026-100209 — Microsoft Office Excel Remote Code Execution Vulnerability (CVSS 8.8) Advisory
- CVE-2026-100210 — Microsoft Office Excel Remote Code Execution Vulnerability (CVSS 8.8) Advisory
- CVE-2026-100211 — Microsoft Office Excel Remote Code Execution Vulnerability (CVSS 8.8) Advisory
- CVE-2026-105718 — Microsoft Excel Remote Code Execution Vulnerability (CVSS 8.8) Advisory
- CVE-2026-97739 — Microsoft Office Excel Remote Code Execution Vulnerability (CVSS 8.8) Advisory
- CVE-2026-97745 — Microsoft Office Excel Remote Code Execution Vulnerability (CVSS 8.8) Advisory
- CVE-2026-97755 — Microsoft Office Excel Remote Code Execution Vulnerability (CVSS 8.8) Advisory
- CVE-2026-97759 — Microsoft Office Excel Remote Code Execution Vulnerability (CVSS 8.8) Advisory
- CVE-2026-97765 — Microsoft Office Excel Remote Code Execution Vulnerability (CVSS 8.8) Advisory
- CVE-2026-97778 — Microsoft Office Excel Remote Code Execution Vulnerability (CVSS 8.8) Advisory
- CVE-2026-97780 — Microsoft Office Excel Remote Code Execution Vulnerability (CVSS 8.8) Advisory
Windows Media Video Decoder (1 Critical)
- CVE-2026-100220 — Windows Media Video Decoder Remote Code Execution Vulnerability (CVSS 8.8) Advisory
Windows Hyper-V (3 Critical)
- CVE-2026-102214 — Windows Hyper-V Remote Code Execution Vulnerability (CVSS 8.8) Advisory
- CVE-2026-105733 — Windows Hyper-V Remote Code Execution Vulnerability (CVSS 8.8) Advisory
- CVE-2026-108399 — Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.2) Advisory
Microsoft Office Visio (3 Critical)
- CVE-2026-102855 — Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 8.8) Advisory
- CVE-2026-102856 — Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 8.8) Advisory
- CVE-2026-102857 — Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 8.8) Advisory
Microsoft Windows Codecs Library (1 Critical)
- CVE-2026-108400 — HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 8.8) Advisory
Windows Virtualization-Based Security (VBS) Enclave (5 Critical)
- CVE-2026-108471 — Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability (CVSS 8.8) Advisory
- CVE-2026-96914 — Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability (CVSS 8.8) Advisory
- CVE-2026-108130 — Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability (CVSS 7.8) Advisory
- CVE-2026-88074 — Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability (CVSS 7.8) Advisory
- CVE-2026-102211 — Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability (CVSS 7.0) Advisory
Windows DHCP Client (1 Critical)
- CVE-2026-70250 — Windows DHCP Client Remote Code Execution Vulnerability (CVSS 8.8) Advisory
Windows GDI+ (1 Critical)
- CVE-2026-83934 — Windows GDI+ Remote Code Execution Vulnerability (CVSS 8.8) Advisory
Windows Graphics Kernel (1 Critical)
- CVE-2026-88073 — Windows Graphics Kernel Elevation of Privilege Vulnerability (CVSS 8.8) Advisory
Windows Kernel (1 Critical)
- CVE-2026-96913 — Windows Kernel Elevation of Privilege Vulnerability (CVSS 8.8) Advisory
Microsoft Windows Media Foundation (1 Critical)
- CVE-2026-96952 — Microsoft Windows Media Foundation Remote Code Execution Vulnerability (CVSS 8.8) Advisory
Azure API Center (1 Critical)
- CVE-2026-83943 — Azure API Center Information Disclosure Vulnerability (CVSS 8.7) Advisory
Microsoft Office SharePoint (1 Critical)
- CVE-2026-102866 — Microsoft Office SharePoint Elevation of Privilege Vulnerability (CVSS 8.1) Advisory
Microsoft Windows PDF (1 Critical)
- CVE-2026-108457 — Microsoft Windows PDF Remote Code Execution Vulnerability (CVSS 8.1) Advisory
Windows Message Queuing (1 Critical)
- CVE-2026-108460 — Windows Message Queuing Remote Code Execution Vulnerability (CVSS 8.1) Advisory
Network Device Enrollment Service (NDES) (1 Critical)
- CVE-2026-69802 — Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability (CVSS 8.1) Advisory
Remote Desktop Gateway Service (1 Critical)
- CVE-2026-70187 — Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.1) Advisory
Active Directory Domain Services (1 Critical)
- CVE-2026-70229 — Windows Active Directory Domain Services Remote Code Execution Vulnerability (CVSS 8.1) Advisory
Microsoft Office Word (2 Critical)
- CVE-2026-70269 — Microsoft Office Word Remote Code Execution Vulnerability (CVSS 8.1) Advisory
- CVE-2026-88185 — Microsoft Office Word Remote Code Execution Vulnerability (CVSS 8.1) Advisory
Microsoft Exchange Server (1 Critical)
- CVE-2026-70571 — Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 8.1) Advisory
Windows Deployment Services (1 Critical)
- CVE-2026-88174 — Windows Deployment Services Remote Code Execution Vulnerability (CVSS 8.1) Advisory
Microsoft Graphics Component (1 Critical)
- CVE-2026-100215 — Microsoft Graphics Component Remote Code Execution Vulnerability (CVSS 7.8) Advisory
Azure Event Grid (1 Critical)
- CVE-2026-83947 — Azure Event Grid Spoofing Vulnerability (CVSS 7.7) Advisory
Active Directory Federation Services (AD FS) (2 Critical)
- CVE-2026-108131 — Active Directory Federation Services (AD FS) Spoofing Vulnerability (CVSS 7.5) Advisory
- CVE-2026-96222 — Active Directory Federation Services (AD FS) Spoofing Vulnerability (CVSS 7.4) Advisory
Reliable Multicast Transport Driver (RMCAST) (1 Critical)
- CVE-2026-69789 — Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability (CVSS 7.5) Advisory
Linux Kernel (1 Critical)
- CVE-2026-62840 — Linux Kernel Elevation of Privilege Vulnerability (CVSS 7.0) Advisory
Windows ALPC (1 Critical)
- CVE-2026-83917 — Windows ALPC Elevation of Privilege Vulnerability (CVSS 7.0) Advisory
Product Family Breakdown
| Product Family | Total | Critical | Important |
|---|---|---|---|
| Microsoft Office Excel | 69 | 11 | 58 |
| Role: DNS Server | 52 | 0 | 52 |
| Windows Kernel | 46 | 1 | 45 |
| Windows Installer | 38 | 0 | 38 |
| Windows Win32 Kernel Subsystem | 36 | 0 | 36 |
| Microsoft Office SharePoint | 36 | 1 | 33 |
| Microsoft Windows Search Component | 29 | 0 | 29 |
| .NET | 26 | 0 | 25 |
| Windows NTFS | 26 | 0 | 26 |
| Microsoft Office Word | 22 | 2 | 19 |
| SQL Server | 22 | 0 | 22 |
| Windows Error Reporting | 22 | 0 | 22 |
| Windows Broadcast DVR User Service | 20 | 0 | 20 |
| Remote Desktop Client | 19 | 0 | 19 |
| Windows Hyper-V | 18 | 3 | 15 |
| Windows Universal Disk Format File System Driver (UDFS) | 16 | 0 | 16 |
| Windows DHCP Server | 16 | 5 | 11 |
| Windows Overlay Filter | 15 | 0 | 15 |
| Active Directory Federation Services (AD FS) | 14 | 2 | 12 |
| WebDAV | 13 | 0 | 13 |
| Microsoft Office Access | 13 | 0 | 13 |
| ASP.NET Core | 13 | 0 | 13 |
| Windows Routing and Remote Access Service (RRAS) | 13 | 0 | 13 |
| Windows DWM Core Library | 13 | 0 | 13 |
| Windows Storage | 11 | 0 | 11 |
| Windows Device Association Service | 11 | 0 | 11 |
| Visual Studio Code | 10 | 0 | 10 |
| Windows iSCSI | 10 | 0 | 10 |
| Windows Kernel-Mode Drivers | 10 | 0 | 10 |
| Microsoft Office Outlook | 10 | 5 | 5 |
| Windows Background Intelligent Transfer Service (BITS) | 10 | 0 | 10 |
| Microsoft Windows Media Foundation | 9 | 1 | 8 |
| Microsoft Office PowerPoint | 9 | 4 | 5 |
| Windows Modern Device Management (MDM) | 9 | 0 | 9 |
| Windows TCP/IP | 9 | 0 | 9 |
| Windows Direct Composition | 9 | 0 | 9 |
| HID Parser Library | 9 | 0 | 9 |
| Network Policy Server (NPS) | 8 | 0 | 8 |
| Windows Virtualization-Based Security (VBS) Enclave | 8 | 5 | 3 |
| Windows Update | 8 | 0 | 8 |
| Desktop Window Manager | 8 | 0 | 8 |
| OpenSSH for Windows | 8 | 0 | 8 |
| Windows Ancillary Function Driver for WinSock | 8 | 0 | 8 |
| Windows Shell | 8 | 0 | 8 |
| Windows Win32K | 8 | 0 | 8 |
| Windows Print Spooler Components | 8 | 0 | 8 |
| Windows USB Print Driver | 8 | 0 | 8 |
| Windows Program Compatibility Assistant Service | 7 | 0 | 7 |
| Windows Audio Service | 7 | 0 | 7 |
| Windows Bind Filter Driver | 7 | 0 | 7 |
| Microsoft Exchange Server | 7 | 1 | 6 |
| Windows Hello | 7 | 0 | 7 |
| Windows Update Orchestrator Service | 7 | 0 | 7 |
| Servicing Stack Updates | 7 | 0 | 7 |
| Windows Management Instrumentation | 7 | 0 | 7 |
| Windows Message Queuing Queue Manager | 6 | 1 | 5 |
| Microsoft Graphics Component | 6 | 1 | 5 |
| Windows Container Isolation FS Filter Driver (unionfs.sys) | 6 | 0 | 6 |
| RPC Runtime | 6 | 0 | 6 |
| .NET Framework | 6 | 0 | 6 |
| Microsoft PostScript Printer Driver | 6 | 3 | 3 |
| Windows GDI | 6 | 0 | 6 |
| Windows AppX Deployment Service | 6 | 0 | 6 |
| Windows DNS | 6 | 0 | 6 |
| Windows Encrypting File System (EFS) | 6 | 0 | 6 |
| Windows Update Service | 5 | 0 | 5 |
| Remote Desktop Gateway Service | 5 | 1 | 4 |
| Windows Graphics Kernel | 5 | 1 | 4 |
| Windows Partition Management Driver | 5 | 0 | 5 |
| Windows IKE Extension | 5 | 0 | 5 |
| Windows SmartScreen | 5 | 0 | 5 |
| Windows Libarchive | 5 | 0 | 5 |
| Windows Spaceport.sys | 5 | 0 | 5 |
| Windows Local Security Authority Subsystem Service (LSASS) | 5 | 0 | 5 |
| Windows PowerShell | 5 | 0 | 5 |
| Windows Event Tracing | 5 | 0 | 5 |
| Active Directory Domain Services | 5 | 1 | 4 |
| Windows Common Log File System Driver | 5 | 0 | 5 |
| Windows Storage Spaces Controller | 5 | 0 | 5 |
| Windows BitLocker | 5 | 0 | 5 |
| Windows Clipboard User Service | 5 | 0 | 5 |
| Windows Resilient File System (ReFS) | 4 | 0 | 3 |
| Dynamics Business Central | 4 | 0 | 4 |
| Microsoft QUIC | 4 | 2 | 2 |
| Windows Network File System | 4 | 0 | 4 |
| Windows Failover Cluster | 4 | 0 | 4 |
| Windows Text Shaping | 4 | 2 | 2 |
| Windows StateRepository API | 4 | 0 | 4 |
| Windows Schannel | 4 | 0 | 4 |
| Windows Distributed File System (DFS) | 4 | 0 | 4 |
| Windows Kerberos | 4 | 0 | 4 |
| Network Device Enrollment Service (NDES) | 4 | 1 | 3 |
| Windows Client for NFS | 4 | 0 | 4 |
| Microsoft Streaming Service | 4 | 0 | 4 |
| Windows Subsystem for Linux | 4 | 0 | 4 |
| Windows CD-ROM Driver | 4 | 0 | 4 |
| Windows Client-Side Caching (CSC) Service | 4 | 0 | 4 |
| Windows Projected File System | 4 | 0 | 4 |
| Windows HTTP.sys | 4 | 0 | 4 |
| Microsoft Office Click-To-Run | 4 | 0 | 4 |
| Windows Setup Files Cleanup | 4 | 0 | 4 |
| Windows Event Logging Service | 4 | 0 | 4 |
| Windows MIDI Service Module | 4 | 0 | 4 |
| Microsoft Bluetooth Driver | 4 | 0 | 4 |
| Windows COM+ Event System Service | 4 | 0 | 4 |
| Windows Universal Plug and Play (UPnP) Device Host | 4 | 0 | 4 |
| SysInternals | 3 | 0 | 3 |
| Windows Storage Port Driver | 3 | 0 | 3 |
| Windows Remote Desktop Protocol | 3 | 0 | 3 |
| Microsoft Office Visio | 3 | 3 | 0 |
| Microsoft Office OneNote | 3 | 0 | 3 |
| Virtual Hard Disk (VHD) Miniport Driver | 3 | 0 | 3 |
| HID class driver | 3 | 0 | 3 |
| Windows Server Update Service | 3 | 0 | 3 |
| Windows Backup Engine | 3 | 0 | 3 |
| Windows Raw Image Extension | 3 | 3 | 0 |
| Windows Imaging Component | 3 | 0 | 3 |
| Windows Cryptographic Services | 3 | 0 | 3 |
| Windows Secure Kernel Mode | 3 | 0 | 3 |
| Windows Internet Information Services | 3 | 0 | 3 |
| Windows Netlogon | 3 | 0 | 3 |
| Windows OLE | 3 | 0 | 3 |
| Windows Bluetooth Port Driver | 3 | 0 | 3 |
| Windows SMB Server | 3 | 0 | 3 |
| Windows Push Notifications | 3 | 0 | 3 |
| Windows Win32K - GRFX | 3 | 0 | 3 |
| Skype for Business and Microsoft Lync | 3 | 0 | 3 |
| Windows Image Acquisition | 3 | 0 | 3 |
| Windows USB Driver | 3 | 0 | 3 |
| Windows Media | 3 | 0 | 3 |
| Windows Volume Manager Extension Driver | 3 | 0 | 3 |
| Windows Cloud Files Mini Filter Driver | 3 | 0 | 3 |
| Windows Camera Frame Server Monitor | 3 | 0 | 3 |
| Azure Key Vault | 3 | 0 | 3 |
| Windows Host Guardian Service | 3 | 0 | 3 |
| Windows Client License Service | 2 | 0 | 2 |
| Windows Group Policy | 2 | 0 | 2 |
| Microsoft Windows Codecs Library | 2 | 1 | 1 |
| Windows Portable Device MTP Driver | 2 | 0 | 2 |
| Microsoft Defender | 2 | 0 | 2 |
| Windows Autopilot | 2 | 0 | 2 |
| Microsoft Azure Attestation service and Device Health Attestation Service | 2 | 0 | 2 |
| Windows Key Storage Provider | 2 | 0 | 2 |
| Windows Key Distribution Center | 2 | 0 | 2 |
| Reliable Multicast Transport Driver (RMCAST) | 2 | 1 | 1 |
| Windows Wired AutoConfig Service | 2 | 0 | 2 |
| Windows Certificates | 2 | 0 | 2 |
| Windows Core Messaging | 2 | 0 | 2 |
| Windows IP Over USB Service | 2 | 0 | 2 |
| Microsoft Configuration Manager | 2 | 0 | 2 |
| Windows Rich Text Edit Control | 2 | 0 | 2 |
| Windows Portable Device File System Driver | 2 | 0 | 2 |
| Windows Remote Access Connection Manager | 2 | 0 | 2 |
| Windows Client Side Caching driver (csc.sys) | 2 | 0 | 2 |
| Windows Security Center | 2 | 0 | 2 |
| Windows DHCP Client | 2 | 1 | 1 |
| Microsoft Trace Data Helper | 2 | 0 | 2 |
| Windows Fast FAT Driver | 2 | 0 | 2 |
| Windows Smart Card | 2 | 0 | 2 |
| Windows WLAN Service | 2 | 0 | 2 |
| Microsoft PowerToys | 2 | 0 | 2 |
| Windows Now Playing Session Manager | 2 | 0 | 2 |
| Windows Wi-Fi Driver | 2 | 0 | 2 |
| Microsoft Local Security Authority Server (lsasrv) | 2 | 0 | 2 |
| Windows Bluetooth Service | 2 | 0 | 2 |
| Microsoft Internet Messaging API | 2 | 0 | 2 |
| Windows SMB Client | 2 | 0 | 2 |
| Windows Update Stack | 2 | 0 | 2 |
| Windows Internet (wininet.dll) | 2 | 0 | 2 |
| Connected Devices Platform Service (Cdpsvc) | 2 | 0 | 2 |
| Microsoft Account | 2 | 0 | 2 |
| Windows exFAT File System | 2 | 0 | 2 |
| Microsoft XML | 2 | 0 | 2 |
| Windows ALPC | 2 | 1 | 1 |
| Windows Telephony Server | 2 | 0 | 2 |
| Windows Performance Monitor | 2 | 0 | 2 |
| Windows USB Video Driver | 2 | 0 | 2 |
| Windows Sysmain Service | 2 | 0 | 2 |
| Windows Composite Image File System | 2 | 0 | 2 |
| Windows Health and Optimized Experiences Service | 2 | 0 | 2 |
| Windows Embedded Mode Service | 2 | 0 | 2 |
| Windows PCI Bus Driver | 2 | 0 | 2 |
| Windows Secure Socket Tunneling Protocol (SSTP) | 2 | 0 | 2 |
| Microsoft Office | 2 | 0 | 2 |
| Microsoft PowerShell | 2 | 0 | 2 |
| Azure CycleCloud | 1 | 0 | 1 |
| Windows Media Video Decoder | 1 | 1 | 0 |
| Microsoft Defender for Endpoint | 1 | 0 | 1 |
| Windows VHD miniport driver | 1 | 0 | 1 |
| Windows Secure Boot | 1 | 0 | 1 |
| .NET and Visual Studio | 1 | 0 | 1 |
| Windows Credential Providers | 1 | 0 | 1 |
| Visual Studio Tools for Applications and SQL Server Management Studio | 1 | 0 | 1 |
| Windows NDIS | 1 | 0 | 1 |
| Windows Security App | 1 | 0 | 1 |
| Microsoft Windows PDF | 1 | 1 | 0 |
| Windows Message Queuing | 1 | 1 | 0 |
| Software Protection Platform (SPP) | 1 | 0 | 1 |
| Windows Update Delivery Optimization | 1 | 0 | 1 |
| Windows UEFI | 1 | 0 | 1 |
| Windows Remote Desktop | 1 | 0 | 1 |
| Windows Perception Simulation Service | 1 | 0 | 1 |
| Linux Kernel | 1 | 1 | 0 |
| Windows kernel32.dll | 1 | 0 | 1 |
| Graphic Fonts | 1 | 0 | 1 |
| Azure SRE Agent | 1 | 1 | 0 |
| Windows Enterprise App Management | 1 | 0 | 1 |
| Windows Credential Manager | 1 | 0 | 1 |
| Windows Storport Miniport Driver | 1 | 0 | 1 |
| Windows Clipboard Server | 1 | 0 | 1 |
| SQLite | 1 | 0 | 1 |
| Azure DevOps | 1 | 0 | 1 |
| Microsoft COM for Windows | 1 | 0 | 1 |
| Windows AI | 1 | 0 | 1 |
| Windows AppX Deployment Extensions | 1 | 0 | 1 |
| Quality Windows Audio/Video Experience (QWAVE) service | 1 | 0 | 1 |
| Windows VMSwitch | 1 | 0 | 1 |
| Windows Remote Desktop Services | 1 | 0 | 1 |
| Windows Work Folders | 1 | 0 | 1 |
| Windows NetBIOS | 1 | 0 | 1 |
| Windows Remote POS Driver | 1 | 0 | 1 |
| Windows System Information Console | 1 | 0 | 1 |
| Windows Connected Devices Platform Service | 1 | 0 | 1 |
| Windows OLE DB | 1 | 0 | 1 |
| Microsoft Power Apps | 1 | 0 | 1 |
| Windows Mobile Device Management | 1 | 0 | 1 |
| Windows Console Driver | 1 | 0 | 1 |
| Windows Container Isolation FS Filter Driver | 1 | 0 | 1 |
| Microsoft MPEG-2 Video Extension | 1 | 0 | 1 |
| Windows Credential Guard | 1 | 0 | 1 |
| Windows Application Compatibility Cache | 1 | 0 | 1 |
| Azure App Service | 1 | 1 | 0 |
| Windows Win32K - ICOMP | 1 | 0 | 1 |
| Windows Kernel Mode Driver | 1 | 0 | 1 |
| Windows Geotag Broker | 1 | 0 | 1 |
| Windows Resilient File System (ReFS) Deduplication Service | 1 | 0 | 1 |
| Windows Sensor Data Service | 1 | 0 | 1 |
| Windows User Profile Service | 1 | 0 | 1 |
| Active Directory Certificate Services (AD CS) | 1 | 0 | 1 |
| Function Discovery Service (fdwsd.dll) | 1 | 0 | 1 |
| Windows Defender Firewall Service | 1 | 0 | 1 |
| Windows Connected User Experiences and Telemetry | 1 | 0 | 1 |
| Windows NTLM | 1 | 0 | 1 |
| Internet Explorer | 1 | 0 | 1 |
| Windows Input System | 1 | 0 | 1 |
| Windows CCFFilter Driver | 1 | 0 | 1 |
| Windows RNDIS | 1 | 0 | 1 |
| Windows Virtual Input | 1 | 0 | 1 |
| Windows Device Install Service | 1 | 0 | 1 |
| Windows Bluetooth A2DP driver | 1 | 0 | 1 |
| Windows Internet Key Exchange (IKE) Protocol | 1 | 0 | 1 |
| Windows Paint | 1 | 0 | 1 |
| Windows Notification | 1 | 0 | 1 |
| Windows Network Load Balancing | 1 | 0 | 1 |
| Windows Aggregated Data Platform Service | 1 | 0 | 1 |
| Windows Diagnostic Policy Service | 1 | 0 | 1 |
| Windows Registry | 1 | 0 | 1 |
| Windows GDI+ | 1 | 1 | 0 |
| Azure API Center | 1 | 1 | 0 |
| Azure Event Grid | 1 | 1 | 0 |
| Remote Access Point-to-Point Protocol (PPP) EAP-TLS | 1 | 0 | 1 |
| Windows EAPHost Service | 1 | 0 | 1 |
| Windows Advanced Rasterization Platform | 1 | 0 | 1 |
| Windows Phone Service | 1 | 0 | 1 |
| Windows Cash Drawer Protocol Provider | 1 | 0 | 1 |
| Windows Text Services Framework | 1 | 0 | 1 |
| Windows Biometric Service | 1 | 0 | 1 |
| Windows Event Viewer | 1 | 0 | 1 |
| Windows Web Account Manager | 1 | 0 | 1 |
| Windows Internet Connection Sharing (ICS) | 1 | 0 | 1 |
| Python | 1 | 0 | 1 |
| Windows Storage VSP Driver | 1 | 0 | 1 |
| Azure HDInsight | 1 | 0 | 1 |
| Windows UI Immersive Server | 1 | 0 | 1 |
| Azure Active Directory | 1 | 0 | 1 |
| Windows Management Services | 1 | 0 | 1 |
| Windows Remote Access Service Infrastructure | 1 | 0 | 1 |
| Winlogon | 1 | 0 | 1 |
| Windows Resource Management (MRM) | 1 | 0 | 1 |
| Windows Fax and Scan Service | 1 | 0 | 1 |
| Windows Quality of Service (QoS) Packet Scheduler | 1 | 0 | 1 |
| Azure Storage Library | 1 | 0 | 1 |
| Windows DCOM Server | 1 | 0 | 1 |
| Windows Security Support Provider Interface | 1 | 0 | 1 |
| Microsoft Input Method Editor (IME) | 1 | 0 | 1 |
| Windows Server for NFS | 1 | 0 | 1 |
| Microsoft Dataverse | 1 | 1 | 0 |
| Windows Portable Device Enumerator Service | 1 | 0 | 1 |
| Microsoft Digest Authentication | 1 | 0 | 1 |
| Windows Local Security Authority (LSA) | 1 | 0 | 1 |
| Windows Deployment Services | 1 | 1 | 0 |
| Microsoft Scripting Engine | 1 | 0 | 1 |
| Microsoft Bookings | 1 | 1 | 0 |
| Windows Media Player | 1 | 0 | 1 |
| Azure Arc | 1 | 0 | 1 |
| Microsoft Partner Center | 1 | 1 | 0 |
| Windows Assigned Access | 1 | 0 | 1 |
| Windows WalletService | 1 | 0 | 1 |
| Windows Internal System User Profile | 1 | 0 | 1 |
| RPC Endpoint Mapper Service | 1 | 0 | 1 |
| Windows Network List Service | 1 | 0 | 1 |
| Windows Resume | 1 | 0 | 1 |
| Remote Desktop Display Driver | 1 | 0 | 1 |
| Windows Security Account Manager | 1 | 0 | 1 |
| Microsoft Failover Cluster Virtual Driver | 1 | 0 | 1 |
| Windows Workstation Service | 1 | 0 | 1 |
| Windows Setup and Deployment | 1 | 0 | 1 |
| Windows Mobile Broadband | 1 | 0 | 1 |
Data sourced from the Microsoft Security Response Center. Mariner (Azure Linux) and Edge (Chromium-based) CVEs are excluded from this summary. Generated by ARETIQ AI.