MSRXSecond Tuesday of every month
Microsoft Patch Tuesday
Next one: Tuesday, 10 November 2026 (in 11 days). Microsoft publishes it at 10 am Pacific time, which is 10:30 to 11:30 pm IST depending on US daylight saving. Apply it to internet-facing and domain systems first.
42 Microsoft vulnerabilities were added to CISA's exploited list in the past 365 days. Those added on a Patch Tuesday itself were zero-days fixed that day. Others were added later, once attacks were seen.
October 2026
Patch Tuesday 2026-10-13 · 1 exploited · 1 on the day| 2026-10-13 | CVE-2026-96951 Windowsfixed on the day Microsoft Windows Command Injection Vulnerability |
September 2026
Patch Tuesday 2026-09-08 · 3 exploited · 2 on the day| 2026-09-25 | CVE-2026-65660 SharePoint Microsoft SharePoint Code Injection Vulnerability |
| 2026-09-08 | CVE-2026-85880 Windowsfixed on the day Microsoft Windows Heap-Based Buffer Overflow Vulnerability |
| 2026-09-08 | CVE-2026-81963 Windowsfixed on the day Microsoft Windows Link Following Vulnerability |
August 2026
Patch Tuesday 2026-08-11 · 4 exploited · 1 on the day| 2026-08-26 | CVE-2019-1068 SQL Server Microsoft SQL Server Remote Code Execution Vulnerability |
| 2026-08-18 | CVE-2026-55040 SharePoint Microsoft SharePoint Weak Authentication Vulnerability |
| 2026-08-18 | CVE-2026-33824 Internet Key Exchange (IKE) Service Extensions Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability |
| 2026-08-11 | CVE-2026-68820 Windows Ancillary Function Driver for WinSockfixed on the day Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability |
July 2026
Patch Tuesday 2026-07-14 · 5 exploited · 2 on the day| 2026-07-22 | CVE-2026-50522 SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability |
| 2026-07-16 | CVE-2026-58644 SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability |
| 2026-07-14 | CVE-2026-56164 SharePoint Serverfixed on the day Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability |
| 2026-07-14 | CVE-2026-56155 Active Directory Federation Servicesfixed on the day Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability |
| 2026-07-01 | CVE-2026-45659 SharePoint Serverransomware Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability |
June 2026
Patch Tuesday 2026-06-09 · 0 exploitedNo Microsoft vulnerability was added to the exploited list this month.
May 2026
Patch Tuesday 2026-05-12 · 7 exploited| 2026-05-20 | CVE-2026-45498 Defender Microsoft Defender Denial of Service Vulnerability |
| 2026-05-20 | CVE-2026-41091 Defender Microsoft Defender Link Following Vulnerability |
| 2026-05-20 | CVE-2010-0806 Internet Explorer Microsoft Internet Explorer Use-After-Free Vulnerability |
| 2026-05-20 | CVE-2010-0249 Internet Explorer Microsoft Internet Explorer Use-After-Free Vulnerability |
| 2026-05-20 | CVE-2009-1537 DirectX Microsoft DirectX NULL Byte Overwrite Vulnerability |
| 2026-05-20 | CVE-2008-4250 Windows Microsoft Windows Buffer Overflow Vulnerability |
| 2026-05-15 | CVE-2026-42897 Microsoft Microsoft Exchange Server Cross-Site Scripting Vulnerability |
April 2026
Patch Tuesday 2026-04-14 · 8 exploited · 2 on the day| 2026-04-28 | CVE-2026-32202 Windows Microsoft Windows Protection Mechanism Failure Vulnerability |
| 2026-04-22 | CVE-2026-33825 Defenderransomware Microsoft Defender Insufficient Granularity of Access Control Vulnerability |
| 2026-04-14 | CVE-2026-32201 SharePoint Serverfixed on the day Microsoft SharePoint Server Improper Input Validation Vulnerability |
| 2026-04-14 | CVE-2009-0238 Officefixed on the day Microsoft Office Remote Code Execution |
| 2026-04-13 | CVE-2025-60710 Windowsransomware Microsoft Windows Link Following Vulnerability |
| 2026-04-13 | CVE-2023-36424 Windows Microsoft Windows Out-of-Bounds Read Vulnerability |
| 2026-04-13 | CVE-2023-21529 Exchange Serverransomware Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability |
| 2026-04-13 | CVE-2012-1854 Visual Basic for Applications (VBA) Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability |
March 2026
Patch Tuesday 2026-03-10 · 1 exploited| 2026-03-18 | CVE-2026-20963 SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability |
February 2026
Patch Tuesday 2026-02-10 · 8 exploited · 6 on the day| 2026-02-17 | CVE-2008-0015 Windows Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability |
| 2026-02-12 | CVE-2024-43468 Configuration Manager Microsoft Configuration Manager SQL Injection Vulnerability |
| 2026-02-10 | CVE-2026-21533 Windowsfixed on the day Microsoft Windows Improper Privilege Management Vulnerability |
| 2026-02-10 | CVE-2026-21525 Windowsfixed on the day Microsoft Windows NULL Pointer Dereference Vulnerability |
| 2026-02-10 | CVE-2026-21519 Windowsfixed on the day Microsoft Windows Type Confusion Vulnerability |
| 2026-02-10 | CVE-2026-21514 Officefixed on the day Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability |
| 2026-02-10 | CVE-2026-21513 Windowsfixed on the day Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability |
| 2026-02-10 | CVE-2026-21510 Windowsfixed on the day Microsoft Windows Shell Protection Mechanism Failure Vulnerability |
January 2026
Patch Tuesday 2026-01-13 · 3 exploited · 1 on the day| 2026-01-26 | CVE-2026-21509 Office Microsoft Office Security Feature Bypass Vulnerability |
| 2026-01-13 | CVE-2026-20805 Windowsfixed on the day Microsoft Windows Information Disclosure Vulnerability |
| 2026-01-07 | CVE-2009-0556 Office Microsoft Office PowerPoint Code Injection Vulnerability |
December 2025
Patch Tuesday 2025-12-09 · 1 exploited · 1 on the day| 2025-12-09 | CVE-2025-62221 Windowsfixed on the day Microsoft Windows Use After Free Vulnerability |
November 2025
Patch Tuesday 2025-11-11 · 1 exploited| 2025-11-12 | CVE-2025-62215 Windows Microsoft Windows Race Condition Vulnerability |
Source: CISA Known Exploited Vulnerabilities catalog, refreshed every 12 hours. Dates are UTC; Patch Tuesday falls on the second Tuesday.