Back Tenable

KB5127646: Windows 11 Version 26H1 Security Update (October 2026)

Tenable • November 1, 2026

Share: View original

CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H")

CVSSv2 score source (changed from "CVE-2026-85797" to "CVE-2026-83888")

CVSSv3 score source (changed from "CVE-2026-88073" to none)

Plugin Feed : 202610221008

Oct 20, 2026, 8:26 AM

CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:H/RL:OF/RC:C")

CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:H/RL:O/RC:C")

Exploit attributes ("Exploited by malware" set to "True")

Plugin Feed : 202610200826

Oct 19, 2026, 10:23 AM

CVSS metrics ("CVSSv2 score" set to 7.8)

CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N")

CVSS metrics ("CVSSv3 score" set to 7.8)

CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H")

CVSSv2 score source (changed from "CVE-2026-70580" to "CVE-2026-85797")

CVSSv2 severity (based on CVE-2026-85797, severity increased from "Medium" to "High")

CVSSv3 score source (changed from "CVE-2026-97816" to "CVE-2026-88073")

Plugin Feed : 202610191023

Oct 16, 2026, 7:34 PM

Plugin metadata (Add IAVM Info)

Plugin Feed : 202610161934

Oct 16, 2026, 3:19 PM

CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C")

CVSSv2 score source (changed from "CVE-2026-87714" to "CVE-2026-70580")

Plugin Feed : 202610161519

Oct 15, 2026, 8:27 AM

CVSS metrics ("CVSSv2 score" set to 6.8)

CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N")

CVSSv2 score source (changed from "CVE-2026-100220" to "CVE-2026-87714")

CVSSv2 severity (based on CVE-2026-87714, severity decreased from "High" to "Medium")

Plugin Feed : 202610150827

Oct 14, 2026, 6:26 PM

Plugin Feed : 202610141826

Oct 14, 2026, 9:52 AM

CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C")

CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C")

CVSSv2 score source (changed from "CVE-2026-100202" to "CVE-2026-100220")

CVSSv3 score source (changed from "CVE-2026-100202" to "CVE-2026-97816")

Exploit attributes ("Exploit available" set to "True")

Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available")

Plugin Feed : 202610140952

Oct 13, 2026, 11:46 PM

Plugin Feed : 202610132346

* Changelogs are generally available for changes made after Nov 1, 2022

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Security Flaws in Windows 11 and ASP.NET Core Require Immediate Attention Two significant security updates were released for Windows 11 and Microsoft ASP.NET Core in late October 2026. Windows 11's update addresses multiple vulnerabilities, including CVE-2026-85797 and CVE-2026-88073, both rated as high severity (CVSS 7.8). These vulnerabilities are by malware, posing a serious risk to users. The ASP.NET Core update also addresses vulnerabilities with available exploits, including CVSS 9.8 flaws. Both updates were released amid reports of, urging users to apply patches immediately. Affected systems include all versions of Windows 11 and ASP.NET Core applications. The updates were published on October 20 and October 28, respectively, highlighting the urgency of the situation. 2 sources 73

Extracted Entities

CVEs (8)

CVE-2026-100202 CVE-2026-100220 CVE-2026-70580 CVE-2026-83888 CVE-2026-85797 CVE-2026-87714 CVE-2026-88073 CVE-2026-97816