October 2026 Patch Tuesday: 173 Office Fixes, 26 Critical Flaws, and Office 2021’s Final Update
Microsoft’s October 2026 Patch Tuesday fixes 173 security flaws in Office, 26 of them Critical. Excel alone gets 69 patches, Outlook has five Critical bugs, and Office 2021 receives its very last security update. Here’s what you need to do right now — and why you should wait a week before installing.
There is some good news. None of the Office flaws are zero days, meaning none are known to be under attack yet. This month’s one actively exploited bug is in Windows Shell, and the two publicly disclosed flaws are in .NET.
What to Do About October’s Office Patches
Wait … Microsoft’s recent history of patching their software isn’t great. While there are many more updates, some of the patches cause more trouble for customers. That’s why we’re recommending people [pause updating](https://office-watch.com/2026/pause-microsoft-office-updates/) for a week or two.
Microsoft 365, Office 2024 and Office 2021 (its final update): open any Office app and go to File, Account, Update Options, Update Now. Then close and reopen your Office apps. Office updates don’t fully apply while the programs are still open.
Update Outlook first if you have to pick. It has five Critical flaws, and email is how booby trapped files usually arrive.
SharePoint Server admins: there are 36 fixes, including one Critical. Schedule the server update this week.
Office 2019 or older: you’re already out of support and officially get none of these fixes. See Office 2019 Is Still Getting Security Updates, But Only for Some and Office 2016 Still Gets Security Updates: Check If Yours Qualifies
Office 2021 has reached the end of the road
Support for Office LTSC 2021 (Long Term Servicing Channel, the one time purchase version) and related apps ended on October 13, 2026. That covers Access, Excel, OneNote, Outlook, PowerPoint, Project, Publisher, Skype for Business, Visio and Word 2021.
The apps keep working, but next month’s Excel bugs won’t be fixed for you, or any after that. Running unpatched Office on a computer that opens email attachments is asking for trouble.
However, it’s possible that Office 2021 volume license software will get more updates, just like Office 2019. Only time will tell.
Why October’s Office Patch Tuesday Matters
Excel is the headline. 69 fixes is more than double the 30 Excel flaws in Microsoft’s September release. Microsoft says it is now using AI tools to find bugs, which helped push this month’s total to a record 1,411 fixes across all Microsoft products. Expect more months like this, not fewer.
Office is a big share of the dangerous stuff. Of the 70 Critical flaws across the whole October release, 26 of them are in Office.
Almost every Critical flaw lets an attacker run code on your computer. 25 of the 26 Critical Office flaws are remote code execution, which means a malicious document or email could run an attacker’s program on your PC. The exception is a SharePoint elevation of privilege bug, where an attacker who already has limited access can grab more.
The patch numbers by Office app
| App | Total | Critical | Important | Low or unrated | What kind of flaws |
| Excel | 69 | 11 | 58 | 0 | 51 remote code execution, 18 information disclosure |
| SharePoint | 36 | 1 | 33 | 2 unrated | 15 elevation of privilege, 7 remote code execution, 7 spoofing, 6 information disclosure, 1 tampering |
| Word | 22 | 2 | 19 | 1 Low | 15 remote code execution, 5 information disclosure, 1 security bypass, 1 elevation of privilege |
| Access | 13 | 0 | 13 | 0 | 12 remote code execution, 1 information disclosure |
| Outlook | 10 | 5 | 5 | 0 | 9 remote code execution, 1 information disclosure |
| PowerPoint | 9 | 4 | 5 | 0 | 5 remote code execution, 4 information disclosure |
| Click to Run (the Office updater) | 4 | 0 | 4 | 0 | 4 elevation of privilege |
| OneNote | 3 | 0 | 3 | 0 | 2 remote code execution, 1 elevation of privilege |
| Visio | 3 | 3 | 0 | 0 | 3 remote code execution |
| Office (shared components) | 2 | 0 | 2 | 0 | 2 remote code execution |
| Office Graphics | 2 | 0 | 2 | 0 | 1 information disclosure (CVE-2026-105731), 1 elevation of privilege (CVE-2026-85881) |
| Total | 173 | 26 | 144 | 3 |
Office patches by severity
| Severity | Count | Where they are |
| Critical | 26 | Excel 11, Outlook 5, PowerPoint 4, Visio 3, Word 2, SharePoint 1 |
| Important | 144 | Every app on the list, including both Office Graphics flaws |
| Low | 1 | Word (CVE-2026-102867, information disclosure) |
| No rating listed | 2 | SharePoint (CVE-2026-88164 and CVE-2026-88163) |
Don’t read “unrated” as “harmless.” One of the two unrated SharePoint entries is a remote code execution flaw.
The 26 Critical flaws
| App | CVE numbers |
| Excel (11) | CVE-2026-105718, 97745, 100211, 100210, 100209, 97739, 97780, 97778, 97765, 97755, 97759 |
| Outlook (5) | CVE-2026-88156, 97016, 70291, 70242, 97749 |
| PowerPoint (4) | CVE-2026-88144, 88178, 88207, 70215 |
| Visio (3) | CVE-2026-102855, 102857, 102856 |
| Word (2) | CVE-2026-70269, 88185 |
| SharePoint (1) | CVE-2026-102866 |
Risk Cohort, the new way to classify patches
Microsoft has added a new way to classify their patches called “Risk Cohort.” A risk cohort bundles flaws that need the same question answered about your setup, such as “do we use this feature?” or “can outside files reach it?” It is not a severity rating, and Microsoft calls the whole idea experimental.
Microsoft sorts 1,119 of this month’s fixes into 16 risk cohorts, and Office is the second biggest group with 135 flaws.
| Risk Cohort | Flaws | What’s in it | The question to answer |
| Windows filesystems, storage and backup | 136 | File systems, disks and backup features | Which storage and backup features handle files or disk images you didn’t create? |
| Office document and mail clients | 135 | Excel, Word, Outlook, PowerPoint, Access, Visio, OneNote and other Office apps | Which Office apps and versions are installed, what outside files and email reach them, and how do updates get installed? |
| Windows graphics, media and content processing | 131 | Image, font, video and display code, including the two Office Graphics flaws | Which PCs open pictures, fonts or media from outside, and with what permissions? |
| Windows core and kernel privilege boundaries | 109 | The heart of Windows, which decides who can do what | Can untrusted or limited accounts run programs on these PCs? |
| Windows installation, deployment and update services | 103 | Windows Installer, setup and update services | Which installer and update services run, and can a limited user interfere with them? |
| Windows device, peripheral and print surfaces | 76 | Drivers, keyboards, mice and other USB devices, printing | Which devices and printers are used, and can untrusted ones be plugged in or reached? |
| DNS, DHCP and network address infrastructure | 76 | The servers that hand out network addresses and look up names | Which name and address services run, and who can talk to them? |
| Remote access and RDP deployments | 65 | Remote Desktop clients, gateways and servers | Which machines connect remotely or accept remote connections, and from where? |
| Windows authentication, credentials and cryptography | 61 | Sign in, passwords, certificates and encryption | Which sign in and encryption features protect these PCs, and who can reach them? |
| Windows networking and protocol stack | 53 | Core networking code | Which network features are switched on, and which networks can reach them? |
| Virtualization, container and isolation hosts | 45 | Virtual machines, containers and sandboxes | Where do you run virtual machines or code you don’t fully trust? |
| Network file and resource sharing | 39 | File sharing (SMB, NFS, WebDAV) | Which file sharing services are on, and who can reach them? |
| Endpoint management and security controls | 38 | Device management and security agents | Which management and security tools are installed, and who can change their settings? |
| Windows web, RPC and messaging services | 27 | Built in web servers, RPC (programs calling each other across a network) and message queuing | Which of these services run, and are they reachable? |
| Directory, federation and certificate infrastructure | 24 | Active Directory, AD FS sign in and certificate services | Which domain and sign in servers run, and what trust do they grant? |
| Browser and web content clients | 1 | Internet Explorer | Is the old Internet Explorer engine still used anywhere? |
| Total in cohorts | 1,119 |
More on Office security patches
If you’re holding off on this month’s patches, How to Pause Microsoft Office Updates After September’s Patch Bugs walks you through turning off updates on Windows and Mac so you can let others go first. For the bigger picture on why there’s no perfect answer, Microsoft Office Updates: A No-Win Scenario and How to Stay Safe lays out the tradeoffs between patching fast and waiting.
Last month’s updates caused plenty of damage on their own. Excel Copy and Paste Broken by Microsoft’s Own Security Update — How to Fix It covers the paste bug that Microsoft took weeks to address, and KB5002907 Broke Office 2016 and 2019: How to Get Office Back explains how to recover if that update deactivated or removed your Office.
Office 2021 isn’t the only thing ending this month. October 2026 Office Changes: Publisher Dies, Office 2021 Support Ends lists all eight October deadlines in date order, and Microsoft Publisher Ends October 2026: How to Keep It Working shows how to hold onto Publisher after Microsoft flips the kill switch.
To see how October compares, September 2026 Patch Tuesday: 20 Critical Office Bugs to Fix Now covers last month’s 124 Office fixes, and August 2026 Patch Tuesday: Office Bugs That Fire From the Preview Pane explains the Critical flaws that triggered just by previewing a file.