Use the compact catalogue to see each deployable update or vendor advisory, its linked CVEs, and whether BlackTree recommends the normal patch window or faster action. CVSS and vendor severity remain source signals, not the BlackTree action window.
274Current-cycle patchesOperational updates, not CVE duplicates
1432Linked unique CVEsRelationships can appear in several applicable patches
11Accelerated actionsIncludes out-of-band and 72-hour recommendations
3 of 9Active vendor sourcesSources that can publish after all checks pass
Vendor visibility
Published and monitored vendor sources
The four main vendors are shown here. Open the full vendor list below to show or hide the other registered vendors. A checked vendor can only display records that have passed publication review.
Official monthly MSRC CVRF, filtered to Patch Tuesday revisions and grouped by deployable vendor fix.
Every registered source below is checked automatically. The status describes what the collected evidence is allowed to do. Complete sources passed the cycle completeness gate. Monitored sources are checked automatically but are not assumed to belong to Microsoft Patch Tuesday. Private validation sources can identify exact-date candidates, while completeness is still being measured. None of the latter two states can create public rows. Checked vendors will appear automatically if they later gain approved Patch Tuesday records. A registered source is included only when an official advisory is demonstrably part of the coordinated Patch Tuesday event. Rolling and ordinary monthly releases remain excluded.
MicrosoftDeploy Microsoft Developer Tools security update KB5126868KB5126868 · Updated 2026-10-13
Product and releaseMicrosoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 20162.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0
This official Microsoft Patch Tuesday update addresses 18 linked CVEs for Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016. Microsoft marks CVE-2026-108398 as publicly disclosed, without that disclosure alone changing the BlackTree action window.
MicrosoftDeploy Microsoft Developer Tools security update KB5127666KB5127666 · Updated 2026-10-13
Product and releaseMicrosoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 version 18092.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0
This official Microsoft Patch Tuesday update addresses 18 linked CVEs for Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 version 1809. Microsoft marks CVE-2026-108398 as publicly disclosed, without that disclosure alone changing the BlackTree action window.
This official Microsoft Patch Tuesday update addresses 18 linked CVEs for Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012. Microsoft marks CVE-2026-108398 as publicly disclosed, without that disclosure alone changing the BlackTree action window.
This official Microsoft Patch Tuesday update addresses 18 linked CVEs for Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2. Microsoft marks CVE-2026-108398 as publicly disclosed, without that disclosure alone changing the BlackTree action window.
MicrosoftDeploy Microsoft Developer Tools security update KB5127683KB5127683 · Updated 2026-10-13
Product and releaseMicrosoft .NET Framework 3.5 AND 4.8 on Windows 10 version 21H2, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 22H22.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0
This official Microsoft Patch Tuesday update addresses 18 linked CVEs for Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 21H2, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 22H2. Microsoft marks CVE-2026-108398 as publicly disclosed, without that disclosure alone changing the BlackTree action window.
This official Microsoft Patch Tuesday update addresses 18 linked CVEs for Microsoft .NET Framework 4.8 on Windows 10 version 1607, Microsoft .NET Framework 4.8 on Windows Server 2016. Microsoft marks CVE-2026-108398 as publicly disclosed, without that disclosure alone changing the BlackTree action window.
MicrosoftDeploy Microsoft Developer Tools security update KB5127685KB5127685 · Updated 2026-10-13
Product and releaseMicrosoft .NET Framework 3.5 AND 4.8 on Windows 10 version 1809, Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 20192.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0
This official Microsoft Patch Tuesday update addresses 18 linked CVEs for Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 1809, Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019. Microsoft marks CVE-2026-108398 as publicly disclosed, without that disclosure alone changing the BlackTree action window.
This official Microsoft Patch Tuesday update addresses 18 linked CVEs for Microsoft .NET Framework 4.8 on Windows Server 2012. Microsoft marks CVE-2026-108398 as publicly disclosed, without that disclosure alone changing the BlackTree action window.
This official Microsoft Patch Tuesday update addresses 18 linked CVEs for Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022. Microsoft marks CVE-2026-108398 as publicly disclosed, without that disclosure alone changing the BlackTree action window.
This official Microsoft Patch Tuesday update addresses 18 linked CVEs for Microsoft .NET Framework 4.8 on Windows Server 2012 R2. Microsoft marks CVE-2026-108398 as publicly disclosed, without that disclosure alone changing the BlackTree action window.
MicrosoftDeploy Microsoft Developer Tools security update KB5127689KB5127689 · Updated 2026-10-13
Product and releaseMicrosoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 21H2, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 22H22.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0
This official Microsoft Patch Tuesday update addresses 18 linked CVEs for Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 21H2, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 22H2. Microsoft marks CVE-2026-108398 as publicly disclosed, without that disclosure alone changing the BlackTree action window.
Vendor statements, CVE descriptions, confirmed exploitation and probability estimates answer different questions. BlackTree keeps them separate and records when each source was checked. This prevents an estimate or a third-party description from being presented as if the vendor confirmed it.
Operational urgency
A severe issue does not always require an emergency patch
The action window is explained
CVSS describes possible technical impact. It does not tell you whether attackers are using the issue, whether your systems are exposed, or whether a safe fix exists. BlackTree considers those practical signals separately and explains why an update belongs in the normal maintenance window, within 72 hours, or in an immediate patch window.
Publication checks
Incomplete information stays private
Public rows must pass every check
A new update first enters a private review area. It is published only after the official source, release date, affected products, fixed versions and linked CVEs have been checked and the source run is complete. Conflicting, missing or uncertain information stays out of the public catalogue until it is resolved.
BlackTreeCVE Intelligence