October Patch Tuesday brought an unprecedented 1,407 fixes from Microsoft, including critical zero-day vulnerabilities, urging immediate attention from admins.
Microsoft has set a new record this October, issuing a staggering 1,407 Common Vulnerabilities and Exposures (CVEs) during its Patch Tuesday release, surpassing the previous record of 1,261 set in 2020. This overwhelming number of vulnerabilities, announced several hours after the usual release time of 1 p.m. Eastern, has understandably left many administrators scrambling for solutions.
Among the vulnerabilities, three are categorized as zero-day threats, with one already being exploited in the wild. The primary zero-day requiring immediate attention is CVE-2026-96951, which allows attackers to bypass Mark of the Web (MotW) protections in Windows Shell. This exploitation highlights a troubling trend; it marks the third time this year that Windows Shell has faced active exploitation, noted Satnam Narang, senior staff research engineer at Tenable.
The other two zero-day vulnerabilities are found in SharePoint and the .NET framework. The SharePoint vulnerability, CVE-2026-102866, allows unauthenticated attackers to hijack user accounts through flaws in cryptographic token validation. The third zero-day, CVE-2026-108398, relates to an untrusted search path issue in the .NET framework, which could enable unauthorized applications to run on targeted systems, posing severe risks to enterprise security.
Urgent Fixes for Other High-Risk Vulnerabilities
In addition to the zero-days, administrators managing self-hosted GitLab instances should prioritize patching CVE-2026-97229. This vulnerability could allow unauthenticated users to execute arbitrary code through specially crafted regular expression patterns in Continuous Integration/Continuous Deployment (CI/CD) configurations. Gene Moody, Field CTO at Action1, emphasized the urgency, indicating this flaw jeopardizes a critical element of the software supply chain.
Other Significant Vulnerabilities to Address
IBM has also issued a warning about a critical vulnerability identified as CVE-2026-96119 affecting its IBM i operating systems. This flaw has an alarming CVSS score of 9.9 and could enable remote authenticated users to execute arbitrary code due to improper data sanitization in the HTTP Server Administration Graphical User Interface (GUI). Users are urged to patch their systems immediately, especially those operating unsupported versions of the software.
Atlassian products are not immune either; the company reported attempts to exploit vulnerabilities in eight self-hosted products, including Jira, Confluence, and Bitbucket. The vulnerability, CVE-2026-21589, allows unauthenticated attackers to access sensitive configuration files if they know the specific filename and path. Although exploitation attempts were recorded starting October 6, no confirmed compromises have been reported. Nonetheless, researchers at Nightwing recommend immediate patching and log reviews as a precaution.
Microsoft's Expansive Vulnerability Landscape
Microsoft has also made it easier for IT security teams to navigate this plethora of vulnerabilities by introducing new risk cohort classifications. This could help prioritize which patches require immediate attention. Among the 55 vulnerabilities labeled as “wormable,” there are significant threats affecting crucial infrastructure, such as DHCP Server, Remote Desktop Gateway, and Network Policy Server. Dustin Childs from TrendAI emphasizes the seriousness of these vulnerabilities, underscoring the potential for autonomous, network-wide propagation, which could have catastrophic impacts.
The sheer volume of vulnerabilities can be overwhelming, but it is vital to focus on what poses the most immediate risk. Childs reiterated the importance of discovering and acting on exploitable vulnerabilities rather than merely counting CVEs. With 1,413 vulnerabilities recorded this month, the norm has shifted; organizations should adapt to treat this abundance as a regular occurrence rather than an anomaly.
SAP and Adobe Security Updates
SAP also rolled out 16 new security notes, including an OAuth2 server-side request forgery vulnerability that has a critical rating. This flaw impacts multi-tenant SAP BTP (Business Technology Platform) applications and allows attackers to redirect OAuth2 token requests, potentially leading to significant security breaches.
Adobe has issued updates addressing 141 CVEs across its products, with ten marked as critical. Severe vulnerabilities in ColdFusion and Commerce demand immediate attention from users. These include several unauthenticated, network-reachable flaws that carry significant severity ratings. Admins are advised to act quickly to mitigate risks associated with these vulnerabilities.
As organizations scramble to address this unprecedented wave of vulnerabilities, it becomes clear that rapid identification and patching of known issues will be essential to safeguard against potential exploitation in the coming weeks.
Discussion
Sign in to join the discussion.