October 2026 News & Updates (new record, again)

CTC News

MyIT Program Reminder – For businesses running without managed IT, the MyIT Program provides enterprise-level protection without enterprise-level pricing. With no term agreements, you can cancel anytime if you don’t find value. Details available here.

October Monthly Maintenance Underway – Our October monthly maintenance cycle is in progress. This month’s focus includes Windows security updates (Patch Tuesday), perimeter device patching verification (firewalls, VPNs, and remote access gateways), backup integrity checks, and endpoint protection health checks. If you haven’t scheduled your maintenance window yet, please reach out to ensure your systems stay current.

Industry News

FortiGate 60E End of Life – A number of Fortinet products including the FortiGate 60E (a very popular perimeter firewall in the SMB space) is being retired on 29 December 2026. If you currently have a FortiGate 60E, you should plan to have it replaced prior to the 29 December 2026 End of Life date. The FortiGate 60F is a significant upgrade to the 60E and we’re still seeing decent ship times (typically seven to 10 days) on new orders but I expect these to start to grow by mid-November.

Windows Server 2016 End of Life – On 7 January 2027, Windows Server 2016 will officially be End of Life. If you have Windows Server 2016 (or earlier) deployed in your environment, especially considering the recent explosion in vulnerabilities discovered, it’s critical that you have a plan in place to have these End of Life systems offline prior to 7 January.

Microsoft October Patch Tuesday Nearly Doubles September’s Record: 1,411 Vulnerabilities – Just when you thought last month’s 974-vulnerability record was bad enough, Microsoft shipped 1,411 CVEs in October — nearly double September and more than the company patched in all of 2025 combined (1,244). The year-to-date total for 2026 now exceeds 4,000 vulnerabilities. Microsoft is now publishing six-digit CVEs and has introduced “risk cohorts” to help overwhelmed IT teams prioritize by environmental exposure rather than severity alone.

Windows 11 Version 24H2 and Windows 10 Enterprise LTSB 2016 Reach End of Support – Microsoft ended support for Windows 11 version 24H2 (Home and Pro editions) and Windows 10 Enterprise LTSB 2016 on October 13, 2026. The October Patch Tuesday updates are the last security updates these versions will receive. If you’re still running either version, plan an upgrade path now — unpatched endpoints are an easy target.

SonicWALL SMA 1000 Series – CVSS 10.0 (Maximum Severity) – SonicWALL disclosed CVE-2026-102255 on October 6, a pre-authentication server-side request forgery (SSRF) vulnerability in the SMA 1000 series WorkPlace interface. The flaw allows an unauthenticated attacker to force the appliance to send requests on their behalf, potentially reaching internal services and management interfaces. Threat intelligence firms observed active exploitation attempts within 24 hours of disclosure. This is the third maximum-severity pre-auth SSRF in the same SMA 1000 interface this year. Affects SMA 1000 models 6210, 7210, and 8200v. Patch to 12.4.3-03670 or 12.5.0-03082 immediately. No workaround is available.

Fortinet FortiMail Critical Zero-Day (CVE-2026-104286) – Fortinet disclosed a path traversal and NULL byte injection vulnerability in FortiMail’s Identity-Based Encryption handler on October 1. The flaw allows unauthenticated attackers to write arbitrary files to the underlying system, potentially leading to full appliance compromise. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a federal remediation deadline of October 4. Affects FortiMail 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, and 8.0.0–8.0.1. If you cannot patch immediately, disable IBE via CLI and restrict management interface access to trusted networks.

Cisco Catalyst SD-WAN Manager Authentication Bypass (CVE-2026-76504) – Cisco disclosed a critical authentication bypass in Catalyst SD-WAN Manager on September 30 that allows unauthenticated remote attackers to gain admin-level API access. Cisco confirmed active exploitation before the patch shipped. CISA added it to KEV with an October 3 remediation deadline. On-premise deployments need to upgrade to Release 20.9.10.1 or later. No workaround is available.

F5 BIG-IP APM Heap Overflow (CVE-2026-94127) – F5 disclosed a critical heap-based buffer overflow in BIG-IP Access Policy Manager on September 22. The flaw allows unauthenticated remote code execution when APM is configured as an OAuth Authorization Server. F5 confirmed active exploitation and CISA added it to KEV with a September 25 remediation deadline. Affects BIG-IP APM versions 17.1.0–17.1.3, 17.5.0, and 21.1.0. Engineering hotfixes are available on F5 Downloads.

ConnectWise ScreenConnect Critical Flaw (CVE-2026-84869) – ConnectWise patched an improper privilege management vulnerability in ScreenConnect that allows a low-privileged remote attacker to transfer and execute arbitrary files on endpoints during active remote sessions without host confirmation. CISA added it to KEV on September 11 with a September 14 remediation deadline. Because ScreenConnect is widely used by MSPs to manage thousands of endpoints, this is a supply chain attack waiting to happen. Patch clients to version 26.6.5.9742 or later.

Citrix NetScaler Zero-Day Under Active Attack (CVE-2026-88779) – Citrix patched a memory overflow vulnerability in NetScaler ADC and Gateway that attackers were exploiting in zero-day attacks before fixes were available. CISA added it to KEV on October 4 with an October 7 remediation deadline. If you run NetScaler, confirm you’re on a patched build.

Ivanti Connect Secure Authentication Bypass (CVE-2026-104935) – Ivanti disclosed an authentication bypass in Connect Secure on October 13 that CISA says attackers are already using for credential theft and data exfiltration. CISA added it to KEV the same day with an October 16 remediation deadline. If you use Ivanti Connect Secure, patch immediately.

Docker Hub Critical Flaw – Docker patched a critical vulnerability in DockerHub that lets attackers impersonate users and push images from others’ repositories. If your build pipeline pulls from DockerHub, review image provenance and rotate credentials.

Atlassian Critical Vulnerability (CVE-2026-21589) – Atlassian released security updates for a critical arbitrary file access vulnerability affecting multiple self-hosted Data Center products, including Confluence, Jira, Bitbucket, Bamboo, and Crowd. Attackers began exploiting the flaw shortly after a proof-of-concept was released. CISA added it to KEV on October 15. Patch now.

Updates

DEPLOY IMMEDIATELY – Microsoft’s October 2026 Patch Tuesday is unprecedented: 1,411 vulnerabilities patched, including 70 critical bugs and 3 zero-day vulnerabilities (at least one actively exploited in the wild, two publicly disclosed). To put that in perspective: Microsoft patched approximately 974 CVEs in September — itself a record — and 1,244 CVEs in all of 2025. This single month broke both records. The year-to-date total for 2026 now exceeds 4,000 vulnerabilities.

The breakdown by category includes hundreds of elevation of privilege, remote code execution, information disclosure, denial of service, security feature bypass, and spoofing vulnerabilities across Windows, Office, SQL Server, SharePoint, Azure, Exchange Server, and Developer Tools. Nearly 4 in 5 vulnerabilities affect Windows. Microsoft has credited AI-assisted vulnerability discovery for the accelerating volume.

Actively Exploited:

CVE-2026-96951 – Windows Shell security feature bypass. Improper neutralization of special elements allows an unauthorized attacker to bypass the Mark of the Web (MotW) protection mechanism over a network. CVSS 8.8. This is the third Windows Shell vulnerability exploited in the wild during 2026.

Publicly Disclosed:

CVE-2026-108398 – .NET Framework security feature bypass. Allows an authenticated attacker to register a malicious .NET assembly for loading by a protected process, bypassing Windows Defender Application Control (WDAC) enforcement. Discovered by James Forshaw of Google Project Zero.

CVE-2026-92707 – MessagePack-CSharp denial of service. Improperly controlled sequential memory allocation in .NET allows an unauthorized attacker to deny service over a network.

Notable Critical:

CVE-2026-70229 – Windows Active Directory Domain Services remote code execution (CVSS 8.1). Microsoft assesses exploitation as “more likely.”

CVE-2026-70571 – Microsoft Exchange Server remote code execution (CVSS 8.1). An attacker could exploit this by sending a specially crafted email; arbitrary code executes when the server processes it through internal content conversion.

Five Outlook Preview Pane RCEs – CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156, and CVE-2026-70291 are all remote code execution vulnerabilities in Outlook where the preview pane is the attack vector. Simply scrolling past a malicious email can trigger exploitation. All five receive fixes in the same patches.

Microsoft also announced that Windows 11 version 24H2 (Home and Pro) and Windows 10 Enterprise LTSB 2016 reached end of support on October 13, 2026. The October security updates are the last available for these versions.

Microsoft releases regular updates the second Tuesday of each month, often referred to as “Patch Tuesday.” These updates are categorized as Low, Moderate, Important or Critical. Details on the categories are available here. The updates can include any supported Microsoft product from Windows to Office to Edge and server products like Exchange and SQL Server. If you have one or more of these products installed, especially if the update is listed as Important or Critical, it’s important that the updates are installed.

Additional details on this month’s Microsoft updates are available from Bleeping Computer, SecurityWeek, Rapid7, and Zero Day Initiative.

Adobe has released 11 security bulletins this month addressing 176 vulnerabilities, 23 of them critical. Affected products include Adobe Commerce, Adobe ColdFusion, Adobe Photoshop, Adobe Substance 3D Stager, Adobe Dimension, and Adobe Framework. Details available from Adobe Here including links to download the update(s) and instructions for installation.

Like Microsoft, Adobe now releases updates to their products on the second Tuesday of each month. Adobe will also release ‘out of band’ updates if necessary to address critical vulnerabilities in their products. Adobe products include Adobe Reader (for viewing PDF files), Adobe Photoshop, Adobe Illustrator, Adobe Acrobat, and the Adobe Creative Suite.

Need IT Support for your Home or Business? We’d love to help!

Are you a small to medium sized business looking to leverage technology and enable your business and workforce to work smarter and more efficiently? Do you already have computers, servers, firewalls, VPNs or other technology that you’re not taking full advantage of? Are you looking for an IT Service Provider who understands small to medium sized businesses needs and the challenges that we face that can work with you to grow your business rather than just sell you time?

Cyber Tech Cafe is an IT Service Company with a focus on helping small to medium business get the most out of their technology investment. As a small business ourselves, we understand the challenges you face and have designed our service offerings to help you get the most out of your technology dollar. We offer on-call, as needed support if you just need a quick fix or extra set of hands right now. We also offer maintenance plans that we call “MyIT” that are designed to address the most common concerns (patch management, disaster recovery / backup, log review, etc.) that are based on the number of workstations and servers that you have and have no term contract. We believe that, if you find value in what we’re doing, you’ll find a way to keep us around without a contract saying that you have to.

If you have questions about the MyIT plans or have an IT need that you need addressed right now, let us know. We look forward to the opportunity to earn your business.