Microsoft security advisory – October 2026 monthly rollup (AV26-1038)
Canada's Cyber Centre urges patching Microsoft's October 2026 updates after exploited CVE-2026-96951 entered CISA's KEV.
74
Product
Microsoft SQL Server
- Mentions · 7d0
- Mentions · 30d6
- All mentions12
- First seenAug 27, 2026
- Last mentioned16d ago
Timeline
12 articles · newest firstMicrosoft Patch Tuesday Sets New Record with 1,415 CVEs in October 2026 Updates
Microsoft's October 2026 updates fix 1,415 CVEs, including an exploited Windows Shell zero-day.
84
Hackers Use AI Agents and GodPotato Exploit to Gain Windows SYSTEM Privileges
Attackers used AI agents and GodPotato to turn an exposed Tomcat endpoint into Windows SYSTEM access.
68
Hackers Breach Two Major South Korean Churches, Exposing Data of Over 1 Million People
Attackers breached two South Korean churches, exposing roughly one million congregant records and financial data.
75
Hackers Use ERP Web Shell and IDOR Flaws to Breach Major South Korean Churches
Attackers breached two major South Korean churches with ERP web shells and IDOR flaws, exposing hundreds of thousands of records.
76
Hackers Turned a Microsoft SQL Server Into a Command and Data Exfiltration Channel
Attackers abused a Viva Aerobus SQL Server to run commands and steal files, then exposed tools and data online.
62
Operation Master Exploits GlobalProtect CVE-2026-0257 and Deploys AdaptixC2 Across Enterprise Networks
Operation Master exploited GlobalProtect CVE-2026-0257, deployed AdaptixC2, and ran large-scale credential theft and invoice fraud.
84
CVE-2019-1068: A remote code execution vulnerability exists in ...
CISA added CVE-2019-1068, a high-severity remote code execution flaw in Microsoft SQL Server, to its KEV catalog after confirming exploitation in the wild.
72
August 2026 CVE Landscape
Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.
68
U.S. CISA adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog
CISA added six flaws, including actively exploited CVE-2026-8452 in Citrix NetScaler, to its Known Exploited Vulnerabilities catalog with federal patch deadlines.
68
CISA Warns of Microsoft SQL Server RCE Vulnerability Exploited in Attacks
CISA warns attackers are exploiting CVE-2019-1068, a remote code execution vulnerability in Microsoft SQL Server, to run malicious commands on database servers.
70
CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
CISA added six actively exploited flaws to KEV, led by Citrix NetScaler CVE-2026-8452, with federal patch deadlines set.
72
Related CVEs
by mentions- CVE-2019-106857%8.8Remote Code Execution in Microsoft SQL Server 2016 and 2017
- CVE-2021-2375883%9.8Unauthenticated .NET Deserialization RCE in Ajax.NET Professional (ajaxpro.2)
- CVE-2026-9695110%8.8Windows Shell command injection bypasses a security feature
- CVE-2026-84521%8.8Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild
- CVE-2022-09959%7.8Out-of-Bounds Write in Linux Kernel watch_queue Enables Local Privilege Escalation
- CVE-2015-32469%7.4Race Condition in Red Hat libuser Allows Local Privilege Escalation
- Local Privilege Escalation via Symlink Attack in Red Hat ABRT
- CVE-2025-6259360%9.4Actively Exploited Browser-Based RCE in Ray AI Compute Engine
- CVE-2026-8157884%8.8Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
- CVE-2026-33954%5.5A flaw has been found in MaxSite CMS up to 109.1
Appears with
- Microsoftvendor · 12
- CISAorganization · 5
- Windowsproduct · 4
- Red Hat libuserproduct · 3
- Red Hatvendor · 3
- Ajax.NET Professionalproduct · 3
- Microsoft Officeproduct · 2
- SAPvendor · 2
- UAT-10147threat actor · 2
- Microsoft SQL Servervendor · 2
- Azureproduct · 2
- Red Hat ABRTproduct · 2
- SAPproduct · 2
- Linux Kernelproduct · 2
- MinIOproduct · 2
- Citrixvendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.