October Patch Tuesday roundup: Over 1,400 Microsoft holes to be plugged, including three zero days

Microsoft released a record-shattering 1,407 CVEs to be plugged today on October Patch Tuesday, breaking the 2020 record of 1,261. The list was so long that its release was several hours later than the usual 1 p.m. Eastern drop time, somewhat frustrating admins.

The bugs include three zero-day vulnerabilities, one of which has been exploited.

The zero day being exploited, and that should be dealt with immediately, is CVE-2026-96951, a security flaw that bypasses the Mark of the Web (MotW) protections in Windows Shell.

This is the third flaw in Windows Shell that has been exploited in the wild this year, noted Satnam Narang, senior staff research engineer at Tenable. The others are CVE-2026-21510, which is linked to the advanced persistent threat group APT28 (also known as Fancy Bear), and CVE-2026-32202, a known exploited vulnerability which was a fix for an incomplete patch for CVE-2026-21510.

“There have been 26 Windows Shell vulnerabilities patched in 2026 through October,” said Narang, “a staggering figure compared to previous years, with only three Windows Shell CVEs in 2025, and just one in 2024 and 2022.”

Another zero day is a hole in SharePoint (CVE-2026-102866) which allows unauthenticated attackers to exploit cryptographic token validation flaws and hijack targeted user accounts.

The third zero day is CVE-2026-108398, an untrusted search path in Windows’ .Net framework that allows an unauthenticated attacker to bypass Windows Defender Application Control enforcement. This could lead to the ability to run unauthorized applications on target systems.

Among other vital patches, developers running self-managed instances of GitLab should quickly patch their servers to plug a hole that could allow an unauthenticated user to exploit arbitrary code through a specially crafted regular expression in a CI/CD configuration. GitLab has remediated this issue in its hosted instance.

“CVE-2026-97229 puts a critical part of the software supply chain at risk,” commented Gene Moody, Field CTO at Action1. Treat this hole as an emergency, he said, and immediate patch self-managed instances.

Critical IBM bugs

IBM is warning that a critical vulnerability has been found in its IBM i versions 7.3, 7.4, 7.5 and 7.6 operating systems for Power Systems hardware. The hole, CVE-2026-96119 with a CVSS score of 9.9, allows a remote authenticated attacker to execute arbitrary code due to improper data sanitization in the HTTP Server Administration Graphical User Interface (GUI). IBM strongly recommends that the vulnerability be patched immediately. Users of unsupported versions of the OS should upgrade to supported and fixed versions.

Attacks on Atlassian self-hosted products

Atlassian reported exploitation attempts that also warrant immediate patching and log review, said researchers at Nightwing. CVE-2026-21589 affects eight self-hosted products, including Jira, Confluence and Bitbucket. An unauthenticated attacker who knows an exact filename and path can read specific files inside the application’s web root; sensitive configuration files could expose information useful for further intrusion.

There are reports that exploitation attempts began October 6, although attempts do not establish successful customer compromise. Patch every affected installation, Nightwing advised, including applicable cluster nodes and mirrors. If patching is delayed, restrict external access and apply Atlassian’s temporary mitigation; a normal login does not block this flaw. Review access logs and rotate secrets where exposure is suspected.

Atlassian Cloud is patched, and requires no user action.

Microsoft patches

Researchers at Nightwing drew attention to four updates for on-premises Exchange Server, each of which fixes a high severity vulnerability with a CVSS score of 8.8. “While each update addresses only a single CVE, the 8.8 CVSS score signals a serious risk, likely involving privilege escalation or remote exploitation potential,” Nicholas Carroll, Nightwing’s cyber incident response manager said. “Exchange admins should prioritize testing and deployment of these patches, given the historical track record of Exchange vulnerabilities being actively targeted in the wild.”

Nightwing also noted that Microsoft has introduced new risk cohort classifications for how IT and security teams should prioritize vulnerabilities.

Dustin Childs, head of threat awareness at TrendAI’s Zero Day initiative, said CSOs should take action on a hole in SharePoint (CVE-2026-102866), which allows unauthenticated attackers to exploit cryptographic token validation flaws and hijack targeted user accounts. Microsoft said an unauthenticated attacker who obtains a valid proof token for a targeted user could modify the token and submit it to an affected SharePoint server. Successful exploitation could allow the attacker to authenticate as that user and access or modify content available to the compromised account. User interaction is not required.

A ’monster’ batch of Microsoft fixes

There are 55 wormable CVEs this month, Childs warned. These are heavily concentrated across critical infrastructure like DHCP Server (6), Remote Desktop Gateway (3), and Network Policy Server (4). They create “an unprecedented risk of autonomous, network-wide propagation,” he said.

“Hundreds of CVEs in a single release used to be the exception,” commented Childs. “Now it’s the baseline. Is AI to blame? Partly. It’s accelerating bug-hunting on both sides of the fence, so vendors are finding (and fixing) more flaws, and researchers are finding them faster too. But AI isn’t creating these bugs out of thin air; it’s just shortening the time between a vulnerability existing and someone noticing it.”

He noted that the volume of CVEs isn’t the real story anymore. “What matters is that discovery is scaling faster than exploitation, so teams that triage by sheer CVE count instead of exploitability are burning cycles on the wrong bugs,” he said. “Patch what’s proven, prioritized, and public, and treat everything else as this month’s new normal.”

Jack Bicer, director of vulnerability research at Action1, drew attention to several critical vulnerabilities that present substantial risks to externally accessible systems and enterprise infrastructure. Windows Message Queuing Queue Manager Remote Code Execution Vulnerability (CVE-2026-100202), Microsoft PostScript Printer Driver Remote Code Execution Vulnerability (CVE-2026-70147 and CVE-2026-70153), and Microsoft QUIC Remote Code Execution Vulnerability (CVE-2026-105016 and CVE-2026-100219) each carry CVSS scores of 9.8 and could allow attackers to execute malicious code remotely without authentication or user interaction. Although active exploitation has not been confirmed for these vulnerabilities, he said, their low attack complexity and potential for severe system compromise make them significant enterprise risks.

While one commentator called the number of Microsoft vulnerabilities listed this month as “monster,” Tyler Reguly, Fortra’s associate director of security R&D, disagreed: “I’ve argued that [vulnerability] numbers are meaningless. This month’s number, 1,413, is no different.”

There are, however, numbers that hold meaning, he noted. “Twenty-six, for example, is how many 2026 Microsoft CVEs have shown up in the CISA KEV (Known Exploited Vulnerabilities] catalogue. Last year, that number was 30, and the year before was 32. That means less than 1% of vulnerabilities patched by Microsoft this year are known to be exploited. That’s an important number, but 1,413 definitely isn’t.” 

SAP Security Notes

In all, SAP released 16 new security notes, four GitHub security advisories and two updates to previously released security notes. One, an OAuth2 server-side request forgery vulnerability in SAP Cloud SDK for Python, is rated a 10 in criticality. It affects multi-tenant SAP BTP (Business Technology Platform) applications. An attacker who controls the tenantsubdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated, SAP said.

But CSOs with SAP products in their environment will also want to ensure admins have taken action on three other critical vulnerabilities:

Security Note 3805589 (CVE-2026-89107, with a CVSS score of 9.9) addresses a code injection vulnerability in SAP S/4HANA Manage Substitution/Validation.. This is an app allowing users to display, change, and create substitution and validation rules for selected business contexts and events. These rules can be used in business processes to validate, derive, or replace values at the time of entry for the relevant fields.

Jonathan Stross, Pathlock’s senior product manager for cybersecurity R&I, noted that for organizations using these functions for journal-entry rules, the potential consequence is a full compromise of the system that processes those rules. The temporary mitigation also has a business cost, because it prevents users from adding, changing or deleting rules through the related SAP Fiori applications. Fiori is a modern user interface that replaces the traditional SAP interface. 

To exploit the vulnerability, Stross said, an attacker with the required business-role access needs to submit a malicious rule definition. The vulnerable processing logic treats that input as executable code rather than restricting it to the intended rule language. The resulting risk extends beyond unauthorized changes to an individual substitution or validation rule. No user interaction is required. 

SAP Security Note 379711 (CVE-2026-89110, with a CVSS score of 9.9) patches a broken access control vulnerability in SAP NetWeaver Visual Composer. Detected by Onapsis Research Labs (ORL), the issue is that certain portal functionality in Visual Composer allows a low-privileged attacker to invoke internal operations on a preconfigured remote system. A security configuration is available that allows for the definition of an allowlist of permissible data services to be invoked, however, this configuration is not enabled by default.

The patch changes the default configuration by enabling the secure settings. The note provides an additional FAQ document and explains how the secure configuration can be enabled manually, prior to applying the permanent patch. A successful exploit of this vulnerability could lead to a full compromise of the remote system.

SAP Security Note 3788788 (CVE-2026-89108, with a CVSS score of 9.1), patches a missing authorization check vulnerability in SAP Manufacturing Integration and Intelligence (Configuration Service). Onapsis said that, when authenticated as an SAP XMII Admin user with network access to specific endpoints, an attacker could submit a specially crafted request to provision an account with administrative privileges on the underlying Java application server. This account can be used to fully compromise the system. 

Adobe security bulletins

Adobe released 10 bulletins covering 141 CVEs, reported Chris Goettl, VP of product management at Ivanti. Fifteen of these are critical, although Adobe is not aware of exploitation of any of them. Admins should start with the two products holding the most critical severity ratings, he said:

ColdFusion (APSB26-144): 10 Critical flaws, including three unauthenticated, network-reachable bugs rated 9.8 or higher (CVE-2026-105899; CVE-2026-106622; and CVE-2026-106624), none of which has as yet been added to the NIST vulnerability database. Users should update to ColdFusion 2025.0.14 or 2023.0.26.

Commerce (APSB26-153): five Critical flaws, including CVE-2026-103849 and CVE-2026-92909, neither requiring authentication to exploit. Customers also need to apply the hotfix for CVE-2026-75650 from the September 7 APSB26-146 update.