Patch Tuesday 2026, October more 1413 CVE !!!

On 13 October 2026, the release notes of the Security Update Guide, maintained by the MSRC (1), announce 1,413 CVEs (2) fixed by Microsoft in the October release. To these is added the republication of a CVE assigned by Cisco Talos, CVE-2026-21413, which affects Raw Image Extension. The previous highest total, 973 CVEs in September 2026, had been presented as a record by Help Net Security.

The release notes break the CVEs down by product family, with the number of distinct updates and their distribution mode. The total row of the table shows 1,414 CVEs; the sum of the rows gives 1,413.

Fig. 1. Breakdown of the October 2026 CVEs by product family, as published in the MSRC release notes. Family labels taken from the release notes.

The records of the 1,407 CVEs assigned by Microsoft and published on 13 October give 78 critical CVEs and 1,329 important ones. By impact type, there are 673 elevations of privilege, 315 remote code executions, 252 information disclosures, 71 denials of service, 40 security feature bypasses, 29 tampering issues and 27 spoofing issues.

Only one CVE is flagged as exploited, CVE-2026-96951, in Windows Shell. One CVE is flagged in the release notes as disclosed before publication, CVE-2026-108398, in .NET Framework. The record of CVE-2026-92707, assigned by GitHub, also carries the publicly disclosed flag.

CVE-2026-96951 affects Windows Shell. Its record classifies it as a security feature bypass, rated important, with a CVSS (6) 3.1 base score of 8.8 and a temporal score of 8.2, for the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C. The temporal metric E:F denotes functional exploit code. The weakness is mapped to the CWE (7) catalogue, entry CWE-77, improper neutralisation of special elements used in a command. The exploitability table shows exploitation detected and no prior public disclosure.

According to the record’s frequently asked questions, exploitation makes it possible to evade Mark of the Web defences, the marking that Windows applies to files originating from the Internet. The scenario described relies on a specially crafted file sent by email or instant messaging. The attacker cannot force the file to be opened: the user has to be led into taking action, for instance clicking a link or opening an attachment.

CISA added the CVE to the KEV catalogue on 13 October 2026, with a remediation due date of 16 October 2026 for United States federal agencies. The entry refers to directive BOD (8) 26-04 and carries the forensic triage flag. Use in ransomware campaigns is recorded as unknown. These values were taken from the JSON (9) feed of the catalogue, version 2026.10.13.

The Security Update Guide links the CVE to 31 product rows: Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2, Windows Server 2012 R2, 2016, 2019, 2022 and 2025, as well as an Outlook.com row that points to release notes. Windows systems are fixed through the October cumulative update for each version, detailed in the next section. The record credits four contributors, including two researchers from Fujitsu Limited.

CVE-2026-108398 affects .NET Framework. Its record classifies it as a security feature bypass, rated important, with a base score of 8.8 for the vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C, and maps it to entry CWE-426, untrusted search path. It is flagged as disclosed, not exploited, with the exploitability index Exploitation Less Likely. According to the frequently asked questions, an authenticated attacker can place a specially crafted .NET assembly on the system and register it to be loaded by a protected process; exploitation then bypasses Windows Defender Application Control and allows unauthorised code to run within that process, with no user interaction.

The Security Update Guide links the CVE to 24 rows covering .NET Framework 3.5, 4.6.2 to 4.7.2, 4.8 and 4.8.1, from Windows 10 version 1607 to Windows 11 version 26H2 and from Windows Server 2012 to Windows Server 2025. For most systems, the fix is published in KBs (10) specific to .NET Framework, numbered from KB5127666 to KB5127694. For Windows 10 version 1607 and Windows Server 2016, the .NET Framework 3.5 and 4.6.2 to 4.7.2 row points to cumulative update KB5126868.

CVE-2026-92707, assigned by GitHub’s CNA (11), also carries the publicly disclosed flag. It is a denial of service in MessagePack-CSharp, rated moderate, with a base score of 5.3. The products listed are the MessagePack library, Visual Studio 2022 version 17.14, Visual Studio 2026 version 18.10 and the Microsoft.AspNetCore.SignalR.Protocols.MessagePack package for .NET 8, 9, 10 and 11 on Windows, Linux and macOS. The release notes do not list it among the notable CVEs.

The following table maps each version of Windows to its October cumulative update, based on the Security Update Guide export and the KB list in the release notes.

Fig. 2. October 2026 cumulative updates by Windows version, taken from the Security Update Guide export and cross-checked against the release notes.

Windows 11 version 26H2 enters its first Patch Tuesday: the Windows 11 Home and Pro lifecycle page dates the start of its support to 28 September 2026, and it shares update KB5127648 with versions 24H2 and 25H2. The same page sets 13 October 2026 as the end of servicing for version 24H2 in the Home and Pro editions.

Eleven CVEs published on 13 October are linked in the export only to the September 2026 cumulative updates, numbered from KB5122871 to KB5124012 depending on the system: CVE-2026-69354, CVE-2026-69363, CVE-2026-69521, CVE-2026-69789, CVE-2026-70067, CVE-2026-71347, CVE-2026-83504, CVE-2026-83518, CVE-2026-83706, CVE-2026-87706 and CVE-2026-87707. CVE-2026-69789, in Reliable Multicast Transport Driver, is critical. The rendered page of its record does list the September articles, for example KB5122876 for Windows Server 2019. CVE-2026-59116, a security feature bypass in Windows Remote Desktop, is linked to earlier articles, from KB5099414 to KB5101650.

For Windows 10 version 1607, Windows Server 2016, Windows Server 2012 and Windows Server 2012 R2, two CVEs are linked both to the cumulative update and to a second article, KB5126649, KB5127356 or KB5127357 depending on the system: CVE-2026-83863, in Servicing Stack Updates, and CVE-2026-69950, in Windows Overlay Filter.

According to the header of the records, 79 CVEs published on 13 October are critical: 78 assigned by Microsoft and the Cisco Talos republication. They comprise 66 remote code executions, 11 elevations of privilege and 2 spoofing issues.

Fig. 3. Breakdown of the 79 critical CVEs of 13 October by family. Grouping drawn up for this article from the component tag of each record; it does not match the families in the release notes.

Office and the reading pane

The five critical Outlook CVEs, CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016 and CVE-2026-97749, have a base score of 9.8 with no user interaction. Their records state that displaying the message in the Outlook reading pane is enough to trigger the vulnerability, without opening it or clicking anything. The record of CVE-2026-70300, in Word, scored 9.8, states that the preview pane is an attack vector, through a WordPerfect document containing a linked graphics file. The 19 critical Excel CVEs and the three Visio ones require user interaction.

For nine Office CVEs, CVE-2026-70300 and the Excel CVEs CVE-2026-97741, CVE-2026-97742, CVE-2026-97753, CVE-2026-97756, CVE-2026-97758, CVE-2026-97761, CVE-2026-97767 and CVE-2026-97776, the critical rating appears in the header of the record while each row of the updates table shows Important. The discrepancy was observed on the rendered page of the CVE-2026-70300 record. Sorting on the severity column of the export keeps 70 critical CVEs instead of 79.

The Office products listed in October are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office for Mac, Office Online Server and Office for Android. The export contains no Office 2016 or Office 2019 row.

Windows network services

The critical Windows CVEs exploitable over the network without authentication or interaction concern infrastructure services:

• Windows DHCP Server: CVE-2026-96934, base score 9.8, and CVE-2026-88117, CVE-2026-88119, CVE-2026-88120, CVE-2026-88171, scored 8.1; for the last four, the high complexity comes from a race condition the attacker has to win
• Windows Message Queuing: CVE-2026-100202, 9.8, and CVE-2026-108460, 8.1
• Microsoft QUIC: CVE-2026-100219 and CVE-2026-105016, 9.8
• Windows Text Shaping: CVE-2026-97814, 9.8
• Microsoft PostScript Printer Driver: CVE-2026-70147 and CVE-2026-70153, 9.8, by sending a specially crafted print job
• Active Directory Domain Services: CVE-2026-70229, 8.1, index Exploitation More Likely; the record states that exploitation depends on particular network configurations and timing conditions
• Remote Desktop Gateway Service: CVE-2026-70187, 8.1
• Network Device Enrollment Service: CVE-2026-69802, 8.1
• Windows Deployment Services: CVE-2026-88174, 8.1
• Microsoft Windows PDF: CVE-2026-108457, 8.1

Isolation, kernel and content

The other critical Windows CVEs are local, adjacent or require interaction. Hyper-V has three: CVE-2026-102214 and CVE-2026-105733, remote code executions scored 8.8, the first of which, according to its record, allows a low-privileged Hyper-V guest to execute code on the host, and CVE-2026-108399, an elevation of privilege scored 7.2. Windows Virtualization-Based Security enclaves have five: CVE-2026-88074, CVE-2026-96914, CVE-2026-102211, CVE-2026-108130 and CVE-2026-108471. To these are added elevations of privilege in Windows Kernel (CVE-2026-96913), Windows Graphics Kernel (CVE-2026-88073) and Windows ALPC (CVE-2026-83917), remote code executions triggered by content in Windows GDI+, Microsoft Windows Media Foundation, Windows Media Video Decoder, Windows Text Shaping and Microsoft Graphics Component, two adjacent-network vulnerabilities in Windows DHCP Client (CVE-2026-70250) and Reliable Multicast Transport Driver (CVE-2026-69789), and two spoofing issues in Active Directory Federation Services (CVE-2026-108131 and CVE-2026-96222).

55 CVEs published on 13 October have a base score of 9.8. 15 are critical. The other 40 are rated important although their vector is identical: network, low complexity, no privileges and no interaction (AV:N/AC:L/PR:N/UI:N). 39 are remote code executions, the last one an elevation of privilege in Microsoft Windows Search Component (CVE-2026-105010).

Several records give the same answer: an unauthenticated attacker sends a specially crafted packet to an affected service, with no authentication or user interaction. This is the case, among the records consulted, for Role: DNS Server (CVE-2026-83869), Windows Local Security Authority Subsystem Service (CVE-2026-96219), RPC Runtime (CVE-2026-83910), OpenSSH for Windows (CVE-2026-97816), Windows Internet Information Services (CVE-2026-70024), Network Policy Server (CVE-2026-100222), Windows Routing and Remote Access Service (CVE-2026-85809) and Windows DHCP Server (CVE-2026-96320). The records do not explain the gap between this score and the important rating.

Fig. 4. The 40 CVEs of 13 October scored 9.8 and rated important, vector AV:N/AC:L/PR:N/UI:N. Values taken from the Security Update Guide records.

Of the 1,407 CVEs assigned by Microsoft and published on 13 October, 168 combine a network vector, no privileges and no interaction. 83 of them are remote code executions; 30 are critical and 138 important.

Exchange Server

The release notes count seven CVEs for Exchange Server. CVE-2026-70571, critical, is a remote code execution scored 8.1 with high complexity: an unauthenticated attacker sends a specially crafted email that triggers an internal content conversion process on the server. The record states that in-depth knowledge of the target environment is required and that success is not guaranteed; the exploitability index is Exploitation More Likely. CVE-2026-70279, a cross-site scripting spoofing issue scored 9.3, carries the same index; its scenario relies on a link sent to a user with administrative rights. The other four CVEs of 13 October are elevations of privilege: CVE-2026-77910, CVE-2026-87692, CVE-2026-87695 and CVE-2026-87696.

The seventh, CVE-2026-96940, an elevation of privilege scored 8.8 with the index Exploitation More Likely, was published on 2 October with its own updates. Its record states that a service-side fix has already been deployed to Exchange Online.

Fig. 5. Exchange Server updates published in October 2026, based on the Security Update Guide export. For Exchange Server 2019 Cumulative Update 15, the export does not list CVE-2026-87692.

SharePoint Server

SharePoint Server has 36 CVEs in the release notes. Only one is critical, CVE-2026-102866, an elevation of privilege scored 8.1 with high complexity, limited to SharePoint Server Subscription Edition (KB5002927). According to its record, an unauthenticated attacker who obtains a valid proof token for a targeted user can modify it, submit it to the server and authenticate as that user; the preview pane is not an attack vector.

The export also lists SharePoint Server 2019, for CVE-2026-69943 and CVE-2026-97783, and SharePoint Enterprise Server 2016, for CVE-2026-69943, with no article and no download link. The Microsoft Learn lifecycle pages set the end of extended support for both versions at 14 July 2026.

SQL Server

SQL Server has 22 CVEs, none of them critical: 8 remote code executions, 7 elevations of privilege, 4 information disclosures and 3 denials of service. The highest base score is 8.8, for remote code executions that require low privileges (PR:L). The fixes cover SQL Server 2017, 2019, 2022 and 2025, with one article per servicing branch: KB5126934, KB5126967 and KB5128492 to KB5128497.

Several CVEs are not fixed, or not only fixed, by the Windows cumulative update.

• Microsoft Store: four critical CVEs target extensions distributed through the Store. Raw Image Extension has three: CVE-2026-21413, republished from Cisco Talos and scored 9.8 with no interaction, is triggered according to its record when Windows generates a thumbnail or preview of a RAW file placed in a browsed folder; CVE-2026-96202 and CVE-2026-96943 are scored 8.8 with interaction. CVE-2026-108400, in HEVC Video Extensions, is scored 8.8 and requires a file to be opened. For these four CVEs, the export points to release notes, with no KB.
• .NET and Visual Studio: CVE-2026-105016, in Microsoft QUIC, scored 9.8, affects Windows 11, Windows Server 2022 and Windows Server 2025, fixed by the cumulative update, but also .NET 8, 9, 10 and 11 on Windows, Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.10, for which the export points to release notes.
• Linux kernel: CVE-2026-62840, a critical elevation of privilege scored 7.0, is linked to the Microsoft MANA Network Driver and to third-party Linux distributions. The record refers to the fix accepted upstream and to the distributions’ security advisories.
• Defender: the release notes classify the four CVEs in the Defender family as automatic updates.
• Cloud services: seven critical CVEs published on 8 October require no customer action according to their records, in Azure Event Grid (CVE-2026-83947), Microsoft Partner Center (CVE-2026-96207, 10.0), Microsoft Bookings (CVE-2026-94510, 9.9), Microsoft Dataverse (CVE-2026-88131, 9.8), Azure App Service (CVE-2026-77900, 9.8), Azure API Center (CVE-2026-83943) and Azure SRE Agent (CVE-2026-69435, 9.6).

Outside observed exploitation, Microsoft’s exploitability index classifies 108 CVEs published on 13 October as Exploitation More Likely, of which 2 are critical and 106 important. 102 are elevations of privilege. The most represented components are Windows Win32 Kernel Subsystem, with 15 CVEs, and Windows Kernel, with 7, followed by Windows Error Reporting, Microsoft Windows Search Component, Windows Background Intelligent Transfer Service, Windows Direct Composition and Windows Update, with 5 CVEs each.

Six CVEs on this list are not elevations of privilege: the remote code executions CVE-2026-70229 (Active Directory Domain Services), CVE-2026-70571 (Exchange Server), CVE-2026-100214 (Microsoft Dynamics 365 Business Central) and CVE-2026-88159 (Windows Background Intelligent Transfer Service), the spoofing issue CVE-2026-70279 (Exchange Server) and the tampering issue CVE-2026-96858 (Windows Security Account Manager).

• Windows Server 2012 and Windows Server 2012 R2: the Microsoft Learn lifecycle pages set the third year of the ESU programme from 14 October 2025 to 13 October 2026, with no further year listed. The October export still links 620 CVEs to Windows Server 2012 and 657 to Windows Server 2012 R2.
• Exchange Server 2016 and 2019: the Exchange team stated on 20 July 2026 that period 2 of the ESU programme ends with the month of October 2026, that no update will be released for these versions afterwards and that no further extension is planned. It points to Exchange Server Subscription Edition.
• Windows 11 version 24H2, Home and Pro editions: end of servicing on 13 October 2026 according to Microsoft Learn.
• Windows 10: Microsoft’s consumer ESU programme page states that enrolment remains possible until the end of the programme, on 12 October 2027.
• ADV260001: this advisory announces hardening changes to the ReFS file system on removable media, starting with the updates of 13 October 2026. According to the advisory, the change is not enabled by default before 2027.

On 13 October 2026, the MSRC published a blog post introducing risk cohorts, provisional groupings of CVEs that share the same assessment question for the customer: exposure of a role, a privilege boundary, the type of content processed. The post states that these are not official categories, that they do not change update guidance and do not replace the assessment of each CVE. The Security Update Guide does not display these groupings; feedback is requested at CVE@microsoft.com. The post notes that the approach could become more useful as AI-assisted research contributes to vulnerability discovery.

Fig. 6. The fifteen illustrative risk cohorts published by the MSRC on 13 October 2026, sorted by number of CVEs. Total: 1,118 CVEs.

The fifteen cohorts add up to 1,118 CVEs, fewer than the volume of the release. The post contains internal discrepancies: the Remote-access and RDP deployments cohort has 65 CVEs in the table and 64 in the text; the Office cohort has 135 CVEs in the table, while the text describes 119, of which 23 are critical and 17 require no user interaction.

Ivanti Connect Secure

On 13 October 2026, CISA added CVE-2026-104935, in Ivanti Connect Secure, to the KEV catalogue, with a due date of 16 October. On the same day, Volexity described an exploitation chain against the VPN (13) gateway observed since 3 October and attributed to an actor tracked as UTA0576: authentication bypass in welcome.cgi using the X-DSCGI-PATH header, then a file write in wu.cgi exploited through a race condition. Volexity also describes an elevation of privilege in the dsinvoked component, with no CVE, whose fix is announced for a later release. Volexity assesses with low confidence that the actor is criminally motivated, and with medium confidence that it uses large language models to develop its exploit code. Affected and fixed versions should be read from Ivanti’s advisory.

SAP

SAP’s Security Patch Day of 13 October 2026 includes 16 new security notes, 4 GitHub security advisories and 2 updates to earlier notes. The four entries with critical priority are CVE-2026-89111, server-side request forgery (SSRF (14)) related to OAuth2 in SAP Cloud SDK for Python, scored 10.0, CVE-2026-89110, broken access control in SAP NetWeaver Visual Composer, scored 9.9, CVE-2026-89107, code injection in SAP S/4HANA (Manage Substitution/Validation Rules), scored 9.9, and CVE-2026-89108, missing authorisation check in SAP Manufacturing Integration and Intelligence (Configuration Service), scored 9.1.

Publications from other vendors dated 13 October were not verified for this article.

Fig. 7. Remediation priorities for the October 2026 Patch Tuesday, drawn from the Security Update Guide records and the KEV catalogue.

The number of CVEs and the number of critical CVEs vary with the source and the scope used.

Fig. 8. October 2026 Patch Tuesday counts by source, as of 13 October 2026.

The 12 third-party CVEs in the records include CVE-2026-21413 from Cisco Talos, CVE-2026-92707 from GitHub and ten CVEs with no severity assigned by Red Hat, MITRE and GitHub, which are absent from the export. The SANS Internet Storm Center totals are matched exactly by addition: the 69 Microsoft CVEs rated critical per product row in the export plus the 7 critical cloud CVEs of 8 October give 76; the 1,407 Microsoft CVEs of 13 October, the 7 cloud CVEs, CVE-2026-96940 of 2 October, CVE-2026-21413 and advisory ADV260001 give 1,417.

The Cyber Security News headline announces 1,118 fixed vulnerabilities; this figure is the sum of the fifteen cohorts in the MSRC post and not the total of the release.

Sorted by identifier. The severity is the one shown in the header of each record; the Fix column shows the distribution channel taken from the Security Update Guide export.

Fig. 9. The 79 critical CVEs published on 13 October 2026, including CVE-2026-21413 republished from Cisco Talos. Base scores and indexes taken from the Security Update Guide records.

Figures come primarily from the MSRC records and release notes; the other sources were used for cross-checking.

1. MSRC (1): Microsoft Security Response Center, Microsoft’s security incident response centre, which publishes the Security Update Guide.
2. CVE (2): Common Vulnerabilities and Exposures, public identifier assigned to a vulnerability.
3. KEV (3): Known Exploited Vulnerabilities, CISA catalogue of vulnerabilities whose exploitation has been observed.
4. CISA (4): Cybersecurity and Infrastructure Security Agency, United States cybersecurity and infrastructure security agency.
5. ESU (5): Extended Security Updates, paid programme of security updates beyond the end of extended support.
6. CVSS (6): Common Vulnerability Scoring System, system for rating the severity of vulnerabilities.
7. CWE (7): Common Weakness Enumeration, classification of software weaknesses.
8. BOD (8): Binding Operational Directive, mandatory operational directive from CISA for United States federal civilian agencies.
9. JSON (9): JavaScript Object Notation, structured text data format.
10. KB (10): Knowledge Base, Microsoft knowledge base article number that identifies an update.
11. CNA (11): CVE Numbering Authority, organisation authorised to assign CVE identifiers.
12. CSV (12): Comma-Separated Values, tabular file format with separated values.
13. VPN (13): Virtual Private Network.
14. SSRF (14): Server-Side Request Forgery, forging of requests issued by the server.
15. SANS (15): SysAdmin, Audit, Network and Security, security training institute that operates the Internet Storm Center.

1. Microsoft Security Response Center, October 2026 Security Updates, release notes, Security Update Guide, 13 October 2026. msrc.microsoft.com/update-guide/releaseNote/2026-Oct
2. Microsoft Security Response Center, CVE-2026-96951 record, Windows Shell Security Feature Bypass Vulnerability, 13 October 2026. msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951
3. Microsoft Security Response Center, CVE-2026-108398 record, .NET Framework Security Feature Bypass Vulnerability, 13 October 2026. msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108398
4. Microsoft Security Response Center, CVE-2026-70300 record, Microsoft Office Word Remote Code Execution Vulnerability, 13 October 2026. msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70300
5. Microsoft Security Response Center, CVE-2026-69789 record, Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability, 13 October 2026. msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69789
6. Microsoft Security Response Center, Security Update Guide CSV export and records of the 2026-Oct release, accessed 13 October 2026. msrc.microsoft.com/update-guide
7. Microsoft Security Response Center, Using risk cohorts to prioritize security updates, 13 October 2026. microsoft.com/en-us/msrc/blog
8. SANS Internet Storm Center, Johannes Ullrich, October 2026 Microsoft Patch Tuesday, 13 October 2026. isc.sans.edu/diary/33422
9. CISA, Known Exploited Vulnerabilities catalogue, JSON feed version 2026.10.13, accessed 13 October 2026. cisa.gov/known-exploited-vulnerabilities-catalog
10. Microsoft Learn, Windows Server 2012 R2, Microsoft Lifecycle, accessed 13 October 2026. learn.microsoft.com/lifecycle/products/windows-server-2012-r2
11. Microsoft Learn, Windows Server 2012, Microsoft Lifecycle, accessed 13 October 2026. learn.microsoft.com/lifecycle/products/windows-server-2012
12. Microsoft Learn, Windows 11 Home and Pro, Microsoft Lifecycle, accessed 13 October 2026. learn.microsoft.com/lifecycle/products/windows-11-home-and-pro
13. Microsoft Learn, SharePoint Server 2019 and SharePoint Server 2016, Microsoft Lifecycle, accessed 13 October 2026. learn.microsoft.com/lifecycle/products/sharepoint-server-2019
14. Microsoft, Windows 10 Consumer Extended Security Updates (ESU), French-language page, accessed 13 October 2026. microsoft.com/fr-fr/windows/extended-security-updates
15. Microsoft, Exchange team, Reminder: Exchange 2016 and 2019 ESU Program Ends in October 2026, 20 July 2026, updated 14 August 2026. techcommunity.microsoft.com/blog/exchange
16. BleepingComputer, Windows 11 KB5127648 & KB5126653 cumulative updates released, 13 October 2026. bleepingcomputer.com
17. BleepingComputer, Microsoft Exchange 2016 and 2019 ESU program ends in October, 22 July 2026. bleepingcomputer.com
18. Help Net Security, October 2026 Patch Tuesday forecast: Time for an Office cleanup, 9 October 2026. helpnetsecurity.com
19. Volexity, A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days, 13 October 2026. volexity.com/blog
20. SAP, SAP Security Patch Day, October 2026, 13 October 2026. support.sap.com
21. Cyber Security News, Microsoft Fixes 1,118 Vulnerabilities in October Patch Tuesday and Introduces New Risk Cohorts, 13 October 2026. cybersecuritynews.com