October 2026 may be the month patching finally outgrew the people doing it. Microsoft shipped 1,411 security fixes in a single day — a record — and CISA added 26 vulnerabilities to the list of flaws known to be exploited in the wild. If you run a business with one person wearing the IT hat, that is not a to-do list. It is a flood.
Here is what actually matters from October, and what to fix first.
A Record 1,411 Patches in One Month
Last month we wrote about September's record of roughly 995 patches. October broke it by more than 400.
The October release covers 1,411 vulnerabilities, of which 70 are rated Critical — 57 of those allow remote code execution, 11 are elevation of privilege, and 2 are spoofing. By category, the bulk were elevation-of-privilege bugs (677), followed by remote code execution (317), information disclosure (254), and denial of service (73).
You will see different totals quoted, and the difference is honest. The 1,411 figure counts only what Microsoft published on Patch Tuesday itself. Microsoft also fixed 348 additional flaws earlier in October across Azure services, Exchange Server, Dataverse, and others — include those and the month's true total is closer to 1,760. Depending on methodology, credible trackers land between 1,407 and 1,413.
The number that matters for a small business is not the total. It is which handful of those patches map to systems you actually run — which is precisely what a structured cybersecurity program exists to answer.
Microsoft also ended support for Windows 11 version 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 on October 13. The October update was their last. Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions stop receiving security updates next month. If you are not certain which builds your office is running, find out before those machines quietly stop being patched.
The Zero-Day Worth Patching Tonight
One flaw in October was already being used against real targets before a fix existed: CVE-2026-96951, a command injection vulnerability in Windows Shell that lets an attacker bypass Mark of the Web.
Mark of the Web is the quiet check that makes Windows treat a file downloaded from the internet differently from one created on the machine. It is why an emailed attachment opens in Protected View, and why a downloaded installer triggers a SmartScreen prompt. A bypass means a malicious file can arrive looking locally made — a document or installer Windows no longer treats with suspicion.
NVD scores it 8.8 (High). Microsoft has not disclosed who was exploiting it or how, which is normal for an actively exploited bug. CISA added it to the Known Exploited Vulnerabilities catalog on October 13 with a federal remediation deadline of October 16 — three days.
What this means for your business: this is not a server-room problem. It affects ordinary Windows workstations, and the exploitation path runs through files your staff open every day. Treat it as a patch-now item on every Windows device you own.
Two More Zero-Days, Disclosed Before They Were Fixed
Two further flaws were public before fixes shipped. Neither was confirmed as exploited, but public knowledge gives attackers a head start on reverse-engineering them.
- CVE-2026-108398 — a security feature bypass in .NET Framework that gets around Windows Defender Application Control (WDAC), the policy layer many organizations use to stop unauthorized applications from running at all. An authenticated attacker can place a crafted .NET assembly on a machine and register it for loading by a protected process, executing code inside it. It was found by James Forshaw of Google Project Zero, whose findings tend to get picked up quickly.
- CVE-2026-92707 — a denial-of-service flaw in MessagePack-CSharp, triggered by uncontrolled memory allocation over a network.
If your business relies on application allow-listing as a control — and more should — the WDAC bypass deserves the same urgency as the exploited zero-day.
Edge Devices and Gateways: 26 New CISA Warnings
Across October, CISA added 26 entries to the Known Exploited Vulnerabilities catalog. The pattern is unmistakable: nearly every one is a device sitting at the edge of a network, facing the internet.
The most serious:
- Fortinet FortiMail — CVE-2026-104286, CVSS 9.8. A path traversal flaw letting an unauthenticated attacker write arbitrary files to the underlying system through crafted HTTP requests. Exploited as a zero-day before it was patched, and added to the catalog on October 1 with a three-day deadline.
- Cisco Secure Email Gateway — CVE-2026-76519, CVSS 9.8. A flaw in the Advanced Malware Protection feature lets an unauthenticated remote attacker write arbitrary files on the appliance.
- BeyondTrust Remote Support — CVE-2026-102764, CVSS 9.8. Internal components failed to validate the origin of messages they received, letting a remote attacker perform file operations on the appliance. This is the software companies use to grant themselves remote access — a compromise there is a compromise of everything behind it.
- Ivanti Connect Secure — CVE-2026-104935, CVSS 8.6. An authentication bypass letting a remote, unauthenticated attacker execute arbitrary commands. Versions before 25.1.3.0 are affected; 22.7R2.14 and earlier are not.
- Citrix NetScaler — CVE-2026-88779, CVSS 7.5. A memory buffer flaw described as denial of service, yet exploited in attacks before a patch shipped.
- Palo Alto Networks PAN-OS — CVE-2026-0322, CVSS 7.2. Code injection in the firewall management interface, allowing an authenticated attacker with network access to run code as root.
- Atlassian Data Center products — CVE-2026-21589, a critical unauthenticated file-read flaw affecting Confluence, Jira, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. A proof of concept circulated and mass scanning followed; CISA added it on October 15 with an October 18 deadline.
Two more are worth naming because they show up in small business stacks. SonicWall SMA1000 (CVE-2026-102255) was a pre-authentication server-side request forgery flaw patched October 6, where exploitation attempts began within two days. And Plex Media Server had four chainable flaws added to the catalog at once on October 20.
That Plex entry is a useful reminder that business and personal systems blur. A Plex server on a spare office machine is still a device on your network.
Why Bugs From 2015 Are on October's List
The oddest thing about this month's additions is their age. On October 8, five vulnerabilities were added that were published years ago:
- CVE-2015-5477 in ISC BIND, a DNS server flaw from 2015
- CVE-2016-3081 in Apache Struts, a command injection bug from 2016
- CVE-2015-3306 in ProFTPD, an access control flaw from 2015
- CVE-2021-3199 in ONLYOFFICE Docs
- CVE-2023-22894 in Strapi
These are not new discoveries. They are old, well-documented bugs that attackers are exploiting right now because some organizations never got around to them. That is what technical debt looks like in security: an unpatched server quietly running software from a decade ago, still reachable, still trusted.
Every one of these has had a fix available for years. The finding is not that the flaws are dangerous — it is that a decade is apparently not long enough for everyone to patch. A compliance and risk review will usually surface systems like these faster than waiting for an incident to point them out.
What to Fix First
A list this long is useless without an order. For most small businesses it looks like this:
- The exploited Windows Shell flaw (CVE-2026-96951) — every Windows device, this week
- Anything internet-facing — firewalls, VPNs, email gateways, and remote access appliances. This is where attackers actually got in this month, repeatedly.
- The WDAC bypass in .NET (CVE-2026-108398) — if you use application allow-listing, this undermines it
- Critical remote code execution flaws — especially the CVSS 9.8 group on email and remote-support appliances
- Domain controllers and file servers — lower urgency than the internet-facing tier, higher consequence if missed
- Everything else — scheduled, not skipped
The distinction that matters is exploited versus merely vulnerable. A CVSS 9.8 flaw nobody is attacking can wait for your maintenance window. A CVSS 7.5 flaw under active exploitation cannot. That gap is exactly why reading nothing but severity scores goes wrong.
How Virtue Technology Solutions Can Help
Nobody running a small business has time to read a 1,411-item patch list, and nobody should have to.
Our managed IT and cybersecurity programs handle this cycle for Southern California businesses:
- Patch management — we track, test, and deploy updates on a schedule that balances security against stability
- Vulnerability management — we identify which of your systems are exposed to flaws that are actually being exploited, not just the ones with alarming scores
- Edge device review — we inventory the firewalls, VPNs, and remote-access appliances that quietly became this month's favourite target
- Legacy systems audit — we find the decade-old software still running in a corner, because attackers already know it is there
If you are not certain whether the machines in your office run an edition of Windows that stopped receiving updates this month, that is worth twenty minutes of someone's attention.
Facing a record patch month with no one to run it? Contact Virtue Technology Solutions for a no-pressure consultation on what needs attention first.