Stay Ahead of Threats with the Latest Vulnerability Updates for October
Stay up to date on critical cyber risks, Microsoft’s October Patch Tuesday, and other notable third-party vulnerabilities. Timely patching is key to maintaining a strong security posture and protecting your business from threats.
Quick Highlights
- Microsoft Patch Tuesday:
– 1,413 vulnerabilities disclosed. Largest Patch Tuesday release to date, increasing pressure on testing and deployment resources and making risk-based prioritization essential for actively exploited, Critical, internet-facing, identity, remote access, and widely deployed productivity systems
– 76 rated Critical, 3 are Zero-Day (1 actively exploited, 2 publicly disclosed)
- Advisories from Major Vendors:
– Adobe: 178 vulnerabilities across 11 products
– Cisco: 62 critical and high-severity flaws, including two actively exploited vulnerabilities affecting Secure Email Gateway and Catalyst SD-WAN Manager
– Fortinet: 5 critical and high-severity flaws, including a critical FortiSandbox authentication bypass and four SQL injection vulnerabilities enabling arbitrary file read/write; no known exploitation reported
– Ivanti: 5 critical and high-severity flaws affecting Connect Secure, Neurons Patch for Intune, and Xtraction, including a Connect Secure authentication bypass with limited exploitation observed
– SAP: 7 critical and high-severity vulnerabilities, including 4 critical flaws affecting SAP Cloud SDK for Python, NetWeaver Visual Composer, S/4HANA, and Manufacturing Integration and Intelligence; no known exploitation reported
– SonicWall: 3 critical and high-severity flaws affecting SMA1000, including a critical pre-authentication SSRF and two high-severity remote code execution paths; no evidence of exploitation reported at publication
- Top Threats to Watch:
– Rapid exploitation of internet-facing infrastructure: Fortinet firewalls, Ivanti Connect Secure appliances, and Oracle PeopleSoft systems remain high-value targets for mass exploitation, data theft, persistent access, and extortion
– AI-enabled and multi-stage social engineering: Low-cost autonomous attack tools, fake AI advertisements, phishing kits, abused trusted platforms, rogue RMM deployment, and follow-up support calls are making credential theft and account compromise more scalable and convincing
Windows 10 Reaches End of Support
As of October 14, 2025, Microsoft has officially ended support for Windows 10. October 2025’s Patch Tuesday was the final security update for the OS—unless your organization enrolls in the Extended Security Updates (ESU) program.
- What This Means for Your Organization:
– No more security patches or bug fixes for Windows 10 devices
– Increased exposure to vulnerabilities and compliance risks
– Continued support requires either: 1.) Enrolling in Microsoft’s paid ESU program, or 2.) Upgrading to Windows 11
- Upgrading Windows 11
Unlike traditional feature upgrades, Windows 11 25H2 is built on the same servicing branch and code base as Windows 11 24H2, making the transition simpler and lower risk.
Fortress has thoroughly tested Windows 11 25H2 and recommends upgrading all supported devices. To begin the upgrade process, contact our 24/7/365 Security Operations Team or reach out to your client experience manager.
Windows 11 End of Support
As of November 2025, Microsoft has officially ended support for earlier versions of Windows 11 (listed below).
- Windows 11 version 21H2 (All Editions)
- Windows 11 version 22H2 (All Editions)
- Windows 11 version 23H2 (Home & Pro)
We would also like to highlight several upcoming End of Support dates for the following Windows releases:
- Windows 11, version 23H2 (Enterprise & Education) — End of Support: November 10, 2026
Important: Support ends November 10, 2026. After this date, Windows 11 version 23H2 Enterprise and Education editions will no longer receive security updates or fixes, leaving systems without ongoing protection from newly discovered vulnerabilities.
Action required: Ensure affected devices are upgraded to a supported version of Windows before the deadline.
Please note: This is a firm end-of-support date, not simply a reminder. After November 10, security updates and fixes will no longer be provided for these editions. - Windows 11 version 24H2 (Home & Pro) – Support ends October 13, 2026. Devices running these editions should be upgraded before this date to remain supported and secure.
Fortress recommends reviewing device inventories ahead of these deadlines to ensure systems are upgraded in advance and remain within a supported lifecycle.
* Some specialized editions of Windows 11 24H2 (e.g. Long Term Support Cycle) will continue to receive extended support through 2029. However, for all other editions we recommend upgrading to Windows 11 25H2.
Windows Server 2016 End of Support
Support for Windows Server 2016 is scheduled to end on January 12, 2027, which is now less than a year away. After this date, Microsoft will no longer provide security updates, bug fixes, or technical support for the platform.
Organizations still running Windows Server 2016 should begin planning upgrade or migration strategies to avoid increased security risk and compliance concerns once support ends.
Fortress recommends reviewing affected systems early to allow sufficient time for testing, upgrades, or workload migration before the end-of-support deadline.
Need help planning your transition?
Fortress SRM can help assess your environment, prioritize upgrades, and ensure your endpoints remain patch-compliant and secure.
Patch Tuesday Summary
Microsoft October 2026 Patch Tuesday
1,413 vulnerabilities disclosed—the first four-digit Microsoft CVE release and the largest Patch Tuesday release to date—including 76 critical vulnerabilities and 3 zero-days. By category:
Why this matters: With 1,413 disclosed vulnerabilities, October 2026 represents Microsoft’s largest Patch Tuesday release to date. The unusually high volume can strain testing and deployment resources, increase the likelihood that high-risk systems remain exposed, and make risk-based prioritization essential. Organizations should accelerate remediation of actively exploited and Critical vulnerabilities, then prioritize internet-facing services, identity infrastructure, remote access technologies, and widely deployed productivity applications.
- 677 Elevation of Privilege
- 316 Remote Code Execution
- 252 Information Disclosure
- 72 Denial of Service
- 40 Security Feature Bypass
- 29 Tampering
- 28 Spoofing
Critical Common Vulnerabilities and Exposures (CVEs)
Windows Zero Days
| CVE-ID | Details | Severity | Exploited? |
| CVE-2026-96951 | Windows Shell security feature bypass caused by command injection can bypass Mark of the Web protections when a user opens a specially crafted file delivered through email, messaging, or a malicious website. | Important (CVSS 8.8) | Yes — actively exploited |
| CVE-2026-108398 | .NET Framework security feature bypass involving an untrusted search path could allow an authenticated attacker to load a crafted .NET assembly into a protected process and bypass Windows Defender Application Control. | Important (CVSS 8.8) | No known exploitation — publicly disclosed |
| CVE-2026-92707 | MessagePack-CSharp denial-of-service vulnerability caused by improperly controlled sequential memory allocation in .NET, which could allow an unauthorized network attacker to deny service. | Important | No known exploitation — publicly disclosed |
Other Critical CVE’s Worth Mentioning
| CVE-ID | Details | Severity | Exploited? |
| CVE-2026-108131, CVE-2026-96222 | Active Directory Federation Services (AD FS) Spoofing Vulnerability | Critical (CVSS 7.4–7.5) | No |
| CVE-2026-83943 | Azure API Center Information Disclosure Vulnerability | Critical (CVSS 8.7) | No |
| CVE-2026-77900 | Azure App Service Remote Code Execution Vulnerability | Critical (CVSS 9.8) | No |
| CVE-2026-83947 | Azure Event Grid Spoofing Vulnerability | Critical (CVSS 7.7) | No |
| CVE-2026-69435 | Azure SRE Agent Elevation of Privilege Vulnerability | Critical (CVSS 9.6) | No |
| CVE-2026-108400 | HEVC Video Extensions Remote Code Execution Vulnerability | Critical (CVSS 8.8) | No |
| CVE-2026-62840 | Linux Kernel Elevation of Privilege Vulnerability | Critical (CVSS 7.0) | No |
| CVE-2026-94510 | Microsoft Bookings Elevation of Privilege Vulnerability | Critical (CVSS 9.9) | No |
| CVE-2026-88131 | Microsoft Dataverse Remote Code Execution Vulnerability | Critical (CVSS 9.8) | No |
| CVE-2026-105718 | Microsoft Excel Remote Code Execution Vulnerability | Critical (CVSS 8.8) | No |
| CVE-2026-70571 | Microsoft Exchange Server Remote Code Execution Vulnerability | Critical (CVSS 8.1) | No |
| CVE-2026-100215 | Microsoft Graphics Component Remote Code Execution Vulnerability | Critical (CVSS 7.8) | No |
| CVE-2026-100209, CVE-2026-100210, CVE-2026-100211, CVE-2026-97739, CVE-2026-97745, CVE-2026-97755, CVE-2026-97759, CVE-2026-97765, CVE-2026-97778, CVE-2026-97780 | Microsoft Office Excel Remote Code Execution Vulnerability | Critical (CVSS 8.8) | No |
| CVE-2026-97749, CVE-2026-88156, CVE-2026-70291, CVE-2026-70242, CVE-2026-97016 | Microsoft Office Outlook Remote Code Execution Vulnerability | Critical (CVSS 9.8) | No |
| CVE-2026-88178, CVE-2026-70215, CVE-2026-88144, CVE-2026-88207 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Critical (CVSS 7.5–9.8) | No |
| CVE-2026-102866 | Microsoft Office SharePoint Elevation of Privilege Vulnerability | Critical (CVSS 8.1) | No |
| CVE-2026-102855, CVE-2026-102856, CVE-2026-102857 | Microsoft Office Visio Remote Code Execution Vulnerability | Critical (CVSS 8.8) | No |
| CVE-2026-88185, CVE-2026-70269 | Microsoft Office Word Remote Code Execution Vulnerability | Critical (CVSS 8.1) | No |
| CVE-2026-96207 | Microsoft Partner Center Elevation of Privilege Vulnerability | Critical (CVSS 10.0) | No |
| CVE-2026-70147, CVE-2026-70153, CVE-2026-108467 | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | Critical (CVSS 8.8–9.8) | No |
| CVE-2026-100219, CVE-2026-105016 | Microsoft QUIC Remote Code Execution Vulnerability | Critical (CVSS 9.8) | No |
| CVE-2026-96952 | Microsoft Windows Media Foundation Remote Code Execution Vulnerability | Critical (CVSS 8.8) | No |
| CVE-2026-108457 | Microsoft Windows PDF Remote Code Execution Vulnerability | Critical (CVSS 8.1) | No |
| CVE-2026-69802 | Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability | Critical (CVSS 8.1) | No |
| CVE-2026-70229 | Windows Active Directory Domain Services Remote Code Execution Vulnerability | Critical (CVSS 8.1) | No |
| CVE-2026-83917 | Windows ALPC Elevation of Privilege Vulnerability | Critical (CVSS 7.0) | No |
| CVE-2026-88174 | Windows Deployment Services Remote Code Execution Vulnerability | Critical (CVSS 8.1) | No |
| CVE-2026-70250 | Windows DHCP Client Remote Code Execution Vulnerability | Critical (CVSS 8.8) | No |
| CVE-2026-96934, CVE-2026-88117, CVE-2026-88119, CVE-2026-88120, CVE-2026-88171 | Windows DHCP Server Remote Code Execution Vulnerability | Critical (CVSS 8.1–9.8) | No |
| CVE-2026-83934 | Windows GDI+ Remote Code Execution Vulnerability | Critical (CVSS 8.8) | No |
| CVE-2026-88073 | Windows Graphics Kernel Elevation of Privilege Vulnerability | Critical (CVSS 8.8) | No |
| CVE-2026-108399 | Windows Hyper-V Elevation of Privilege Vulnerability | Critical (CVSS 7.2) | No |
| CVE-2026-102214, CVE-2026-105733 | Windows Hyper-V Remote Code Execution Vulnerability | Critical (CVSS 8.8) | No |
| CVE-2026-96913 | Windows Kernel Elevation of Privilege Vulnerability | Critical (CVSS 8.8) | No |
| CVE-2026-100220 | Windows Media Video Decoder Remote Code Execution Vulnerability | Critical (CVSS 8.8) | No |
| CVE-2026-100202 | Windows Message Queuing Queue Manager Remote Code Execution Vulnerability | Critical (CVSS 9.8) | No |
| CVE-2026-108460 | Windows Message Queuing Remote Code Execution Vulnerability | Critical (CVSS 8.1) | No |
| CVE-2026-96202, CVE-2026-96943 | Windows Raw Image Extension Remote Code Execution Vulnerability | Critical (CVSS 8.8) | No |
| CVE-2026-69789 | Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability | Critical (CVSS 7.5) | No |
| CVE-2026-70187 | Windows Remote Desktop Services Remote Code Execution Vulnerability | Critical (CVSS 8.1) | No |
| CVE-2026-97814, CVE-2026-102225 | Windows Text Shaping Remote Code Execution Vulnerability | Critical (CVSS 8.8–9.8) | No |
| CVE-2026-108471, CVE-2026-96914, CVE-2026-108130, CVE-2026-88074, CVE-2026-102211 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | Critical (CVSS 7.0–8.8) | No |
Microsoft October 2026 Security Update Release
3rd Party Critical CVE’s Worth Mentioning
Adobe Products *
| CVE-ID(s) | Affected Product | Issues | Key Risks |
| CVE-2026-105899, 106622, 105903, 106612, 106624, 75994 and additional CVEs | Adobe ColdFusion 2025 and 2023 (APSB26-144) | 32 critical, high, and medium vulnerabilities | Unauthenticated code execution, privilege escalation, arbitrary file read/write, security bypass, denial of service, and memory exposure |
| CVE-2026-95634, 100124, 100123, 104345, 100122, 100121, 100120, 100119 and additional CVEs | Content Credentials SDK and C2PA Tool (APSB26-163) | 30 high and medium vulnerabilities | Security feature bypass, denial of service, arbitrary file-system access, and exposure of sensitive information |
| CVE-2026-75650 and additional October CVEs | Adobe Commerce, Commerce B2B, and Magento Open Source (APSB26-153) | 11 vulnerabilities, including critical flaws | Unauthenticated arbitrary code execution, privilege escalation, and compromise of commerce environments; Adobe also recommends credential and encryption-key rotation |
| Multiple CVEs | Adobe Photoshop | 18 vulnerabilities, primarily critical and high severity | Arbitrary code execution through malicious files, potentially allowing compromise in the context of the current user |
| Multiple CVEs | Substance 3D Stager | 16 vulnerabilities, including high-severity flaws | Arbitrary code execution and application denial of service through crafted content |
| CVE-2026-104344, 104342, 104341, 104340, 103967, 106625, 103966 and additional CVEs | Adobe FrameMaker 2026 and 2022 (APSB26-172) | High and medium vulnerabilities | Arbitrary code execution, denial of service, and memory exposure when a user opens a malicious file |
| CVE-2026-103847, 103846, 103845, 103844, 103854 and additional CVEs | Adobe Dimension (APSB26-171) | High and medium vulnerabilities | Arbitrary code execution, denial of service, and memory exposure through malicious files |
| Multiple CVEs | Substance 3D Sampler | High and medium vulnerabilities | Arbitrary code execution and application instability through crafted content |
| Multiple CVEs | Substance 3D Designer | High and medium vulnerabilities | Arbitrary code execution and denial of service through malicious files |
| Multiple CVEs | Adobe Bridge | High and medium vulnerabilities | Arbitrary code execution and application compromise through crafted files |
Cisco *
| CVE-ID(s) | Details | Severity | Exploited? |
| CVE-2026-76461 | Secure Email Gateway SQL injection could allow an unauthenticated attacker to execute queries and access sensitive data. | Critical (9.8) | Yes |
| CVE-2026-76460 | Identity Services Engine API authentication bypass could provide unauthorized access to the management interface. | Critical (10.0) | No known exploitation |
| CVE-2026-20334, 20330, 20335, 20331, 20332, 20329, 20333, 20336 | Secure Firewall ASA, FTD, and FMC September hardening release addressing multiple vulnerability classes. | Critical (9.9) | No known exploitation |
| CVE-2026-20324 | Secure Firewall Management Center sftunnel flaw could allow root-level arbitrary code execution. | Critical (9.9) | No known exploitation |
| CVE-2026-20242 | Secure Firewall Management Center Java deserialization vulnerability could allow remote code execution. | Critical (9.8) | No known exploitation |
| CVE-2026-20344, 20341, 20340, 20342, 20343; CVE-2026-76412, 76413, 76420 | Multiple Secure Firewall Management Center vulnerabilities, including high-impact code execution and security-control weaknesses. | Critical (9.1/9.0) | No known exploitation |
| CVE-2026-20295, 20323, 20249, 20250, 20154, 20135, 20222 | Secure Firewall FMC, FTD, and ASA vulnerabilities primarily affecting sftunnel, certificate authentication, DTLS, logging, TLS 1.3, and EIGRP availability. | High (7.4–8.6) | No known exploitation |
| CVE-2026-20360, 20361, 20322, 20325, 20326, 76409 | Nexus Dashboard September hardening release addressing multiple vulnerabilities. | Critical (9.9) | No known exploitation |
| CVE-2026-76504 | Catalyst SD-WAN Manager API authentication bypass could allow unauthenticated access with administrator privileges. | Critical (9.8) | Yes |
| CVE-2026-76455, 76456, 76457, 76459, 76458, 76453 | NX-OS October hardening release addressing multiple remotely exploitable vulnerability classes. | Critical (9.8) | No known exploitation |
| CVE-2026-76465; CVE-2026-76485, 76486, 76501; CVE-2026-76471 | Nexus 3000/9000 MPLS OAM and NGOAM, plus NX-API, remote code execution vulnerabilities. | Critical (9.8) | No known exploitation |
| CVE-2026-76499, 76500, 76498 | Application Policy Infrastructure Controller October hardening release addressing multiple vulnerabilities. | Critical (9.8) | No known exploitation |
| CVE-2026-76480, 76482, 76483, 76484; CVE-2026-76437, 76452, 20328, 76454 | Cisco License On-Prem hardening and additional vulnerabilities, including authentication, signature-validation, password-reset, and API flaws. | Critical (10.0) | No known exploitation |
| CVE-2026-76470, 76472, 76469, 76464, 76467, 76468, 76463 | Meraki October hardening release affecting gateways, wireless access points, switches, cameras, and MX security appliances. | Critical (9.6) | No known exploitation |
Fortinet *
| CVE-ID(s) | Details | Severity | Exploited? |
| CVE-2025-46773, CVE-2026-23705, CVE-2026-23706, CVE-2026-23707 | Multiple arbitrary file read/write vulnerabilities via SQL injection. Successful exploitation could allow an authenticated attacker to manipulate database queries and access or modify files. | High | No known exploitation |
| CVE-2026-107656 | FortiSandbox and FortiSandbox PaaS GUI authentication bypass could allow an unauthenticated attacker to access protected functions. | Critical (9.6) | No known exploitation |
Ivanti *
| CVE-ID(s) | Details | Severity | Exploited? |
| CVE-2026-104935 | Ivanti Connect Secure authentication bypass could allow a remote, unauthenticated attacker to execute arbitrary commands. Affected customers should update immediately and regularly run the Integrity Checker Tool. | High (8.6) | Yes — limited exploitation observed |
| CVE-2026-109412 | Ivanti Neurons Patch for Intune exposed a dangerous endpoint that could allow a remote, authenticated attacker to leak sensitive authentication information. Ivanti recommends rotating the Microsoft Entra ID App Registration client secret used for Intune publication. | Critical (9.9) | No known exploitation |
| CVE-2026-106042, CVE-2026-106043, CVE-2026-106047 | Ivanti Xtraction vulnerabilities could allow credential theft through redirected application requests, unauthorized creation or modification of trusted sites, and arbitrary file reads. Customers should update to Xtraction 2026.4 and rotate affected EPMM connector credentials. | Critical/High (7.5–9.9) | No known exploitation |
Ivanti October 2026 Security Update
SAP *
| CVE-ID(s) | Details | Severity | Exploited? |
| CVE-2026-89111 | SAP Cloud SDK for Python OAuth2 server-side request forgery could allow an unauthenticated attacker to redirect token requests and exfiltrate client credentials. Versions before 0.45.2 are affected. | Critical (10.0) | No known exploitation |
| CVE-2026-89110 | SAP NetWeaver Visual Composer broken access control could allow a low-privileged user to invoke internal operations on configured remote systems, potentially resulting in full compromise. | Critical (9.9) | No known exploitation |
| CVE-2026-89107 | SAP S/4HANA Manage Substitution/Validation Rules code injection could cause crafted rule input to execute as ABAP code and fully compromise the affected system. | Critical (9.9) | No known exploitation |
| CVE-2026-89108 | SAP Manufacturing Integration and Intelligence Configuration Service missing authorization check could allow an MII administrator to create an account with administrative privileges on the underlying Java server. | Critical (9.1) | No known exploitation |
| CVE-2026-89113 | SAP Commerce Cloud OOTB code SQL injection could allow an authenticated attacker to read, modify, or delete database records. | High (8.8) | No known exploitation |
| CVE-2026-58249 | SAP NetWeaver and SAP Web Dispatcher Internet Communication Manager memory corruption could allow an unauthenticated attacker to crash affected HTTP/2-enabled processes. | High (7.5) | No known exploitation |
| CVE-2026-89120 | SAP ABAP Platform missing authorization check could allow an authenticated user to perform unauthorized actions in affected kernel versions. | High (7.1) | No known exploitation |
SAP October 2026 Security Notes
SonicWall *
| CVE-ID(s) | Details | Severity | Exploited? |
| CVE-2026-102255 | SMA1000 Workplace interface pre-authentication server-side request forgery through an unintended forward-proxy path could allow a remote, unauthenticated attacker to make appliance-originated requests, reach internal functionality, and perform unauthorized operations. | Critical (10.0) | No evidence reported by SonicWall at publication |
| CVE-2026-102256 | SMA1000 post-authentication OS command injection could allow a remote authenticated administrator, under specific conditions, to execute arbitrary operating-system commands and achieve remote code execution. | High (7.8) | No evidence reported by SonicWall at publication |
| CVE-2026-102257 | SMA1000 Appliance Management Console Zip Slip path traversal could allow an authenticated administrator to extract files outside the intended directory using a crafted archive, resulting in remote code execution. | High (7.2) | No evidence reported by SonicWall at publication |
| CVE-2026-102258 | SMA1000 Appliance Management Console stored cross-site scripting could allow an authenticated administrator to store and potentially execute arbitrary JavaScript in the management interface. | Medium (5.5) | No evidence reported by SonicWall at publication |
Google Chrome
- Version: 155.0.8059.79/.80 (Windows and Mac), 155.0.8059.79 (Linux)
- Release Date: Tuesday, October 13, 2026
- Key Fixes: 37 security fixes (7 critical, 29 high, 1 medium)
* Not handled by Fortress SRM.
Threat Intelligence Trends – October 2026
The following resources are grouped by threat type / category.
AI-Enabled / Emerging Threats
FortiBleed: The Campaign That Cracked 86,644 Firewalls
The FortiBleed campaign reportedly compromised 86,644 Fortinet firewalls, highlighting the scale of attacks targeting exposed and vulnerable devices and the urgency of patching and securing affected systems.
Read more ->
FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts
Ongoing FortiBleed operations are targeting internet-exposed systems, with reported incidents resulting in organizations being locked out of affected devices. Defenders should prioritize identifying exposed Fortinet systems and applying recommended mitigations to reduce compromise risk.
Read more ->
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
Chinese government-linked cyber actors are combining automated exploitation with hands-on intrusion techniques to compromise targeted networks and steal sensitive data. The advisory highlights the need to address internet-facing vulnerabilities and monitor for malicious activity associated with these operations.
Read more ->
Behind the Connect Button: The Fake AI Ads Campaign
Attackers are using deceptive AI-themed advertisements and fake “Connect” prompts to lure users into malicious workflows designed to compromise accounts and steal sensitive information.
Read more ->
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft ShinyHunters has launched a renewed mass exploitation campaign targeting Oracle PeopleSoft systems, seeking to compromise vulnerable internet-facing environments and steal sensitive data for extortion.
Read more ->
ShinyHunters Claims Access to FBI Systems
ShinyHunters claims it gained unauthorized access to FBI systems, raising concerns about sensitive government data and third-party security risks. The reported breach follows claims that attackers exploited an unpatched vulnerability tied to contractor-managed infrastructure.
Read more ->
AI Agents Are Hacking Online Retailers for $25 a Company
Gambit reports that autonomous AI agents can be deployed for as little as $25 per company to identify and exploit weaknesses in online retailers, demonstrating how inexpensive AI-driven automation could significantly lower the barrier to cyberattacks.
Read more ->
Social Engineering & Phishing
Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia
The Wazza phishing kit is being used in campaigns targeting banking, government, and manufacturing organizations across the US, Europe, and Australia, highlighting the broad reach of phishing-as-a-service operations.
Read more ->
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs | Huntress
A phishing campaign abuses Microsoft Power BI to redirect victims to malicious infrastructure and deploy unauthorized remote monitoring and management (RMM) tools, giving attackers persistent remote access to compromised systems.
Read more ->
From Gmail Compromise to Fake Support Call: A Social Engineering Pattern on the Rise
Attackers are combining compromised Gmail accounts with convincing fake support calls to manipulate victims into handing over additional access or sensitive information, highlighting a growing multi-stage social engineering tactic.
Read more ->
Milk Dragon: Huge Discounts on Social Media? Think Twice Before You Buy | Group-IB Blog
Milk Dragon, also known as Nailong, is a phishing kit used to create convincing fake e-commerce sites promoted through social media offers and steep discounts, ultimately stealing victims’ payment and personal information.
Read more ->
DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer | Huntress
DarkMe RAT has evolved from a VB6-based trojan associated with APT-style exploitation into a more conventional infostealer, shifting away from exploit-heavy delivery while retaining capabilities for stealing sensitive information from compromised systems.
Read more ->
Vulnerabilities & Experts
Docker Hub Security Advisory: CVE-2026-105445 | Docker
Docker disclosed CVE-2026-105445 affecting Docker Hub; users should review the advisory and follow Docker’s recommended remediation guidance to reduce potential exposure.
Read more ->
A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days | Volexity
Volexity details attacks chaining multiple unauthenticated Ivanti Connect Secure zero-day vulnerabilities to compromise exposed appliances, emphasizing the risk of rapid exploitation and the need for immediate remediation and investigation.
Read more ->
Critical Atlassian Arbitrary File Access Vulnerability Impacts Multiple Products
Atlassian disclosed CVE-2026-21589, a critical unauthenticated arbitrary file access vulnerability affecting Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, and Crowd Data Center, as well as Crucible and Fisheye. Organizations should immediately update affected installations to a fixed version, prioritizing internet-facing systems and deployments that may store sensitive files within the web application root directory.
Read more ->
Critical Dell System Update Vulnerabilities Require Upgrade to DSU 2.3.0.0
Dell disclosed five critical and high-severity vulnerabilities in Dell System Update versions prior to 2.3.0.0, including path traversal, improper permissions, access-control, and certificate-validation flaws. Successful exploitation could allow filesystem access, privilege escalation, remote code execution, or complete compromise of the underlying operating system. Dell recommends upgrading to DSU 2.3.0.0 or later at the earliest opportunity.
Read more ->
Recommended Actions
Mitigations
- Prioritize actively exploited and internet-facing vulnerabilities: Expedite remediation for the Windows Shell zero-day, Cisco Secure Email Gateway and Catalyst SD-WAN Manager, and Ivanti Connect Secure, then address Critical flaws affecting identity, remote access, email, perimeter, and externally accessible systems.
- Apply vendor updates and compensating controls: Patch Microsoft, Adobe, Cisco, Fortinet, Ivanti, SAP, SonicWall, and Chrome products according to vendor guidance. Where immediate patching is not possible, restrict external access, disable unnecessary services, segment affected systems, and limit administrative interfaces to trusted networks.
- Strengthen credentials and access controls: Rotate credentials, secrets, and encryption keys where advised—particularly for Ivanti and Adobe Commerce—and enforce MFA, least privilege, and privileged access controls for administrative and remote-access systems.
- Reduce social-engineering exposure: Reinforce user awareness around AI-themed advertisements, unexpected support calls, deep-discount shopping offers, credential prompts, and requests to install remote monitoring or support software.
Monitoring
- Monitor internet-facing infrastructure: Review Fortinet, Ivanti Connect Secure, SonicWall SMA1000, Cisco, SAP, and Oracle PeopleSoft systems for unexpected configuration changes, new accounts, web-shell activity, unusual outbound connections, and signs of unauthorized administrative access.
- Watch identity and email activity: Alert on anomalous sign-ins, MFA changes, token or secret use, mailbox-rule creation, suspicious forwarding, impossible travel, and privilege escalation involving Microsoft 365, Entra ID, AD FS, and other identity services.
- Track remote-access tools: Inventory approved RMM software and investigate new or unauthorized deployments, especially ScreenConnect or similar tools launched after a user visits Power BI, advertising, file-sharing, or other trusted-platform links.
- Validate patch coverage: Use vulnerability scanning and endpoint-management reporting to identify missing October updates, unsupported Windows versions, exposed management interfaces, and systems that failed deployment or require manual remediation.
Detection Tips
- Correlate edge-device indicators: Investigate repeated authentication failures followed by successful logins, requests to uncommon administrative endpoints, unexpected file writes, command execution, service changes, or outbound traffic from security appliances.
- Detect malicious document and file activity: Alert on Office, PDF, image, video, or PostScript files spawning command shells, script interpreters, download utilities, or child processes inconsistent with normal business use.
- Hunt for phishing-to-RMM chains: Review browser and email telemetry for AI-themed lures, Power BI redirects, fake storefronts, or support-themed messages followed by credential submission, remote-support downloads, persistence, or new external connections.
- Investigate suspected compromise before closing exposure: For actively exploited or chained vulnerabilities, review historical logs and integrity-check results for activity predating patch installation; patching alone does not remove persistence or confirm that a device was not previously compromised.
About Fortress SRM’s Vigilant Managed Cyber Hygiene Offering
Why Patching Matters
Unpatched software is a leading cause of breaches—nearly 1 in 3 attacks exploit known vulnerabilities.
Vigilant Managed Cyber Hygiene
Fortress SRM’s Vigilant Managed Cyber Hygiene simplifies patch management.
- Automated updates with 97%+ success rate for Microsoft & 100+ third-party applications
- Critical patches, OS upgrades, and configuration updates for all devices, on/off network
- 24/7/365 U.S.-based monitoring and real-time reporting for full visibility
Stay Protected. Stay Proactive.
Learn how Fortress SRM can enhance your cybersecurity strategy