Microsoft's October 2026 Patch Tuesday Sets a Record With 1,407 Fixes
Microsoft's October 2026 Patch Tuesday fixed a record 1,407 CVEs, including an exploited Windows Shell zero-day. Here is what to patch first, and why.
By TPW Editorial8 min read
#zero-day
10 stories · “zero-day”.
Fortinet's FortiMail Zero-Day Lets Attackers Write Files Without Logging In
Fortinet disclosed CVE-2026-104286, a 9.8-severity FortiMail zero-day, on October 1, 2026, and CISA told federal agencies to patch or mitigate by October 4.
By TPW Editorial9 min read
Cisco's SD-WAN Manager Zero-Day Lets Attackers In as Admin
Cisco patched CVE-2026-76504, a 9.8-severity authentication bypass in Catalyst SD-WAN Manager, on September 30, 2026. Attackers are already exploiting it.
By TPW Editorial8 min read
Two Citrix NetScaler Zero-Days, Three Weeks Undetected, and Now Mass Exploitation
Citrix patched two critical NetScaler ADC and Gateway zero-days on September 27, 2026, but attackers had been inside customer networks for several weeks.
By TPW Editorial9 min read
Google Patches CVE-2026-58704, an Actively Exploited Pixel Modem Zero-Day
Google's September 2026 Pixel bulletin fixes CVE-2026-58704, a modem zero-day under limited targeted exploitation. CISA set a September 19 federal deadline.
By TPW Editorial8 min read
Cisco's Email Gateway Zero-Day Hands Attackers Root From a Single Message
Cisco disclosed CVE-2026-76461, a 9.8 SQL injection in Secure Email Gateway that is already exploited; CISA set a September 17 patch deadline.
By TPW Editorial8 min read
GitLab's Perfect-Score Path Traversal Is Already Being Probed in the Wild
CVE-2026-85706 lets an unauthenticated attacker read files from a self-managed GitLab server. Probes began within a day of the patch.
By TPW Editorial8 min read
Microsoft's Record Patch Tuesday: 974 Flaws, Two Already Exploited
Microsoft's September 2026 Patch Tuesday fixed a record 974 vulnerabilities, two already exploited, as AI-assisted discovery keeps inflating patch volumes.
By TPW Editorial9 min read
Adobe Commerce's 'StyleSmuggler' Zero-Day Hit Stores Three Days Before a Fix
CVE-2026-75650 is a CVSS 10.0 unauthenticated RCE in Magento and Adobe Commerce, exploited from Sept. 4 and patched only by a hotfix with no version number.
By TPW Editorial9 min read
Microsoft's August Patch Tuesday Fixed About 400 Flaws, and One Real Fire
Microsoft's August 2026 Patch Tuesday fixed roughly 400 vulnerabilities, including three zero-days and one actively exploited by North Korean attackers.
By TPW Editorial8 min read