If you do one thing this week, make sure every Windows PC and server has the October 2026 cumulative update installed. Microsoft fixed a Windows Shell flaw that attackers were already using to slip malicious files past the warnings Windows normally shows, and CISA added it to its Known Exploited Vulnerabilities catalog the same day. The same update changes Wi-Fi and VPN authentication and can destabilize on-premises Exchange, so plan for both.
Patch now
| Product | Issue | Action |
|---|---|---|
| Windows PCs and servers | CVE-2026-96951, Mark of the Web bypass, exploited | Install the October 2026 cumulative update |
| Palo Alto PAN-OS and Panorama | CVE-2026-0322, management interface code execution, exploited | Upgrade to a fixed build, lock down management access |
| Fortinet FortiOS, FortiProxy, FortiPAM, FortiSwitchManager | CVE-2025-61624, privilege escalation, exploited | Upgrade to 7.6.5 or 7.4.10 or later, rotate management credentials |
Windows Shell zero-day (CVE-2026-96951)
What it is: A security feature bypass in Windows Shell rated CVSS 8.8. If a user opens a malicious file sent by email or chat, the Mark of the Web protection behind SmartScreen and Protected View warnings does not apply. Microsoft says it was exploited in the wild before the patch. See the Microsoft advisory and Tenable’s Patch Tuesday breakdown.
Who is affected: Any business running Windows, which is nearly everyone.
What to do:
- Deploy the October 2026 cumulative update to all workstations and servers, then confirm installation in Intune, WSUS, or your RMM tool.
- Since the user must open the file, tighten email filtering on archive, shortcut, and script attachments during rollout.
- On-premises Exchange also gets a fix for CVE-2026-70571, a Critical remote code execution flaw (CVSS 8.1) rated “Exploitation More Likely.” Install the October Exchange security update.
Palo Alto PAN-OS management interface (CVE-2026-0322)
What it is: An authenticated attacker who can reach the management interface can run code as root on the firewall. Palo Alto rates it 8.6 High with “Highest” urgency and reports limited exploitation. Panorama is affected; Cloud NGFW and Prisma Access are not. Details are in the Palo Alto advisory.
What to do: There is no workaround. Upgrade to 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12, or the other fixed hotfix build listed for your branch. Restrict management access to trusted internal IPs or a jump host. Threat IDs 510046 and 510047 give only partial coverage.
Fortinet FortiOS path traversal (CVE-2025-61624)
What it is: A flaw that lets an attacker with an admin account escalate to root on the firewall. Fortinet’s original advisory is from April, but this week CISA added it to the KEV catalog and Unit 42 published research showing attackers who first compromised a FortiManager used it to plant a memory-resident implant on managed FortiGates. CVSS is only 6.0, but it is in active use.
What to do: Per the Fortinet advisory, upgrade FortiOS 7.6 to 7.6.5 or later and 7.4 to 7.4.10 or later. FortiOS 7.2, 7.0, and 6.4 have no fix in those branches, so plan a migration to a fixed release. If your firewalls are managed by FortiManager, treat stored admin and VPN credentials and certificates as exposed if that FortiManager was ever reachable from the internet, and rotate them.
Other items this week
ConnectWise Cloud Backup (formerly SkyKick) used to break into Microsoft 365 tenants
What it means: Huntress reports that a Microsoft 365 app credential belonging to ConnectWise Cloud Backup was stolen and used to sign in to customer tenants as that app. MFA does not apply because no user signs in. Huntress confirmed unauthorized sign-ins in 162 tenants as of October 16, and in one tenant the attacker granted itself Global Administrator and added secrets to other apps. BleepingComputer has additional coverage.
What to do:
- In Entra admin center, Enterprise applications, search for “SkyKick” and “ConnectWise.” Set “Enabled for users to sign-in” to No. Disable, do not delete, or you lose the consent.
- Review client secrets and certificates on all Enterprise applications and App registrations for anything added since October 13 that you did not create, and remove it.
- Remove directory roles held by ConnectWise or SkyKick apps that you did not intentionally grant.
- Disabling the app pauses backups. Confirm retention and restore options with ConnectWise, and do not re-enable until ConnectWise confirms all credentials are reset.
Even without this product, audit which third-party apps hold admin roles in your tenant.
October update side effects: Wi-Fi, VPN, and Exchange
What it means: Starting with the October update, Windows 11 24H2, 25H2, and 26H2 plus Windows Server 2025 block NTLMv1-derived single sign-on credentials by default on devices without Credential Guard. Wi-Fi, wired 802.1X, and VPN connections that use MS-CHAPv2 (including PEAP-MSCHAPv2, common on office RADIUS setups) may fail. Microsoft says this is a planned change, not a bug, in its Windows message center. Separately, Microsoft warns that the October Windows Server updates can make Exchange 2016, 2019, and SE unstable, with Outlook on the web failures and growing mail queues. And the October Exchange security updates are the last that Exchange 2016 and 2019 will ever receive, even for Period 2 ESU customers.
What to do:
- Test the update on one laptop using corporate Wi-Fi and VPN before broad rollout. If connections fail, the temporary audit-mode registry setting in KB5066470 restores them, though Microsoft says it weakens protection.
- Plan the real fix: move Wi-Fi and VPN to certificate-based authentication (EAP-TLS) instead of passwords over MS-CHAPv2.
- On Exchange servers, do not uninstall the Windows update. Apply Microsoft’s EpmapSavedContextCap registry change from the post above, reboot, and monitor.
- If you still run Exchange 2016 or 2019, schedule the move to Exchange SE or Exchange Online now.
End of support: Windows 11 24H2 Home/Pro and Office 2021
What it means: As of October 13, Windows 11 24H2 Home and Pro no longer receive security updates, and Office 2021 and Office LTSC 2021 reached end of support with no extension and no extended security updates.
What to do: Upgrade 24H2 Pro machines to Windows 11 26H2, which Microsoft recommends. Move Office 2021 users to Microsoft 365 Apps. Also note Windows Server 2016 stops receiving updates on January 12, 2027.
This week’s checklist
- Confirm the October 2026 cumulative update is installed on every Windows device, using a compliance report, not a guess.
- Check PAN-OS and FortiOS versions against the fixed builds above, upgrade, and confirm management interfaces are not reachable from the internet.
- In Entra, list Enterprise applications with admin roles and review secrets added since October 13. Disable ConnectWise or SkyKick apps if present.
- Test Wi-Fi and VPN sign-in on one updated Windows 11 laptop before pushing to everyone.
- Inventory any Windows 11 24H2 Pro and Office 2021 installs and schedule upgrades.
- If you run on-premises Exchange, install the October security update and apply the RPC registry fix.
Patching only helps if someone verifies it landed and catches side effects like this month’s Wi-Fi and Exchange issues before users do. For a senior engineer handling patch rollout, testing, and vendor follow-up, see our managed IT services. For tenant app audits and email protection, see cybersecurity services, and for moving Wi-Fi to certificate-based authentication, see network infrastructure.
