■ CISCO CVE-2026-76519 · Fixed■ CITRIX CVE-2026-88779 · Fixed■ FORTINET CVE-2026-104286 · Fixed■ MICROSOFT KB5127648 · Fixed in October 13 updates■ ORACLE · Pending Oct 20 CPU (pre-release)■ PALO ALTO CVE-2026-0322 · Fixed■ SAP GHSA-4mv3-jxxm-9cx2 · Patches released 2026-10-13■ VMWARE/BROADCOM KB 455737 · No critical release in October■ MICROSOFT KB5124010 · Mitigated (workaround only

Critical patches

Fixes that are CVSS ≥ 9.0, actively exploited (including CISA KEV), or rated Critical by the vendor.

7 entries

Critical patchFixed

Cisco Secure Email Gateway: exploited critical arbitrary file write via email attachment (CVE-2026-76519)

Cisco · CVE-2026-76519, cisco-sa-esa-afw-zqYJkjxp

Reported 2026-10-14
Critical (CVSS 3.1 9.8)
Critical patchFixed

Citrix NetScaler ADC/Gateway: exploited DoS in SAML configs (CVE-2026-88779)

Citrix · CVE-2026-88779, CTX697174 · Workaround available

Reported 2026-10-04
CVSS 4.0 8.7
Critical patchFixed

Fortinet FortiMail: exploited critical path traversal in IBE (CVE-2026-104286, FG-IR-26-175)

Fortinet · CVE-2026-104286, FG-IR-26-175 · Workaround available

Reported 2026-10-01
Critical (CVSSv3 9.8)
Critical patchInstall impactFixed

Microsoft October 2026 Patch Tuesday: exploited Windows Shell MotW bypass (CVE-2026-96951)

Microsoft · KB5127648, CVE-2026-96951

Reported 2026-10-13
Important (CVSS 3.1 8.8)
Critical patchPending release

Oracle October 2026 CPU: not yet released (scheduled Oct 20, 2026)

Oracle · Critical Patch Update, October 2026


Critical patchFixed

Palo Alto PAN-OS: exploited authenticated RCE in management interface (CVE-2026-0322)

Palo Alto · CVE-2026-0322

Reported 2026-10-14
HIGH (CVSS 4.0 8.6), urgency HIGHEST
Critical patchReleased

SAP October 2026 Security Patch Day: four Critical notes

SAP · GHSA-4mv3-jxxm-9cx2, 3797111, 3805589, 3798788, CVE-2026-89111, CVE-2026-89110, CVE-2026-89107, CVE-2026-89108

Reported 2026-10-13
Critical (CVSS 10.0, 9.9, 9.9, 9.1)