Lead · Microsoft · Oct 13
Patch Tuesday fixes an exploited flaw and breaks Remote Desktop for non-admins.
Microsoft October 2026 Patch Tuesday fixes CVE-2026-96951, which is on CISA’s known-exploited list. The same cycle carries a known issue: Windows 11: Remote Desktop fails for non-admin users (0xC000000D) on hosts with Administrator protection. Microsoft lists it as mitigated; workaround: temporarily turn off administrator protection.
5Exploited · CISA KEV
7Critical patches
3Install impacts
Oracle
Oct 20Next release
Oct 20Next release
The ledger
Seven critical patches this month. Five already exploited.
| Vendor | Advisory | Severity | Status | Date |
|---|---|---|---|---|
| Cisco | Cisco Secure Email Gateway | Critical | Fixed | 2026-10-14 |
| Citrix | Citrix NetScaler ADC/Gateway | CVSS 4.0 8.7 | Fixed | 2026-10-04 |
| Fortinet | Fortinet FortiMail | Critical | Fixed | 2026-10-01 |
| Microsoft | Microsoft October 2026 Patch Tuesday | Important | Fixed in October 13 updates | 2026-10-13 |
| Oracle | Oracle October 2026 CPU | — | Pending Oct 20 CPU (pre-release) | Oct 20 |
| Palo Alto | Palo Alto PAN-OS | HIGH | Fixed | 2026-10-14 |
| SAP | SAP October 2026 Security Patch Day | Critical | Patches released 2026-10-13 | 2026-10-13 |
Vendor status board
Eight vendors, one glance.
| Vendor | Cadence | Status | Top ID | CVSS | Date |
|---|---|---|---|---|---|
| Microsoft | 2nd Tue | EXPLOITED | KB5127648 | 8.8 | 2026-10-13 |
| Cisco | 1st & 3rd Wed | EXPLOITED | CVE-2026-76519 | 9.8 | 2026-10-14 |
| Oracle | Quarterly · Oct 20 | PENDING | — | — | — |
| VMware/Broadcom | Ad hoc | IMPACT | KB 455737 | — | 2026-10-09 |
| Fortinet | 2nd Tue | EXPLOITED | CVE-2026-104286 | 9.8 | 2026-10-01 |
| Palo Alto | 2nd Wed | EXPLOITED | CVE-2026-0322 | 8.6 | 2026-10-14 |
| SAP | 2nd Tue | PATCHED | GHSA-4mv3-jxxm-9cx2 | 10.0 | 2026-10-13 |
| Citrix | 2nd Tue* | EXPLOITED | CVE-2026-88779 | 8.7 | 2026-10-04 |
Breaks after install
Microsoft October 2026 Patch TuesdayMicrosoft · KB5127648, CVE-2026-96951VMware/Broadcom October 2026VMware/Broadcom · KB 455737, KB 457944Windows 11Microsoft · KB5124010, KB5127648AI attacks in the wild
Blind prompt injection against exposed AI agent frameworks, observed in the wild Observed (research) · 2026-08-27LiteLLM MCP auth bypass Confirmed · 2026-06-30LiteLLM MCP test-endpoint command injection Confirmed · 2026-04-21Weekly patch briefing
What shipped, what broke, what to hold
Coming soonNewsletter signup opens soon
Coming soonReader stats