74 openlast updated

HomePatch Tuesday October 2026

Patch Tuesday October 2026: Known Issues and What Broke

Known issues and what broke on Patch Tuesday October 2026.

01

Open

CallTitleVendorProductsDate
Patch now
CallPatch nowTitleCVE-2026-19868 SonicOS SSL VPN SAML/MFA bypass exploitedEnterprisefrom 2026-10VendorSonicWallProductsSonicOS Gen7 7.3.3-7015 and earlier, SonicOS Gen8 8.2.2-8015 and earlier +6Date
CallPatch nowTitleCVE-2024-27834 Apple PAC bypass: now in KEVEnterpriseEnd-user appsfrom 2026-10VendorAppleProductsiOS 16.7.8, iOS 17.5 +6Date
CallPatch nowTitleCVE-2026-123158 OpenSSH sshole: patch Alpine nowEnterpriseHomelabfrom 2026-10VendorLinuxProductsOpenSSH before 10.6p2, Alpine Linux +4Date
CallPatch nowTitleCVE-2026-107441 Zyxel GS1900: exploited, old patch missed itEnterpriseHomelabfrom 2026-10VendorZyxelProductsZyxel GS1900-8, GS1900-8HP +8Date
CallPatch nowTitleCVE-2026-120422 Sogou Input Method abused to plant backdoorEnterpriseEnd-user appsfrom 2026-10VendorTencentProductsSogou Input Method for Windows before 16.10, Sogou Input Method 16.10Date
CallPatch nowTitleBTCPay Server 2.4.1 and older: hot wallets drainedEnterpriseHomelabfrom 2026-10VendorBTCPay ServerProductsBTCPay Server 2.4.1 and earlier, BTCPay Server 2.4.2Date
CallPatch nowTitlecPGuard 5.88.12-5.88.19: update channel pushed a backdoorEnterprisefrom 2026-10VendorOPSSHIELDProductscPGuard 5.88.12-5.88.19, cPGuard 5.88.25Date
CallPatch nowTitleCVE-2026-58115 Node-RED on Siemens IoT2050: exploitedEnterpriseHomelabfrom 2026-10VendorSiemens, Node-REDProductsSIMATIC IoT2050 Advanced, Industrial OS +1Date
CallPatch nowTitleCVE-2026-111357 Ivanti Connect Secure: patched? Patch againEnterprisefrom 2026-10VendorIvantiProductsIvanti Connect Secure 25.1.1, Ivanti Connect Secure 25.1.3 +1Date
CallPatch nowTitleCVE-2026-118539 Drupal Commerce: exploited access bypassEnterprisefrom 2026-10VendorDrupalProductsDrupal Commerce Core 3.x, Drupal Commerce Core 8.x-2.xDate
CallPatch nowTitleCVE-2026-119977 WordPress update race RCE: now exploitedEnterpriseHomelabfrom 2026-10VendorWordPressProductsWordPress 4.7 through 7.1.3, WordPress 7.1.4 +3Date
CallPatch nowTitleCVE-2026-20127 Cisco SD-WAN: exploited, KeyDrift malwareEnterprisefrom 2026-10VendorCiscoProductsCisco Catalyst SD-WAN Controller, Cisco Catalyst SD-WAN Manager +1Date
CallPatch nowTitleCVE-2026-97229 GitLab: exploited CI/CD regex RCE, CVSS 10EnterpriseHomelabfrom 2026-10VendorGitLabProductsGitLab CE, GitLab EE +1Date
CallPatch nowTitleSynology DSM SA-24:20: ransomware hits unpatched NAS boxesEnterpriseHomelabfrom 2026-10VendorSynologyProductsSynology DSM 7.4, Synology DSM 7.3 +5Date
CallPatch nowTitleCVE-2026-41709 ESXi: exploited flaw that skips the logsEnterpriseHomelabfrom 2026-10VendorVMwareProductsVMware ESXi 8.0, VMware ESX 9.0 +3Date
CallPatch nowTitleCVE-2026-46300 Fragnesia: exploited Linux kernel root bugEnterpriseHomelabfrom 2026-10VendorLinux, Debian, Ubuntu, Proxmox, Palo Alto NetworksProductsLinux kernel, Debian 11/12/13 +4Date
CallPatch nowTitleCVE-2026-76418 Cisco ASA/FTD: exploited SSL VPN crash bugEnterprisefrom 2026-10VendorCiscoProductsCisco Secure Firewall ASA, Cisco Secure Firewall Threat Defense (FTD)Date
CallPatch nowTitleCVE-2026-48356 PolyShell: Magento and Adobe Commerce hitEnterprisefrom 2026-10VendorAdobeProductsAdobe Commerce, Magento Open Source +1Date
CallPatch nowTitleFortiMail CVE-2026-104286: your encrypted-mail portal accepts files from strangersEnterprisefrom 2026-10VendorFortinetProductsFortiMail 7.2, FortiMail 7.4 +2Date
CallPatch nowTitleCVE-2026-111497 Brotli 'Node2Shell': exploited; patch nowEnterprisefrom 2026-10VendorMicrosoftProducts.NET 8, .NET 9 +7Date
CallPatch nowTitleCVE-2026-109618/-109619 php2shell: patch PHP and appliancesEnterpriseHomelabfrom 2026-10VendorPHPProductsPHP 8.2-8.5, PAN-OS +7Date
CallPatch nowTitleCVE-2026-76519 Cisco SEG, CVE-2026-104935 Ivanti: exploitedEnterprisefrom 2026-10VendorCisco, IvantiProductsCisco Secure Email Gateway, Ivanti Connect SecureDate
CallPatch nowTitleFortiOS CVE-2025-61624: an April fix, an October KEV entry, and an implant called PEERSTITCHEnterprisefrom 2026-10VendorFortinetProductsFortiOS, FortiProxy +2Date
CallPatch nowTitleNextcloud's built-in Collabora app: exploited for six weeks, CVE'd for ten daysEnterpriseHomelabfrom 2026-10VendorNextcloudProductsCollabora Online - Built-in CODE Server (richdocumentscode) before 26.4.303Date
CallPatch nowTitleOctober 2026 Patch Tuesday: 1,413 fixes, one exploited zero-day, and an Exchange hangoverEnterpriseEnd-user appsfrom 2026-10VendorMicrosoftProductsWindows 10, Windows 11 +3Date
CallPatch nowTitlePAN-OS CVE-2026-0322: root on your firewall, exploited, and php2shell is next in lineEnterprisefrom 2026-10VendorPalo Alto NetworksProductsPAN-OS 10.2-12.2, PanoramaDate
CallPatch nowTitlePlex2Shell: your media server is now somebody else's crypto minerHomelabfrom 2026-10VendorPlexProductsPlex Media Server before 1.43.3.10861Date
CallPatch nowTitleArista VeloCloud Orchestrator: read-only users, now with superuser energyEnterprisefrom 2026-10VendorAristaProductsVeloCloud OrchestratorDate
CallPatch nowTitleFortiOS 7.6.8, 7.4.13: October 2026 hardening releaseEnterprisefrom 2026-10VendorFortinetProductsFortiOS, FortiManager +4Date
CallPatch nowTitleBeyondTrust Remote Support: the remote-access tool attackers are using for remote accessEnterprisefrom 2026-10VendorBeyondTrustProductsRemote SupportDate
CallPatch nowTitleCVE-2026-96951: exploited Windows Shell zero-dayEnterpriseEnd-user appsfrom 2026-10VendorMicrosoftProductsWindows 11 24H2/25H2/26H2, Windows 11 23H2 +5Date
Hold
CallHoldTitleKB4960 Veeam Appliance on AMD EPYC: boot panicEnterprisefrom 2026-10VendorVeeamProductsVeeam Software Appliance 13.1, Veeam Backup & ReplicationDate
CallHoldTitleKB5121794 Windows 11 26H2: Windows Hello sign-in breaksEnterprisefrom 2026-10VendorMicrosoftProductsWindows 11 26H2, Windows Hello +1Date
CallHoldTitleIntel's connectivity suite optimizes your IPv6 straight into connection resetsEnterpriseEnd-user appsfrom 2026-10VendorIntelProductsIntel Connectivity Performance Suite (OEM builds 40.25.725.165, 40.25.926.173 +6Date
CallHoldTitleDebian 13 kernel 6.12.111 and Broadcom NICs: Proxmox already did this oneEnterpriseHomelabfrom 2026-10VendorDebianProductsDebian 13 trixie kernel 6.12.111+deb13, bnxt_en +1Date
CallHoldTitleHP ProBook 4 G1i BIOS 01.05.04: restart is now a two-step processEnd-user appsfrom 2026-10VendorHPProductsHP ProBook 4 G1i 14 and 16 (platform 8DEA), BIOS X72 01.05.04Date
CallHoldTitleNVIDIA 621.01: your videos now come with intermissionsEnd-user appsfrom 2026-10VendorNVIDIAProductsGeForce Game Ready Driver 621.01, GeForce Hotfix Driver 621.12Date
CallHoldTitleOld OnGuard vs new Windows: the Login Driver can't find its way homeEnterprisefrom 2026-10VendorLenelS2ProductsLenelS2 OnGuard 7.4-8.1, Windows cumulative updates Aug-Oct 2026Date
CallHoldTitleWindows 11 26H2 on Falcon fleets: hold the feature update, not the security updateEnterprisefrom 2026-10VendorMicrosoftProductsWindows 11 26H2, CrowdStrike FalconDate
Known issues
CallKnown issueTitleHome Assistant 2026.11.0: custom integrations not loadedHomelabfrom 2026-10VendorHome AssistantProductsHome Assistant Core 2026.11.0, Home Assistant OS +2Date
CallKnown issueTitleCVE-2026-83844 Microsoft Paint RCE: Store-only fixEnterpriseEnd-user appsfrom 2026-10VendorMicrosoftProductsMicrosoft Paint, Windows 11Date
CallKnown issueTitleCVE-2026-98432 Veeam appliances: Linux kernel TCP fixEnterprisefrom 2026-10VendorVeeamProductsVeeam Software Appliance 13.1, Veeam Infrastructure Appliance 13.1 +4Date
CallKnown issueTitleKB5126836: Server 2012 R2 SAN disks vanish after updateEnterprisefrom 2026-10VendorMicrosoftProductsWindows Server 2012 R2 ESU (KB5126836)Date
CallKnown issueTitleKB5127648: shared printers fail with Error #87 in SettingsEnterprisefrom 2026-10VendorMicrosoftProductsWindows 11 24H2/25H2/26H2 (KB5127648), Windows 11 23H2 +1Date
CallKnown issueTitleOctober DC updates vs NetApp ONTAP: LDAP says your credentials are invalidEnterprisefrom 2026-10VendorMicrosoftProductsWindows Server 2016-2025 domain controllers, NetApp ONTAP 9.x +1Date
CallKnown issueTitleFortiOS 7.4 and 7.6: the GUI daemon that eats the firewall (bug 1227167)EnterpriseHomelabfrom 2026-10VendorFortinetProductsFortiOS 7.4, FortiOS 7.6Date
CallKnown issueTitleJava's second eMudhra alert: this time it's roots, and one of them is load-bearingEnterpriseEnd-user appsfrom 2026-10VendorOracleProductsJava SE, GraalVM for JDK +1Date
CallKnown issueTitleKB5127648: boot failures and install rollbacks on Windows 11EnterpriseEnd-user appsfrom 2026-10VendorMicrosoftProductsWindows 11 24H2/25H2/26H2, Dell Pro 14 +4Date
CallKnown issueTitleYour PEAP-MSCHAPv2 Wi-Fi stopped auto-connecting. That's not a bug, that's the roadmap.Enterprisefrom 2026-10VendorMicrosoftProductsWindows 11 24H2/25H2/26H2, Windows Server 2025Date
CallKnown issueTitleFortiOS 7.6.8 breaks admin SAML SSO (bug 1338764)Enterprisefrom 2026-10VendorFortinetProductsFortiOS 7.6.8, FortiGateDate
02

Resolved