SANS Stormcast Wednesday, October 14th, 2026: October 2026 Patch Tuesday: Microsoft Fixes 1,417 Vulnerabilities; Ivanti Connect Secure Exploited; Adobe ColdFusion and Commerce Critical Patches

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10136.mp3

previous

October 2026 Patch Tuesday: Microsoft Fixes 1,417 Vulnerabilities; Ivanti Connect Secure Exploited; Adobe ColdFusion and Commerce Critical Patches

00:00

iTunes

MP3 Download

RSS Feed

Google

Podbean

Amazon Echo

YouTube

Spreaker

Spotify

Discussion

Login here to join the discussion.

Podcast Transcript

 Hello and welcome to the Wednesday October 14th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Amsterdam, Netherlands. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in
 Cybersecurity Engineering. Well of course today it's
 Microsoft Patch Tuesday for October 2026 and with this as
 pretty much everybody expected we did get another massive
 release of updates. 1417 different vulnerabilities were
 addressed in this update. 76 of these vulnerabilities were
 rated critical so pretty much sort of a factor of 10 or so
 from what we had prior with Microsoft. Now seven of the
 critical vulnerabilities do not require any customer
 actions. These were cloud issues that Microsoft has
 addressed actually before a Patch Tuesday came out.
 Scrolling through the list I sort of saw a couple of kind
 of interesting issues here. Now first of all we did have
 one vulnerability that's already being exploited that's
 a Windows shell security feature bypass. This
 vulnerability allows bypassing of the Mark of the Web so an
 attacker can send you a message and if the user opens
 the message there is no warning that this particular
 file was downloaded from the internet. So overall nothing
 really super critical here. Yes it's an important
 vulnerability. And then we have a second vulnerability
 that was already made public before today. This is a little
 bit a similar kind of issue in terms of impact. It's a .NET
 Framework security feature a bypass and it does allow an
 attacker or a user to execute a file bypassing application
 control. So if you basically try to limit what applications
 can be executed well this can be used to bypass this
 feature. Again you still have to get the malicious
 application to the user and get them to execute it. It
 could be useful like for example for an attacker that
 has already access to a system then to execute additional
 malicious software. Now one particular product that I
 found was kind of interesting was Windows DHCP server. So if
 you happen to use Windows DHCP server you have 10 remote
 code execution vulnerabilities that are being addressed in
 the DHCP server. Five of them are rated critical. There's
 also a remote code execution vulnerability in Microsoft
 Exchange server. Now Microsoft considers exploitation of this
 vulnerability less likely. They say an attacker would
 have to have some detailed knowledge of the environment
 they are attacking in order to successfully exploit this
 vulnerability. The way it would be exploited is that you
 send a specific email to the Exchange server and then as
 the Exchange server converts the email it will then trigger
 the vulnerability. So certainly something that's
 exploitable in the sense that all you have to do is send an
 email but apparently to properly exploit it and
 actually successfully exploit a vulnerability you must have
 a lot of detailed knowledge about the system to actually
 craft the right exploit for this of vulnerability. So in
 general yes tons and tons of vulnerabilities. Office again
 lots of vulnerabilities in Office. I would definitely pay
 attention to those. Lots of remote code execution
 vulnerabilities also in Office. And that has been
 historically always sort of one of the targets of
 attackers but it's really just more vulnerabilities not
 necessarily in more products. There are a few more products
 in this update so get them applied. Don't really worry
 about each vulnerability individually just worry about
 which applications you actually run and which ones of
 those do need patching. But well Microsoft wasn't the only
 one releasing patches today. Ivanti released its October
 2026 security update fixing one vulnerability in Ivanti
 Connect Secure that is already being exploited in limited
 attacks as Ivanti states in its advisory. There is a
 second set actually two additional vulnerabilities
 that are being addressed by Ivanti in Ivanti Neurons
 patch for Intune and Extraction. This vulnerability
 is not yet exploited but one of the issues with this
 vulnerability is that it can leak the credentials being
 used by Ivanti Neurons in particular to connect to
 Microsoft Intune. So Ivanti advises that you should rotate
 those credentials in addition to applying the patch. And
 Adobe brings us 110 vulnerabilities that are being
 updated across 11 products and as usual the products that
 sort of I'm trying to focus on Adobe Commerce has some
 critical vulnerabilities here that allow for arbitrary code
 execution also ColdFusion has critical CVSS 10.0
 vulnerabilities like server-side request forgery
 vulnerabilities and unrestricted file uploads
 which of course then often can be escalated to arbitrary code
 execution on the server. Definitely address those two
 products. The other products are your Photoshop, FrameMaker
 and the like. They're really sort of more in the category
 of Office products and well not as commonly used as
 Microsoft Office so probably less of an issue. Well and
 that's it for today so thanks for listening, thanks for
 liking, thanks for subscribing. Should I have
 covered any other products or such please let me know and
 talk to you again tomorrow. Bye!