Октябрьская коллекция патчей: Microsoft и не только

Microsoft's October Patch Tuesday sets a new record, fixing 1414 vulnerabilities in one go — the first time the tally has hit four digits. Most issues sit in Windows (1102), Office (134), SharePoint Server (36), SQL Server (22) and Exchange Server (7), with privilege escalation (677) and remote code execution (317) the most common impact types. Of the 86 flaws rated critical, 68 enable RCE; two vulnerabilities were publicly disclosed before patches shipped (CVE-2026-108398 in .NET Framework, bypassing WDAC, and CVE-2026-92707 in the MessagePack-CSharp library, causing denial of service), though neither is reported as actively exploited yet.

The only zero-day already under active attack is CVE-2026-96951 in Windows Shell (CVSS 8.8), a command-injection flaw that lets attackers bypass a security feature over the network; it was credited to researchers from Fujitsu and Anthropic. Administrators should also prioritize three serious RCE bugs — CVE-2026-65674 in SQL Server, CVE-2026-70571 in Exchange Server, and CVE-2026-70229 in Active Directory Domain Services — due to their relatively easy exploitability.

Beyond Microsoft, Adobe's October round fixed 174 bugs, including maximum-severity (CVSS 10) flaws in ColdFusion and Commerce/Magento, both frequently internet-facing. SAP's bulletin addressed 20 issues, including CVE-2026-89111, a CVSS-10 SSRF in the Cloud SDK for Python that can be used to hijack OAuth tokens.