A huge Patch Tuesday, active exploitation of Ivanti, Cisco and Palo Alto, and a file leak in self-hosted Atlassian products: there is plenty of internet-facing equipment to patch this week.
Microsoft: record Patch Tuesday with a leaked Windows zero-day
Microsoft covered a record number of more than 1,400 vulnerabilities in the October release, around 75 of which are marked as critical. The most important item is CVE-2026-96951, a Windows Shell bug (CVSS 8.8) that lets an attacker bypass Mark-of-the-Web warnings; it is already being actively exploited and CISA requires government agencies to patch it by 16 October. Apply the October update quickly and prioritise this zero-day, especially on systems that open many email and message attachments. Source: https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct
Atlassian: unauthenticated file leak in 8 self-hosted products
Atlassian has published an advisory (CVSS 9.3) in which an attacker without a login can read specific files from the web application root in Jira, Confluence, Bitbucket, Bamboo and Crowd (all Data Center editions) plus Crucible and Fisheye. CISA added it to the Known Exploited Vulnerabilities catalog on 15 October based on evidence of active exploitation. Update to a fixed build and - if Jira runs on Crowd - rotate the Crowd credentials, as those in crowd.properties may have been exposed. Source: https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html
Ivanti Connect Secure: chained zero-days for unauthenticated root
On 13 October Ivanti released fixes for CVE-2026-104935, where, according to Volexity, attackers chain three bugs together (authentication bypass, code execution, privilege escalation) to gain unauthenticated root access; CISA has set a deadline of 16 October. Note that this attack runs in memory, so detection tools may miss it - so patch and also check your logs for unusual activity. Source: https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
Cisco Secure Email Gateway: second zero-day in a month
Cisco has published CVE-2026-76519 (CVSS 9.8), an arbitrary file write that can lead to root commands without logging in when a specially crafted email attachment is processed; it is a different bug from last month's, so a gateway that was only patched in September may still be vulnerable. The KEV deadline is 17 October; upgrade the mail gateway and check whether File Reputation is active with an old Content Scanner. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
Palo Alto PAN-OS: root via the management interface after login
Palo Alto Networks has patched CVE-2026-0322 (CVSS 8.6), which allows an attacker with high-privilege credentials on the management interface to execute arbitrary code as root on PA-Series, VM-Series and Panorama. The company reports "very limited" exploitation; CISA has set 17 October as the deadline. Restrict access to the management interface to trusted internal addresses and patch as soon as possible. Source: https://security.paloaltonetworks.com/CVE-2026-0322