Senserva Watch: free Patch Tuesday, CISA KEV and CVE alerts by email

1. 2026-11-04 CVE-2026-69499 CVE-2026-73013 CVE-2026-104935 CVE-2026-111357 CVE-2026-118527

   Two patches a normal Windows patch cycle can miss: nine Windows CVEs that Microsoft now says also affect Office for Mac and Office for Android, and two more exploited Ivanti Connect Secure flaws that the October 13 fix did not cover.

   ______________________________________________

   OFFICE FOR MAC AND ANDROID: NINE WINDOWS CVES NOW APPLY

   On October 28, Microsoft revised nine Windows vulnerabilities it first published in July, August and September. Each revision says Microsoft "Added supported editions of Microsoft Office to the Security Updates table because they are affected by this vulnerability."

   The editions added are Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021 and 2024, and Microsoft Office for Android. Office for Windows is not among them. The fix for these editions is an Office update, not a Windows one.

   Microsoft rates two of the nine Critical, both Windows Imaging Component remote code execution at CVSS 8.8:
   CVE-2026-69499: Office for Mac and Office for Android
   CVE-2026-73013: Office for Android

   Microsoft's tables give the fixed builds: Office for Mac 16.112.26090911 and Office for Android 16.0.20430.20000. The Office for Mac release notes show that build as Version 16.112.4 (Build 26090911), released September 10, so a Mac updated since then already has it; the release notes do not name these CVEs. Microsoft lists none of the nine as exploited or publicly disclosed, and none is in CISA's Known Exploited Vulnerabilities catalog.

   Ours: https://senserva.com/cve/CVE-2026-69499.html and https://senserva.com/cve/CVE-2026-73013.html

   Microsoft's Security Update Guide :

   ______________________________________________

   ONLY IF YOU RUN IVANTI CONNECT SECURE: TWO MORE EXPLOITED FLAWS

   An update to our October 18 note on CVE-2026-104935. Rapid7 reports that on October 29 Ivanti added two vulnerabilities to its Connect Secure advisory, CVE-2026-111357 and CVE-2026-118527, and that "The October 13 fixes in 25.1.1.2 and 22.8R2.5 do not remediate CVE-2026-111357 or CVE-2026-118527." Rapid7 lists the fixed versions as 25.1.1.3 and 22.8R2.6. CISA's Known Exploited Vulnerabilities catalog shows both added on October 30.

   BleepingComputer reports that Volexity saw a threat actor "chaining the CVE-2026-104935 vulnerability since at least October 3 with two other flaws to gain unauthenticated root-level code execution on fully patched ICS devices." On what the attackers went after, Rapid7 writes: "Volexity observed credential theft and Active Directory queries for Windows LAPS passwords and BitLocker recovery keys." Rapid7 also cautions: "Volexity reports that the observed activity evades Ivanti's Integrity Checker Tool, so a clean result does not rule out compromise."

   Rapid7:
   BleepingComputer:
   Ours: https://senserva.com/cve/CVE-2026-111357.html and https://senserva.com/cve/CVE-2026-118527.html

   ______________________________________________

   SOURCES

   Microsoft Security Update Guide, CVE-2026-69499:
   Microsoft Security Update Guide, CVE-2026-73013:
   Microsoft, Office for Mac release notes:
   Ivanti security advisory, Connect Secure:
   CISA Known Exploited Vulnerabilities catalog:
   Rapid7, November 2:
   BleepingComputer, November 2:

2. 2026-10-29 CVE-2026-48356 CVE-2025-54236

   ONLY IF YOU RUN ADOBE COMMERCE OR MAGENTO OPEN SOURCE: CVE-2026-48356 (POLYSHELL)

   CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities catalog on October 27, with a November 10 due date for federal agencies. Adobe rates it Critical, CVSS 9.3, and describes it as an unrestricted upload of a dangerous file type that could lead to arbitrary code execution. Sansec, the e-commerce security firm that discovered it and named it PolyShell, says it lets attackers upload executable files to any Magento or Adobe Commerce store through the REST API.

   This one has been exploitable for seven months. Sansec published PolyShell on March 17, when no patch existed for production releases. Mass exploitation started March 19, two days after disclosure. Sansec observed attacks on 79.5% of all stores it monitors. On March 30, one group compromised 471 stores in a single hour, uploading webshells through PolyShell and then injecting malicious JavaScript.

   That group is still active. On October 24, Sansec tied it to a skimmer-loader campaign that has hit 953 stores, mostly Magento, since July 2025. One store on Magento 2.4.7-p1 still had PolyShell webshells disguised as PNG images in pub/media/custom_options/quote/, and it had never installed the fix.

   Adobe’s fix came four months after the attacks began, in bulletin APSB26-73 on July 14. When it published the bulletin, Adobe said it was not aware of any exploits in the wild for the issues it covered. CISA’s listing now makes this a high priority.

   The fix, per Adobe’s APSB26-73, is to update to July patch:

   Adobe Commerce: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul
   Magento Open Source: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul
   Adobe Commerce B2B: 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul
   Adobe Commerce Events: 1.21.0

   Adobe also released an isolated patch for teams that can’t take the full release right away. If you run Adobe Commerce on cloud infrastructure, confirm your patch status with Adobe rather than assuming it was applied for you. If you self-host Magento Open Source, you are responsible for applying.

   Patching does not remove what’s already there. With seven months of mass exploitation before many stores could patch, assume any store that was online and unpatched may already hold webshells. Sansec found that a fully patched store on 2.4.7-p10 picked up the newest loader on October 23, an hour after passing a clean scan, because of a rogue admin account and a GSocket backdoor planted in September. After patching:

   - Check pub/media/custom_options/quote/ for uploaded files, especially images that contain PHP.
   - Review CMS blocks for injected script.
   - Audit admin accounts for ones you didn’t create.
   - Look for suspicious processes on the server.
   - Sansec also recommends installing APSB25-88 for SessionReaper (CVE-2025-54236), the other upload flaw this group uses.

   Ours: https://senserva.com/cve/CVE-2026-48356.html

   SOURCES
   Adobe security bulletin APSB26-73:
   CISA Known Exploited Vulnerabilities catalog:
   Sansec, PolyShell research:
   The Hacker News, October 27:
   Infosecurity Magazine, October 27:
   Every exploited non-Microsoft CVE we track: https://senserva.com/non-microsoft-cve-tracker.html?utm_source=watch

   -TJ

3. 2026-10-27 CVE-2026-111497 CVE-2026-70197 CVE-2026-102870 CVE-2026-114148 KB5133964 KB5133965 KB5133966

   Update to recent note on this topic:

   CVE-2026-111497, CVE-2026-70197, CVE-2026-102870, CVE-2026-114148, KB5133964, KB5133965, KB5133966

   Two items: an out-of-band .NET security release from Sunday, which also finishes fixes that October's Patch Tuesday left incomplete, and Microsoft's reminder that Windows Server 2016 gets its last security update in January.

   ---

   .NET: OUT-OF-BAND SECURITY RELEASE, OCTOBER 25

   Microsoft released .NET 8.0.33, 9.0.22 and 10.0.14 on Sunday, October 25. The release notes say: "We are releasing this out-of-band (OOB) security update, outside our regular monthly servicing schedule, to address CVE-2026-111497". Microsoft's Security Update Guide also lists fixes for PowerShell 7.4, 7.5 and 7.6, and for Visual Studio 2019 16.11, 2022 17.14, and 2026 18.11 and 18.12. Microsoft's KB articles (KB5133964, KB5133965, KB5133966) say the update is on Microsoft Update for Windows clients and on WSUS and the Update Catalog for Windows Server.

   The October fixes were incomplete. For CVE-2026-70197, a .NET remote code execution flaw from October 13, Microsoft's release notes say "the October 13, 2026 release did not fully address this issue. Today's update provides the fix." KB5133964 says customers "should apply the latest update even if they installed the October 13 security update." Microsoft's Security Update Guide entry for CVE-2026-70197 was last revised on October 25 with an informational change, and it still carries the October 19 note that the issue "has not been addressed". The release notes and KB article, both dated October 25, say the fix is in this release.

   For .NET 10, the release notes also re-release CVE-2026-102870, a Blazor WebAssembly debugger flaw from October 13, and say to update the Microsoft.AspNetCore.Components.WebAssembly.Server and Microsoft.AspNetCore.Components.WebAssembly.DevServer package references to 10.0.14, because "updating the shared runtime alone does not update these packages."

   CVE-2026-111497 is in the Brotli compression library that .NET uses. Microsoft rates it Critical, lists it as publicly disclosed, and assesses exploitation as "Exploitation More Likely". Its mitigation note: "Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install." Microsoft says applications are affected if they turned on ASP.NET Core request decompression or HttpClient response decompression, or call the Brotli APIs directly. Per the release notes, ".NET Framework is not affected."

   CVE-2026-114148 is incorrect file ownership in some Linux .NET tarballs. The release notes add: "Downloading an updated archive does not by itself correct ownership in an existing installation."

   To check a machine, Microsoft's release notes say "You can check your .NET SDK version by running the following command": dotnet --version. Per the release notes, the SDKs that include the fixed runtimes are 8.0.427 or 8.0.133, 9.0.320 or 9.0.123, and 10.0.403 or 10.0.114, and the fixed runtimes are 8.0.33, 9.0.22 and 10.0.14. .NET 11 release candidate 3 shipped the same day with the same fixes. Microsoft's release data gives November 10, 2026 as the end of support for both .NET 8 and .NET 9.

   Ours:
   https://senserva.com/cve/CVE-2026-70197.html
   https://senserva.com/cve/CVE-2026-102870.html
   https://senserva.com/cve/CVE-2026-111497.html
   https://senserva.com/cve/CVE-2026-114148.html

   --- Also a reminder ---

   WINDOWS SERVER 2016: LAST SECURITY UPDATE IN JANUARY

   Microsoft's message center, October 14: "On January 12, 2027, Windows Server 2016 will reach end of updates. The January 2027 Windows security update will be the last update available for this version." Microsoft says "Extended Security Updates (ESU) are available for Windows Server 2016 Standard and Datacenter editions for organizations that need additional time to complete their transition."

   Ours, October's update for Windows Server 2016: https://senserva.com/kb/5126868.html

   ---

   SOURCES

   Microsoft, .NET 8.0.33 release notes:
   Microsoft, .NET 9.0.22 release notes:
   Microsoft, .NET 10.0.14 release notes:
   Microsoft, .NET 11.0 RC3 release notes:
   Microsoft, KB5133964 (.NET 8.0):
   Microsoft, KB5133965 (.NET 9.0):
   Microsoft, KB5133966 (.NET 10.0):
   Microsoft Security Update Guide, CVE-2026-70197:
   Microsoft Security Update Guide, CVE-2026-102870:
   Microsoft Security Update Guide, CVE-2026-111497:
   Microsoft Security Update Guide, CVE-2026-114148:
   Microsoft, Windows message center:
   BleepingComputer, October 23:

4. 2026-10-21 CVE-2026-109618 CVE-2026-109619

   IF YOU RUN PHP ON ANY SERVER THAT TAKES WEB TRAFFIC: CVE-2026-109618 AND CVE-2026-109619 (PHP2SHELL)

   PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 to fix two critical flaws that can allow unauthenticated remote code execution. Both are rated CVSS v4.0 9.2. PHP says every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php highest, because a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs. Researchers at Calif, Wiz and OpenAI found the bugs. Cloudflare says they affect all web servers running PHP 5.4 or later.

   The timeline has moved fast. SecurityWeek reported that details leaked online ahead of coordinated disclosure, and PHP pulled the release forward to October 21 at 14:00 UTC. Cloudflare says it saw attack traffic targeting its customers during the leak window, and that its WAF customers, including Free plans, were protected by default starting October 21 at 3:02 UTC. watchTowr said it believed it had reproduced CVE-2026-109618. That establishes attack attempts, not confirmed compromises. As of October 21, PHP had not reported in-the-wild exploitation but Cloudflare has reported attempts against their network. CISA did issue an alert the same day urging organizations to patch immediately.

   The fix, per PHP’s advisory: update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages. PHP 8.1 and older get no updates from the PHP project; contact your distribution or LTS vendor for a backport, or move to a supported version. PHP also published minimal source backports for 7.4, 8.0 and 8.1 for anyone building from source. If you rely on rpms.remirepo.net, PHP says that repo will not have updates today and urges switching to distribution packages or building from source. The flaws sit in the PHP runtime, so updating site code or plugins does not fix them. If a hosting provider manages your PHP, ask them to apply the update.

   If you cannot patch today, PHP is direct: “There are no complete mitigations, updating is the only safe choice.” Its interim measures narrow specific attack paths but do not make an installation safe. For CVE-2026-109618: set memory_limit=-1 where applications cannot override it, set a low post_max_size (8M without uploads, 32M with), and use a container or cgroup limit. For CVE-2026-109619: set session.upload_progress.enabled=0 in php.ini, an FPM pool or server config (not ini_set() or .user.ini) and restart every worker; on PHP 8.5, also set fatal_error_backtraces=0. The UK NCSC told organizations to update PHP immediately or take systems offline until they can. Cloudflare paid-plan customers should confirm the Managed Ruleset is deployed in block mode, and Cloudflare still says to patch.

   Our pages: https://senserva.com/cve/CVE-2026-109618.html and https://senserva.com/cve/CVE-2026-109619.html

   ----------------

   SOURCES

   PHP security advisory, October 21:
   PHP GitHub advisory, CVE-2026-109618:
   PHP GitHub advisory, CVE-2026-109619:
   CISA alert, October 21:
   Cloudflare, October 21:
   BleepingComputer, October 21:
   SecurityWeek, October 21:
   UK NCSC:
   Every exploited non-Microsoft CVE we track: https://senserva.com/non-microsoft-cve-tracker.html?utm_source=watch

5. 2026-10-20 CVE-2026-102764

   ONLY IF YOU RUN BEYONDTRUST REMOTE SUPPORT OR PRIVILEGED REMOTE ACCESS: CVE-2026-102764

   CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16, with a due date of October 19 for federal agencies. CISA describes it as an authentication bypass that "could allow a remote attacker to perform file operations on the appliance," and marks forensic triage as required. NVD scores it CVSS 9.8 Critical; BeyondTrust scores it CVSS v4 9.3.

   Rapid7 reports that BeyondTrust "has confirmed that exploitation in the wild has already occurred prior to disclosure," with the two known compromises dated to August 29. Rapid7 adds that "Mandiant attributes the activity to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221."

   The fix, per BeyondTrust's advisory: Remote Support 26.2.3 and earlier is affected; apply the BT26-05-RS patch, available for versions 24.3.1 through 26.2.3. Versions older than 24.3.1 must first upgrade to a supported version, then apply the patch. SecurityWeek reports BeyondTrust shipped the fix on October 8, and the advisory says: "As of Oct 9, 2026, a patch that remediates this vulnerability has been applied to all Remote Support SaaS customers." Self-hosted appliances need it applied by hand if they are not subscribed to automatic updates. BeyondTrust's blog also recommends that self-hosted Privileged Remote Access customers apply the patch immediately, because PRA shares the affected code, though its testing has not found a way to exploit the flaw in PRA.

   After patching, Rapid7 says: "Patching does not remove persistence." It "strongly recommends investigating for compromise even after patching," relays Mandiant's advice to preserve evidence before changes or reboots, isolate suspected appliances, and rebuild from a clean, fully patched image if compromise is confirmed or cannot be ruled out, and says organizations "should rotate stored or brokered credentials after patching or rebuilding." Rapid7 notes these credential and configuration reviews "also apply to SaaS customers."

   Ours: https://senserva.com/cve/CVE-2026-102764.html

   ______________________________________________

   SOURCES

   BeyondTrust advisory BT26-05:
   BeyondTrust blog, BT26-05:
   CISA Known Exploited Vulnerabilities catalog:
   Rapid7, October 19:
   SecurityWeek, October 16:

6. 2026-10-18 CVE-2026-104935 KB5127648 KB5124010 KB5129195

   Two items this weekend: the known issues on October's Windows 11 update, and an exploited Ivanti flaw for anyone running Ivanti Connect Secure.

   ______________________________________________

   WINDOWS 11: THREE KNOWN ISSUES ON KB5127648

   Microsoft now lists three known issues for KB5127648, the October 13 update for Windows 11 24H2, 25H2 and 26H2, and says it is working on fixes for all three.

   Smart App Control: "some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off." Microsoft gives a registry change, or for managed devices two Group Policy downloads that must both be installed. Devices where it is already on "are not affected and remain protected."

   Remote Desktop: since the September preview update KB5124010, "non-admin users might be unable to establish Remote Desktop connections to remote devices that have Administrator protection enabled", with error 0xC000000D. Microsoft notes that Administrator protection is on by default in its Windows 11 24H2, 25H2 and 26H2 security baselines. Its mitigation is to temporarily turn off Administrator protection in Intune or Group Policy.

   USB audio: "some USB Audio Class 1.0 devices might fail to start or produce audio." Microsoft says the September 14 out-of-band update KB5129195 resolved only the 8-channel and 3D audio cases, and points admins who need a workaround for the rest to Microsoft Support for Business.

   Also on the same page: Microsoft says "The October 2026 monthly security update is the last update available" for Windows 11, version 24H2 Home and Pro.

   Microsoft's article:
   Ours: https://senserva.com/kb/5127648.html

   ______________________________________________

   ONLY IF YOU RUN IVANTI CONNECT SECURE: CVE-2026-104935

   CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13: an authentication bypass that "allows a remote unauthenticated attacker to execute arbitrary commands." Rapid7 notes that "exploitation in the wild has already occurred prior to disclosure, affecting a limited number of customers." CISA's alert names the affected versions: "25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior." Ivanti's advisory lists the fixed versions, 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5, and which applies to each line. CISA points to Ivanti's upgrade guide for hardware and virtual appliances, and notes that version 22.8 "reaches end of life on Jan. 31, 2027."

   The Microsoft side: SecurityWeek reports that the attackers "searched Active Directory for LAPS passwords and BitLocker recovery keys."

   CISA says organizations checking for compromise "will need to conduct network and memory forensics to identify evidence of exploitation," because the Integrity Checker Tool "may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory." If a compromise is suspected, CISA recommends Ivanti's recovery procedures, including: "Reset passwords for all accounts, including domain, administrator, and local accounts."

   As of October 14, The Register reported that a separate privilege escalation used in the same attacks was not yet fixed, and that Volexity said Ivanti plans a fix "in the coming weeks."

   Ours: https://senserva.com/cve/CVE-2026-104935.html

   ______________________________________________

   SOURCES

   Microsoft, KB5127648:
   Ivanti advisory:
   CISA alert, October 13:
   CISA Known Exploited Vulnerabilities catalog:
   Rapid7, October 13:
   SecurityWeek, October 13:
   The Register, October 14:

7. 2026-10-17 CVE-2026-96951 KB5126868

   KB5126868 (OS Build 14393.9612) addresses 769 CVEs, including CVE-2026-96951, a critical vulnerability with CVSS 9.8 and known active exploitation.

   Microsoft has opened known issues on this update: users may be unable to sign in to OWA or send emails on Exchange Server, and USB Audio Class 1.0 devices may fail with error Code 10 or no output. No out-of-band fixes are available.

   Before deployment, verify your Exchange Server and audio device configurations against these issues. Review the full details and current status at our page and Microsoft's support article.

   ______________________________________________

   SOURCES

   Microsoft's article for KB5126868:
   Senserva tracking page: https://senserva.com/kb/5126868.html

8. 2026-10-16 KB5127648

   BleepingComputer reports that Microsoft has acknowledged an issue where some users may have trouble turning on Smart App Control after installing the October Windows 11 security update KB5127648.

   For Microsoft administrators managing Windows 11 environments, this means you should verify Smart App Control status on systems that have received this update. If your organization relies on Smart App Control as part of your application allowlisting or security posture, check whether affected devices can enable or maintain this feature after patching.

   Review the full report at

   And monitor our tracking page at https://senserva.com/kb/5127648.html for updates on this issue and any available remediation steps.

   ______________________________________________

   SOURCES

   BleepingComputer, 2026-10-16:

   (a bit down in the page there is an update)

   Senserva tracking page: https://senserva.com/kb/5127648.html

9. 2026-10-15 KB5127648

   On October 15, Microsoft added an [Authentication] item under Improvements in the KB5127648 release notes. It says that when the BlockNtlmv1SSO registry value is not set:

   "Windows now uses Enforce mode (1) instead of Audit mode (0), blocking the generation of NTLMv1-derived credentials for Single Sign-On (SSO)." Microsoft says it applies only where Credential Guard is disabled, and "might affect Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2-based authentication."

   Thank you to a reader who told us our KB page missed this; it is not under Known issues. Our KB pages now show it: https://senserva.com/kb/5127648.html

   Our data can be wrong. If unsure, check the source and tell us and we will look into it: https://senserva.com/contact.html?reason=kb

   Where to look:

   Microsoft's note, under Improvements, [Authentication]; the date is in the Change log at the end (expand it):

   Microsoft's guidance on the setting:

   Windows Server 2025 carries the same note: and https://senserva.com/kb/5126646.html

10. 2026-10-12

    Cyber Security News reports that a phishing campaign is abusing Microsoft Power BI to deliver rogue ScreenConnect installations and give attackers lasting remote access to Windows systems.

    For Microsoft 365 administrators, this means attackers are using Power BI as a vector to compromise endpoints. Review your Power BI usage logs and audit which users have accessed Power BI content recently, particularly any reports or dashboards from untrusted sources or arriving via email. Check whether any users have reported unusual Power BI links or invitations. Examine your Windows systems for unexpected ScreenConnect installations or remote access tool activity. Monitor Defender alerts for suspicious remote desktop protocol connections and unauthorized software installations on machines where Power BI users operate.

    https://senserva.com/security-dashboard.html

    ______________________________________________

    SOURCES

    Cyber Security News, 2026-10-12:
    Senserva tracking page: https://senserva.com/security-dashboard.html

11. 2026-10-08 CVE-2026-96940 KB5129955 KB5129956 KB5129957 KB5129958

    EXCHANGE SERVER: A SECURITY UPDATE MICROSOFT SHIPPED EARLY, AND THE OCTOBER ESU DEADLINE

    On October 2 Microsoft released the September 2026 V2 security updates for on-premises Exchange Server. The Exchange team's release post says the difference from the original September release "is an addition of CVE-2026-96940", and that this update "was published ahead of its intended schedule." The V2 updates are cumulative: each still carries the September fixes as well.

    WHAT THE FLAW DOES

    Microsoft's advisory for CVE-2026-96940 describes "Weak authorization in Microsoft Exchange Server" that "allows an authenticated attacker to elevate privileges over a network." Its FAQ says an attacker who succeeds "could gain unauthorized access to other users' mailboxes within the same organization and read email messages and attachments", and that "The vulnerability does not allow access across tenant boundaries." Microsoft rates it Important, CVSS 8.8.

    It is not being exploited, per the release post: "We identified the vulnerability internally and are not aware of active exploitation." It is not in the CISA Known Exploited Vulnerabilities catalog.

    WHO NEEDS IT

    - Exchange Server Subscription Edition RTM: KB5129955
    - Exchange Server 2019 CU15: KB5129956
    - Exchange Server 2019 CU14: KB5129957
    - Exchange Server 2016 CU23: KB5129958

    Exchange Online itself needs nothing. Microsoft's advisory says: "Exchange Online customers do not need to take any action to receive the fix." Any Exchange servers you still run do: the release post says the update "needs to be installed on your Exchange servers, even if they are used only for management purposes", and recommends installing it on "all servers and workstations running the Exchange Management Tools".

    WHAT MICROSOFT SAYS TO DO

    The release post: "We recommend that customers review the deployment guidance and apply the update at the earliest opportunity." If you are on a supported CU, Microsoft says to "simply install the latest SU." Its Exchange Server Health Checker script reports which servers are behind.

    Read the known issues for your version first. All four KB articles list one: a published calendar (.ics) returns HTTP 500 for calendar applications, which the release post says is "to be resolved in a future update". The Subscription Edition article, KB5129955, also lists a ContentEngine deadlock affecting customers with email in Korean, and a free/busy failure for delegated mailboxes in hybrid deployments that use Graph API only. The release post lists that free/busy item as resolved in this release, so Microsoft's two pages disagree on it.

    THE OCTOBER DEADLINE FOR EXCHANGE 2016 AND 2019

    Exchange 2016 and 2019 are out of support. Per the release post, only organizations enrolled in the Period 2 Extended Security Update program, "which is valid between May and October 2026", can get these updates; the 2016 and 2019 KB articles say enrolled organizations receive security updates "until the end of October 2026." For everyone else still on 2016 or 2019, Microsoft's recommendation is to "upgrade your organization to Exchange SE as soon as possible."

    Our pages for this update:
    https://senserva.com/cve/CVE-2026-96940.html
    https://senserva.com/kb/5129955.html

    October Patch Tuesday is next Tuesday, October 13.

12. 2026-09-29 CVE-2026-87902

    WORDPRESS CORE: EXPLOITED, PATCH NOW

    On September 22 WordPress released 7.1.2 to fix CVE-2026-87902. Every release from 4.7.0 through 7.1.1 is affected. The attacker needs no account on the site and no action from anyone who has one.

    The flaw is a path traversal in WordPress's page-template resolution. A crafted request can make WordPress load a readable .php file from outside the active theme folders. WordPress rates it CVSS 9.2. A risk for Remote Code Execution (RCE) is exposed through this vulnerability, making this a high value for exploitation.

    Exploitation began within hours of public disclosure, and SecurityWeek reported that it escalated to active compromises by September 23. The Hacker News reports attackers are using the flaw to include pearcmd.php and write PHP files to disk.

    CISA added it to its Known Exploited Vulnerabilities catalog on September 25, with a September 28 deadline for federal agencies.

    What the evidence does and does not establish: an unpatched version alone does not guarantee code execution. WordPress's advisory says RCE depends on whether "relevant pre-conditions for both the server environment and the active theme are met." Two things have to be true. The active child or parent theme contains a top-level directory whose name starts with page- (e.g., page-templates). And a chosen local .php target file exists on the server and is readable by the web server account. Don't read those conditions as a reason to wait. Common themes meet the first one, and attackers are already using a file that ships with many PHP installs to meet the second.

    The fixes, per WordPress: 7.1.2, 7.0.6, 6.9.9 and 6.8.10. The fix was also backported as a courtesy to all branches eligible for security fixes, currently through 4.7, but only the most recent version is actively supported.

    Here's what to do: if you run WordPress, confirm the version on every site now. Don't assume auto-updates applied it. WordPress's release notes say "it is recommended that you update your sites immediately." If a site was unpatched and reachable after September 22, check it for compromise as well as patching it. Look for PHP files on the server that you did not put there, and review web logs from September 22 onward.

    Senserva CVE page: https://senserva.com/cve/CVE-2026-87902.html
    Non-Microsoft CVE tracker: https://senserva.com/non-microsoft-cve-tracker.html
    WordPress advisory:
    SecurityWeek:
    The Hacker News:
    Help Net Security:
    CISA's catalog:

The 58 alerts sent so far, newest first; the 12 most recent are printed here and the full table loads above them.