⚡ THE ONE THING TODAY
Immediately audit your environment for Ivanti Connect Secure instances and begin vendor communication on CVE-2026-104935 mitigation; assume compromise until proven otherwise.
Microsoft Global Secure Access Outage Disrupts M365 in UK & Germany for ~11 Hours
On 13 October 2026, Microsoft 365 users in Germany and the UK accessing services via Global Secure Access (GSA) could not reach Outlook, Teams, OneDrive, SharePoint Online, and Windows 365 Cloud PCs for approximately 10 hours 51 minutes (07:40–18:31 UTC). Microsoft attributed the cause to a section of GSA infrastructure performing below acceptable performance thresholds, but no post-incident report or root-cause explanation had been published as of 14 October. Workaround: Route M365 traffic outside GSA/Entra Internet Access while the infrastructure is degraded.
SharePoint Server Elevation of Privilege (CVE-2026-102866) Publicly Disclosed Before Patch
October Patch Tuesday includes a fix for CVE-2026-102866, a high-severity elevation of privilege vulnerability in Microsoft Office SharePoint caused by improper verification of cryptographic signatures. An unauthenticated attacker could exploit the flaw over a network to gain elevated privileges on SharePoint Server Subscription Edition. The bug was publicly disclosed before Microsoft had a patch ready — apply the October SharePoint cumulative update immediately.
Power BI Dashboard Chart Rendering Bug — Ongoing Impact for Users with Light/Dark Themes
Microsoft is tracking an ongoing issue affecting Power BI users attempting to view data on Cartesian charts pinned to dashboards when standard light or dark themes are enabled. Microsoft indicated a new fix was targeting completion around 13 October 2026, with root cause details to follow. Workaround: temporarily switch affected dashboards to a non-standard theme or view reports directly rather than pinned dashboard tiles.
October 2026 Patch Tuesday: Record ~1,413 CVEs — Windows Shell Zero-Day Actively Exploited
Microsoft's October 2026 Patch Tuesday — the largest on record — patches approximately 1,413 CVEs including one actively exploited zero-day: CVE-2026-96951, a Windows Shell security feature bypass (CVSS 8.8) that lets attackers evade Mark of the Web (MotW) protections. It is the third Windows Shell flaw exploited in the wild in 2026. A second zero-day, CVE-2026-108398 (.NET Framework, CVSS 8.8), was publicly disclosed before the patch shipped. Apply October updates immediately; no standalone workaround exists for CVE-2026-96951.
CVE-2026-96951: Windows Shell MotW Bypass — Third Windows Shell Zero-Day Exploited in 2026
CVE-2026-96951 allows an unauthenticated attacker to bypass Windows Mark of the Web by exploiting how Windows Shell handles specially crafted commands, enabling malicious downloaded files to bypass Protected View and SmartScreen warnings. Microsoft has confirmed active exploitation in the wild. Prioritise patching Windows endpoints within 72 hours; restrict execution of untrusted files as a partial interim control.
Microsoft Exchange Server RCE (CVE-2026-70571, CVSS 8.1) Rated 'Exploitation More Likely'
October's Patch Tuesday also addresses CVE-2026-70571, a critical remote code execution vulnerability in Microsoft Exchange Server triggered when a vulnerable server processes a malicious email through its internal content-conversion pipeline. Rated CVSS 8.1 and assessed 'Exploitation More Likely' by Microsoft. MSPs managing on-prem or hybrid Exchange should apply the October cumulative update without delay.
Ivanti Connect Secure Zero-Day Chain (CVE-2026-104935) Gave Attackers Root on Fully Patched VPNs
A chained zero-day exploit targeting Ivanti Connect Secure, tracked as CVE-2026-104935, allowed unauthenticated remote code execution and full root access — even on devices reported as fully patched. The severity of the chain underscores the need for continuous integrity verification of Ivanti appliances beyond standard patching. Ivanti's ICT (Integrity Checker Tool) should be run immediately and appliances should be reset to factory defaults if compromise is suspected.
FortiSandbox Critical Auth-Bypass (CVE-2026-107656) Disclosed — Remote Attackers Can Access Protected GUI Functions
Fortinet disclosed a critical authentication-bypass vulnerability in the FortiSandbox graphical user interface (CVE-2026-107656), published 13 October 2026, that could allow remote attackers to access protected functions without valid credentials. The flaw affects the FortiSandbox GUI and represents a significant risk for environments using FortiSandbox in an internet-accessible configuration. Restrict GUI access to trusted management networks as an immediate workaround and apply Fortinet's patch.
This is what you get — free, in your inbox.
Subscribers also get the full “From the Floor” take with every issue — not just the summary you just read.
Written from 12 years on the helpdesk floor. Always free.