Friday, October 16, 2026

SharePoint Online Custom Forms Broken — Ongoing M365 Incident

Microsoft has confirmed an ongoing incident where users cannot view or modify custom forms in SharePoint Online. No ETA for resolution has been published; affected organisations should use direct list views as a workaround while Microsoft investigates.

Ivanti Connect Secure Zero-Day Chain CVE-2026-104935 Grants Attackers Root on Fully Patched VPN

A zero-day exploit chain targeting Ivanti Connect Secure, tracked as CVE-2026-104935, enables unauthenticated remote code execution and has been observed granting root access even on fully patched appliances. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog. Organisations running Ivanti Connect Secure should apply available patches immediately and audit for signs of compromise.

Microsoft QUIC Heap Buffer Overflow CVE-2026-105016 Scores CVSS 9.8

Security researchers have flagged CVE-2026-105016, a heap-based buffer overflow RCE flaw in Microsoft QUIC, as a top priority in this month's Patch Tuesday with a CVSS score of 9.8. Although not yet confirmed exploited in the wild, its critical score and network-level attack vector make it a high-priority patch this cycle. Include in emergency patching alongside CVE-2026-96951.

.NET Framework Security Feature Bypass CVE-2026-108398 Publicly Disclosed — Patch Before Exploitation

CVE-2026-108398 is a publicly disclosed security feature bypass in the .NET Framework that can be exploited to run unauthorised applications locally; technical details are already public though Microsoft has not yet observed active attacks. MSPs managing .NET-dependent LOB applications should prioritise patching ahead of anticipated exploitation.

Palo Alto PAN-OS CVE-2026-0322 Actively Exploited — CISA KEV Deadline October 17

Palo Alto Networks confirmed on October 14–15, 2026 that CVE-2026-0322 (CVSS 8.6), an authenticated RCE vulnerability in the PAN-OS management interface, is under active exploitation, allowing attackers to execute arbitrary code with root privileges on PA-Series, VM-Series, and Panorama appliances. CISA added it to its KEV catalog with a federal remediation deadline of October 17, 2026. Fixed releases are available for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2; no workaround exists, but restricting management interface access to trusted IPs reduces exposure.

SonicWall SMA 1000 CVE-2026-102255 (CVSS 10.0) Under Active Exploitation — 135+ Attempts Logged

Threat actors began exploiting CVE-2026-102255, a pre-authentication SSRF flaw in SonicWall SMA 1000 appliances scoring a perfect CVSS 10.0, within just two days of public disclosure on October 6, 2026. Over 135 exploitation attempts have been logged against honeypots, with attacks targeting 6210, 7210, and 8200v models. Upgrade immediately to firmware versions 12.5.0-03082 or 12.4.3-03670; no workaround exists.

SonicWall SMA 1000 CVE-2026-102255 (CVSS 10.0) Targeted in 135+ Exploitation Attempts Within Days of Disclosure

Threat actors have been observed exploiting CVE-2026-102255, a pre-authenticated server-side request forgery (SSRF) flaw in SonicWall Secure Mobile Access 1000 appliances scored at CVSS 10.0, within days of public disclosure. The flaw allows a remote attacker to direct the appliance to issue requests on their behalf and access internal functionality. SonicWall patches are available; upgrade immediately and restrict SMA management access.

Cisco Patches 12+ Critical Vulnerabilities Including Meraki RCE and DoS Flaws

On 8 October 2026, Cisco patched 35 vulnerabilities across its product line including over a dozen critical-severity bugs. Key issues include CVE-2026-76471 and CVE-2026-76465 in Meraki, which allow remote unauthenticated attackers to execute arbitrary code with root privileges or cause denial-of-service conditions. Apply Cisco's October security bundle across Meraki, Finesse, and associated products.

Atera's 'Robin' AI Agent Claims Autonomous Resolution of Tier-1 MSP Tickets Around the Clock

Atera has rebranded its platform positioning around 'Autonomous IT', with Robin — its AI agent — now able to take an end-user complaint, run diagnostics, and execute a fix end-to-end without technician involvement for qualifying Tier-1 issues. The platform's IT Autopilot is cited as resolving up to 40% of routine tasks autonomously, covering password resets, software deployments, and common troubleshooting. MSPs evaluating AI-driven ticket deflection should assess Robin alongside competing agents such as SuperOps Monica, Rallied, and Neo Agent.

Rewst Continues to Lead MSP Orchestration: Cross-Stack Automation Now on Pax8 Marketplace

Rewst, the workflow orchestration platform built for MSPs, is gaining channel traction with its visual automation builder, pre-built 'Crates' for common MSP tasks, and RoboRewsty AI assistant for workflow creation. Separately, Pia — another MSP automation tool featuring AI Ticket Triage, AutoStart, and AutoClose — is now available on the Pax8 marketplace, reducing procurement friction for Australian MSPs. Both platforms target repeatable multi-step tasks rather than simple ticket summarisation.

Windows Server 2012/2012 R2 Extended Security Updates End This Week — Final Patch Deadline

The third and final year of Extended Security Updates (ESU) for Windows Server 2012 and Windows Server 2012 R2 expires this week in October 2026, meaning these platforms will receive no further security patches from Microsoft. MSPs with clients still running these operating systems face immediate security and compliance risk and should accelerate migration to Windows Server 2022 or 2025, or move workloads to Azure for continued ESU coverage. There is no further extension option.