⚡ THE ONE THING TODAY
Immediately audit every Palo Alto, Cisco, Fortinet, and Ivanti device in your entire estate against today's nine CVE list and get patch timelines in writing from every client by EOD.
Exchange Server RCE CVE-2026-70571 and AD DS RCE CVE-2026-70229 Rated 'Exploitation More Likely'
October Patch Tuesday also addresses a critical unauthenticated Exchange Server RCE (CVE-2026-70571, CVSS 8.1) and an Active Directory Domain Services RCE (CVE-2026-70229), both rated 'Exploitation More Likely' by Microsoft. A separate Exchange spoofing vulnerability, CVE-2026-70279 (CVSS 9.3), can be triggered by a malicious link via social engineering. Organisations running on-premises Exchange or AD should apply October patches immediately and confirm no internet-exposed Exchange endpoints remain unpatched.
.NET Framework WDAC Bypass CVE-2026-108398 Publicly Disclosed Before Patch Shipped
CVE-2026-108398 is an untrusted-search-path flaw in .NET Framework that allows an attacker to place a crafted assembly on an endpoint and execute code inside a protected process, bypassing Windows Defender Application Control (WDAC). Technical details were public before Microsoft released the fix in October Patch Tuesday, raising the risk of rapid weaponisation. Patch all .NET Framework installations immediately; no supported workaround exists.
Palo Alto PAN-OS CVE-2026-0322 Actively Exploited — CISA KEV Deadline Was October 17
Palo Alto Networks confirmed on October 14, 2026 that CVE-2026-0322 (CVSS 8.6), a code injection flaw in the PAN-OS management interface, is under active attack, allowing an authenticated attacker with network access to execute arbitrary code as root. CISA added it to the KEV catalog on October 14 with a federal remediation deadline of October 17. Affected: PA-Series, VM-Series, and Panorama — patch to fixed releases (e.g. 10.2.18-h12) immediately and restrict management interface access to trusted IPs.
9 Actively Exploited Perimeter CVEs Confirmed This Week: Ivanti, Fortinet, Cisco, BeyondTrust Among Them
As of October 17, 2026, nine CVEs affecting perimeter and remote-access products from Ivanti Connect Secure, Palo Alto Networks PAN-OS, Fortinet FortiOS, Cisco Secure Email Gateway, and BeyondTrust Remote Support have confirmed active exploitation in the wild. MSPs should audit all internet-facing edge devices this week and restrict admin interface access where patches cannot be applied immediately. Confirm affected versions in each vendor's advisory before scheduling remediation.
Cisco Secure Email Gateway Zero-Day CVE-2026-76519 Allows Root-Level Arbitrary File Write
CISA is warning of active exploitation of CVE-2026-76519 in Cisco Secure Email Gateway, a critical vulnerability that allows an attacker to write arbitrary files and execute commands with root privileges on the underlying OS. Cisco has confirmed awareness of exploitation in the wild. Apply Cisco's security update immediately; as an interim control, restrict management access to the appliance to trusted internal IPs only.
Atera's 'Robin' AI Agent Offers 90-Day Performance Guarantee on Tier 1 & 2 Ticket Resolution
Atera's autonomous AI agent Robin now comes with a public 90-day performance guarantee: Atera commits to resolving 50% of Tier 1 and complex Tier 2 tickets autonomously, or waives fees. Robin takes end-user complaints, runs diagnostics, and executes fixes end-to-end without following a pre-built script. MSPs evaluating AI-driven L1 automation should consider this a meaningful commercial commitment that de-risks a pilot.
AI Agent Triage Accuracy Hits 96% Across 173M Tickets in Production — 2026 Benchmark Data
New 2026 production benchmarks show AI dispatch-and-triage agents achieving 96% triage accuracy across 173 million tickets, returning over 490,000 technician hours. Password resets alone account for 18% of Tier-1 ticket volume, with workflow automation tools returning 4–6 hours per technician per week. These figures provide MSPs with a concrete ROI framework when building the business case for agentic AI investment.
Windows Server 2012/2012 R2 Extended Security Updates End This Month — Final Patch Received
October 2026 Patch Tuesday marks the final ESU (Extended Security Updates) patches for Windows Server 2012 and 2012 R2, with the third and final year of ESU coverage ending this week. After this release, there will be no further security updates for these platforms. Australian MSPs with clients still running Server 2012/2012 R2 must urgently migrate or isolate these systems — no further patches or workarounds will be available from Microsoft.
ASD Open-Sources 'Azul' Malware Analysis Tool — Free Resource for Australian MSPs and MSSPs
On October 15, 2026, the Australian Signals Directorate (ASD/ACSC) open-sourced Azul, its malware analysis tool, publishing it to ASD's ACSC GitHub repository. Azul is designed to explore, analyse, and correlate malware at scale to enhance threat investigations. Australian MSPs and MSSPs providing SOC or IR services should evaluate Azul as a no-cost addition to their malware triage workflow.
This is what you get — free, in your inbox.
Subscribers also get the full “From the Floor” take with every issue — not just the summary you just read.
Written from 12 years on the helpdesk floor. Always free.