Security Digest: October 14, 2026 - 121 Critical Vulnerabilities

Today’s patch wave is dominated by multiple network-exploitable Windows flaws, plus high-risk issues in Adobe Commerce, ASP.NET Core, SharePoint, Exchange, and several third-party platforms. The most urgent risks are unauthenticated remote code execution, authentication bypass, and privilege escalation—meaning exposed systems should be patched first, with internet-facing services and identity infrastructure at the front of the line.

· 18 min read

Security Digest: October 14, 2026 — 121 Critical Vulnerabilities

Executive Summary

Today’s patch wave is dominated by multiple network-exploitable Windows flaws, plus high-risk issues in Adobe Commerce, ASP.NET Core, SharePoint, Exchange, and several third-party platforms. The most urgent risks are unauthenticated remote code execution, authentication bypass, and privilege escalation—meaning exposed systems should be patched first, with internet-facing services and identity infrastructure at the front of the line.

Act now: prioritize emergency patching for externally reachable servers, then move to internal services that can be reached by authenticated users. If you cannot patch immediately, isolate or disable the affected service, restrict access, and increase monitoring for exploitation attempts.

Critical Vulnerabilities

  • CVE-2026-110130: Dockhand authentication bypass to account takeover
    • Impact: Unauthenticated attackers can reset passwords and take over admin or user accounts.
    • Affected Systems: Dockhand before 1.0.45.
    • Immediate Action: Patch immediately and review all recent password resets and account changes.
    • Mitigation: Upgrade to 1.0.45 or later; temporarily restrict access to Dockhand if patching is delayed.
  • CVE-2026-103849: Adobe Commerce template injection RCE
    • Impact: Attackers may execute code without user interaction and gain control of sessions or accounts.
    • Affected Systems: Adobe Commerce.
    • Immediate Action: Apply vendor fixes urgently on all storefront and admin instances.
    • Mitigation: Patch now; reduce exposure of admin panels and review for suspicious template changes.
  • CVE-2026-70096: Windows Rich Text Edit Control buffer overflow
    • Impact: Remote attackers may execute code over the network.
    • Affected Systems: Microsoft Windows components using Rich Text Edit Control.
    • Immediate Action: Expedite Patch Tuesday updates on endpoints and servers.
    • Mitigation: Apply the latest Windows security updates; isolate high-risk systems until patched.
  • CVE-2026-70147: Microsoft PostScript Printer Driver buffer overflow
    • Impact: Remote code execution over the network.
    • Affected Systems: Windows systems with the PostScript Printer Driver.
    • Immediate Action: Patch print servers and workstations first.
    • Mitigation: Update Windows; disable unnecessary printer exposure where possible.
  • CVE-2026-100222: Network Policy Server buffer overflow
    • Impact: Remote attackers may execute code.
    • Affected Systems: Microsoft NPS.
    • Immediate Action: Patch NPS servers immediately.
    • Mitigation: Apply Microsoft updates; restrict network access to NPS.
  • CVE-2026-83869: DNS Server integer underflow
    • Impact: Remote code execution on DNS servers.
    • Affected Systems: Microsoft DNS Server.
    • Immediate Action: Treat as emergency if DNS is internet-facing or mission-critical.
    • Mitigation: Patch immediately; monitor for abnormal DNS activity.
  • CVE-2026-83862: Windows Network Load Balancing use-after-free
    • Impact: Remote code execution.
    • Affected Systems: Windows NLB deployments.
    • Immediate Action: Patch clustered and load-balanced hosts first.
    • Mitigation: Apply updates; reduce exposure to untrusted network traffic.
  • CVE-2026-102210: Windows Text Shaping buffer overflow
    • Impact: Remote code execution.
    • Affected Systems: Windows systems with Text Shaping components.
    • Immediate Action: Patch all managed Windows devices.
    • Mitigation: Install Microsoft updates; prioritize user-facing systems.
  • CVE-2026-83780: Windows CCFFilter Driver use-after-free
    • Impact: Remote code execution.
    • Affected Systems: Windows systems with CCFFilter Driver.
    • Immediate Action: Patch immediately on servers and endpoints.
    • Mitigation: Apply vendor updates; watch for unusual driver crashes.
  • CVE-2026-70157: Windows System Information Console buffer overflow
    • Impact: Remote code execution.
    • Affected Systems: Windows systems using the System Information Console.
    • Immediate Action: Patch all Windows hosts.
    • Mitigation: Install the latest cumulative update.
  • CVE-2026-70153: Microsoft PostScript Printer Driver buffer overflow
    • Impact: Remote code execution.
    • Affected Systems: Windows printing environments.
    • Immediate Action: Patch print infrastructure immediately.
    • Mitigation: Update Windows and limit printer service exposure.
  • CVE-2026-83693: Windows Error Reporting buffer overflow
    • Impact: Remote code execution.
    • Affected Systems: Windows Error Reporting component.
    • Immediate Action: Patch endpoints and servers.
    • Mitigation: Apply Microsoft updates; monitor for crash-report anomalies.
  • CVE-2026-83770: Windows Text Shaping buffer overflow
    • Impact: Remote code execution.
    • Affected Systems: Windows Text Shaping.
    • Immediate Action: Patch now.
    • Mitigation: Update Windows; isolate untrusted document workflows.
  • CVE-2026-83782: Windows Shell buffer overflow
    • Impact: Remote code execution.
    • Affected Systems: Windows Shell.
    • Immediate Action: Patch all Windows systems.
    • Mitigation: Apply security updates without delay.
  • CVE-2026-83748: Windows Error Reporting buffer overflow
    • Impact: Remote code execution.
    • Affected Systems: Windows Error Reporting.
    • Immediate Action: Patch immediately.
    • Mitigation: Install latest Windows fixes.
  • CVE-2026-83519: Windows Error Reporting buffer overflow
    • Impact: Remote code execution.
    • Affected Systems: Windows Error Reporting.
    • Immediate Action: Patch immediately.
    • Mitigation: Install latest Windows fixes.
  • CVE-2026-105010: Windows Search Component use-after-free
    • Impact: Remote attackers may elevate privileges.
    • Affected Systems: Microsoft Windows Search Component.
    • Immediate Action: Patch endpoints and servers using Windows Search features.
    • Mitigation: Apply Microsoft updates; monitor for suspicious search-index activity.
  • CVE-2026-105016: Microsoft QUIC buffer overflow
    • Impact: Remote code execution.
    • Affected Systems: Microsoft QUIC.
    • Immediate Action: Patch internet-facing services first.
    • Mitigation: Update Windows and reduce QUIC exposure where feasible.
  • CVE-2026-83517: Windows Media Foundation buffer overflow
    • Impact: Remote code execution.
    • Affected Systems: Windows Media Foundation.
    • Immediate Action: Patch all Windows systems.
    • Mitigation: Apply the latest OS updates.
  • CVE-2026-83578: Windows PowerShell integer underflow
    • Impact: Remote code execution.
    • Affected Systems: Windows PowerShell.
    • Immediate Action: Patch and restrict PowerShell usage on exposed systems.
    • Mitigation: Apply Microsoft updates; enforce constrained language mode where appropriate.
  • CVE-2026-83910: RPC Runtime out-of-bounds write
    • Impact: Remote code execution over the network.
    • Affected Systems: Windows RPC Runtime.
    • Immediate Action: Treat as high priority on all networked Windows systems.
    • Mitigation: Patch immediately and monitor RPC traffic.
  • CVE-2026-70300: Microsoft Office Word untrusted pointer dereference
    • Impact: Remote code execution.
    • Affected Systems: Microsoft Word.
    • Immediate Action: Patch Office clients and isolate risky document handling.
    • Mitigation: Deploy Office updates; block untrusted documents where possible.
  • CVE-2026-70291: Microsoft Office Outlook buffer overflow
    • Impact: Remote code execution.
    • Affected Systems: Microsoft Outlook.
    • Immediate Action: Patch mail clients immediately.
    • Mitigation: Update Office; keep preview panes and auto-open features restricted.
  • CVE-2026-69634: Windows iSCSI buffer overflow
    • Impact: Remote code execution.
    • Affected Systems: Windows iSCSI.
    • Immediate Action: Patch storage hosts first.
    • Mitigation: Update Windows and limit iSCSI network exposure.
  • CVE-2026-69639: Windows Libarchive buffer overflow
    • Impact: Remote code execution.
    • Affected Systems: Windows Libarchive.
    • Immediate Action: Patch systems that process archives.
    • Mitigation: Apply Windows updates; restrict untrusted archive handling.
  • CVE-2026-69705: Windows iSCSI out-of-bounds write
    • Impact: Remote code execution.
    • Affected Systems: Windows iSCSI.
    • Immediate Action: Patch storage and virtualization hosts now.
    • Mitigation: Update Windows; monitor storage traffic.
  • CVE-2026-100219: Microsoft QUIC use-after-free
    • Impact: Remote code execution.
    • Affected Systems: Microsoft QUIC.
    • Immediate Action: Patch immediately.
    • Mitigation: Apply Microsoft updates and review network exposure.
  • CVE-2026-69883: Windows iSCSI use-after-free
    • Impact: Remote code execution.
    • Affected Systems: Windows iSCSI.
    • Immediate Action: Patch storage infrastructure first.
    • Mitigation: Update Windows and restrict access to trusted networks.
  • CVE-2026-69886: Windows Imaging Component buffer overflow
    • Impact: Remote code execution.
    • Affected Systems: Windows Imaging Component.
    • Immediate Action: Patch all endpoints and servers.
    • Mitigation: Apply OS updates; limit untrusted image processing.
  • CVE-2026-70242: Microsoft Office Outlook buffer overflow
    • Impact: Remote code execution.
    • Affected Systems: Microsoft Outlook.
    • Immediate Action: Patch immediately.
    • Mitigation: Update Office and restrict risky email content.
  • CVE-2026-70024: Windows IIS stack buffer overflow
    • Impact: Remote code execution on web servers.
    • Affected Systems: Windows Internet Information Services.
    • Immediate Action: Patch internet-facing IIS servers immediately.
    • Mitigation: Apply Microsoft updates; review web logs for exploit attempts.
  • CVE-2026-70279: Exchange Server XSS spoofing
    • Impact: Attackers may spoof content and steal sessions through crafted requests.
    • Affected Systems: Microsoft Exchange Server.
    • Immediate Action: Patch Exchange and review exposed web endpoints.
    • Mitigation: Apply vendor fixes and tighten email/web access controls.
  • CVE-2026-100133: Adobe Commerce stored XSS
    • Impact: Malicious scripts can run in victims’ browsers and steal sessions.
    • Affected Systems: Adobe Commerce.
    • Immediate Action: Patch and sanitize user-facing form fields now.
    • Mitigation: Deploy Adobe fixes; inspect for injected scripts.
  • CVE-2026-70188: ASP.NET Core request smuggling
    • Impact: Attackers may bypass security controls over the network.
    • Affected Systems: ASP.NET Core.
    • Immediate Action: Patch application servers and reverse proxies together.
    • Mitigation: Apply framework updates; validate proxy and backend parsing consistency.
  • CVE-2026-105008: Windows Schannel spoofing
    • Impact: Remote attackers may spoof trusted connections.
    • Affected Systems: Windows Schannel.
    • Immediate Action: Patch TLS-reliant systems urgently.
    • Mitigation: Install Microsoft updates and review certificate trust paths.

Additional critical and high-severity issues affect SharePoint, Exchange, AD FS, AD CS, DNS, DHCP, SMB, WSUS, NDES, NLB, Windows Kernel, Win32K, SmartScreen, ReFS, MDM, IIS, RPC, .NET, Visual Studio, and Windows drivers/components. Many are remote code execution or privilege escalation flaws that can be chained into full domain compromise.

Previously Alerted

What to Do Now

  1. Patch internet-facing systems first: Adobe Commerce, Exchange, SharePoint, IIS, DNS, NPS, AD FS, and any exposed Windows servers.
  2. Push emergency Windows updates across servers, endpoints, and VDI; prioritize mail, identity, print, and storage systems.
  3. Lock down admin access to Dockhand, Wukong AICRM, youlai-boot, Rapyd Admin, and similar internal tools until patched.
  4. Verify exposure by checking whether the affected services are reachable from the internet or from low-trust internal networks.
  5. Review logs now for unusual password resets, account changes, admin role grants, template edits, web-shell activity, and unexpected outbound connections.
  6. Isolate unpatched critical hosts if patching will take time, especially DNS, Exchange, IIS, and identity servers.

Verification steps:

  • Confirm patch levels against vendor advisories and your asset inventory.
  • Check for failed logins, new admins, privilege changes, and suspicious service restarts.
  • Scan for exposed management interfaces and legacy endpoints that should be disabled.

Monitoring recommendations:

  • Increase alerting on authentication anomalies, webhook/admin API calls, and unusual file or template changes.
  • Watch for PowerShell, IIS, Exchange, and RPC abuse patterns.
  • Correlate endpoint detections with network logs for signs of lateral movement or post-exploitation activity.

Related Resources

  • Internal analysis: Microsoft October 2026 Patch Triage (coming soon)
  • Internal analysis: Adobe Commerce Emergency Hardening Guide (coming soon)
  • Official vendor advisories: Microsoft Security Update Guide, Adobe Security Bulletins, and ASP.NET Core release notes

Keep reading