Microsoft confirmed active exploitation of a Windows Shell command-injection bug within days of its October release, affecting both familiar desktop estates and long-lived server fleets. At the same time, mail gateways, routers, GitLab servers and virtualization control planes exposed paths from a network request to files, commands or full administrative control. October was distinctive for how often the first foothold was simply being able to reach the service.
Windows Shell command injection
CVE-2026-96951 is a command-injection flaw in Windows Shell, the component behind everyday shell and file-handling behaviour on Windows endpoints and servers. An unauthorised attacker can bypass a security feature over the network by getting specially constructed input processed; the supplied severity vector says user interaction is required, but no prior privileges are.
That combination matters because the affected list spans Windows 10 and 11 as well as Windows Server 2016, 2019, 2022 and 2025. Microsoft lists the issue as exploited in the wild, so this is not a case for waiting to see whether a proof of concept becomes operational. Microsoft published the fix in its October update material; teams should treat deployment across server and client rings as an active-incident priority, not merely routine patching.
Email gateways write files
Two of October’s highest-impact appliance flaws landed in the systems intended to inspect and control email before it reaches users. CVE-2026-104286 lets an unauthenticated remote attacker use crafted HTTP or HTTPS requests to traverse paths and write arbitrary files on Fortinet FortiMail. It affects several current 7.x and 8.x trains, plus all FortiMail 7.0 versions listed in the advisory. CISA added it to the Known Exploited Vulnerabilities catalog, making its perimeter position especially uncomfortable; Fortinet has issued remediation guidance and fixed releases.
Cisco Secure Email Gateway has a parallel problem in CVE-2026-76519, but the delivery route is the email stream itself. When its Advanced Malware Protection feature and file-reputation service are enabled, an unauthenticated attacker can send a crafted attachment that causes an arbitrary file write. Cisco says that can lead to commands executed as root on the appliance. Cisco published an advisory and software fixes; there is no exploitation or public proof-of-concept status in the material provided.
These are not just messaging bugs. A compromised gateway sits at a privileged junction: it handles hostile content, often has broad network reach, and is frequently exposed for mail delivery and administration. The fact that one flaw is KEV-listed should prompt a review of both products’ external exposure, not just a search for FortiMail.
GitLab CI server execution
CVE-2026-97229 is a particularly consequential boundary failure for organisations that run their own GitLab Community or Enterprise Edition. Insufficient validation of a specially crafted regular expression in CI/CD configuration can trigger an integer overflow or wraparound and allow an unauthenticated user to execute arbitrary code on the GitLab server. In practical terms, a service built to orchestrate source, pipelines and deployment credentials can become the execution point.
GitLab remediated affected versions before 19.2.8, 19.3.5 and 19.4.2. The related CVE-2026-110264 and BIT-gitlab-2026-110264 describe the same release or underlying issue among the associated advisories, a useful reminder to correlate fixes rather than ticking off identifiers one by one. The supplied material does not report exploitation in the wild or a public proof of concept. That should not lower the urgency: unauthenticated server-side execution on development infrastructure is enough on its own.
Nutanix Prism admin bypass
CVE-2026-84731 turns a crafted internal-management HTTP header into a bypass for Prism Element’s authentication filters in Nutanix AOS. An unauthenticated remote attacker can obtain a session cookie whose JWT grants maximum cluster-administrator privileges, then run root-level commands across the cluster’s Controller VMs. That can expose VM memory and virtual disks or destroy the cluster outright.
This is a control-plane compromise, not a narrow guest-VM issue. Nutanix published an advisory and AOS update information; the supplied details do not identify active exploitation or a public proof of concept. Still, any Prism Element reachable through an alternate management route deserves immediate scrutiny, because the flaw is specifically about an internal route being trusted when it should not be.
Perimeter systems lost their assumptions
The month’s strongest cluster was in appliances and management planes: FortiMail and Cisco’s gateway flaws allow unauthenticated file writes, while CVE-2026-84411 puts MikroTik RouterOS web management at risk of a single pre-authentication request that can yield root code execution or denial of service. MikroTik has made updates available, and CISA published an ICS advisory; the supplied information does not mark it as exploited or provide a public proof of concept.
That pattern extends beyond the ranked entries. The wider pool included unauthenticated control-plane issues such as CVE-2026-76268, CVE-2026-105944, CVE-2026-110130 and CVE-2026-62253. The recurring failure was not sophisticated post-compromise manoeuvring but alternate paths into administrative APIs that did not enforce the boundary operators thought they had.
Memory safety remained the other dependable route in. Apache HTTP Server’s HTTP/2 module has a use-after-free and wild-write issue in CVE-2026-57941, affecting versions through 2.4.68; Apache issued fixes, including related release issues CVE-2026-59797 and CVE-2026-56154. Android’s CVE-2026-55330 is a zero-click Bluetooth use-after-free capable of remote code execution without extra privileges, addressed in October’s Android security material. Neither entry is marked exploited or accompanied by a public proof of concept in the supplied data, but both show why protocol and content parsers remain high-value attack surfaces.
October added up to a simple priority order: patch the externally reachable mail, routing and management systems first, then move quickly on actively exploited Windows. Inventorying which administrative interfaces are actually exposed is the useful follow-through; SecAlerts monitors an organisation’s actual software stack and alerts on new vulnerabilities affecting the products it runs, so teams can focus on the issues that apply rather than sift the whole month’s list.
