Security Alert, Week of October 20, 2026: Actively Exploited Flaws to Patch
Which security flaws are being actively exploited this week?
In the week to October 20, 2026, the U.S. Cybersecurity and Infrastructure Security Agency added 5 vulnerabilities in products small businesses commonly use to its list of flaws attackers are actively exploiting, affecting Firewalls and VPN appliances; Windows and Microsoft 365. If you run any of them, apply the vendor’s update this week.
What are the actively exploited flaws, and who is affected?
CISA’s Known Exploited Vulnerabilities catalog lists flaws with confirmed attacks in the wild. These are the additions from the past seven days in products a small business is likely to run:
| Product | Flaw | Added |
|---|---|---|
| Ivanti Connect Secure | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CVE-2026-104935). | 2026-10-13 |
| Microsoft Windows | Microsoft Windows Command Injection Vulnerability (CVE-2026-96951). | 2026-10-13 |
| Cisco Secure Email Gateway | Cisco Secure Email Gateway Relative Path Traversal Vulnerability (CVE-2026-76519). | 2026-10-14 |
| Palo Alto Networks PAN-OS | Palo Alto Networks PAN-OS Code Injection Vulnerability (CVE-2026-0322). | 2026-10-14 |
| Fortinet Multiple Products | Fortinet Multiple Products Path Traversal Vulnerability (CVE-2025-61624). | 2026-10-16 |
Does this affect my business?
- Firewalls and VPN appliances: If your office firewall or remote-access VPN is one of these brands, it is the most urgent item here: these devices face the internet, and attackers scan for unpatched ones within days. Check the firmware version, not just whether the device is working.
- Windows and Microsoft 365: Every Windows PC needs this month’s updates. Check that they actually installed: a PC that has not restarted in weeks usually has not finished updating.
Which Microsoft deadlines are coming up?
- Windows 11 24H2 and Office 2021, this Patch Tuesday. This month’s updates are the last either one gets. Office 2021 bought outright (Home and Business, Professional) gets no more fixes, so any flaw found in it from now on stays open. Windows needs the free update to 25H2: how to check and update.
- OneDrive and SharePoint sharing, mid-October to the end of November. Outside people opening older links you shared with them will get “access denied” until they have a guest account. The one-step fix.
- Copier scan to email, end of December. Microsoft 365 switches off the password sign-in most copiers use to send scans. How to check your copier and four fixes.
What should a small business do this week?
- Confirm updates installed on every PC, including laptops that are rarely in the office.
- Restart computers and browsers so pending updates finish.
- Check your firewall and VPN firmware against the vendor’s latest version.
- Make sure multi-factor authentication is on for email and remote access, so a single exploited flaw or stolen password is not enough.
- Know when your backup was last restored from, not just whether it ran.
For the businesses we manage, this is handled centrally: updates are pushed and verified overnight. More on how that works: managed endpoint protection and patching, network security, the Windows 11 24H2 end-of-support deadline.
Catch up with the previous alert, October 2026 Patch Tuesday: What Small Businesses Should Patch Now, or all weekly security alerts.
Want This Handled for You?
iTech Plus provides managed IT and cybersecurity for small businesses and medical practices across Polk County, including Lakeland, Winter Haven, Davenport and Haines City. If you are not sure your computers and firewall are patched, we offer a free IT assessment with a written report. Call (321) 221-7117 or email info@itechplus.co.
