#Patch Tuesday
All CosmicBytez Labs articles tagged #Patch Tuesday, across news, security advisories, how-to guides, and projects.
- News
Microsoft Patches Two Dozen RCE Flaws in Office, Including Zero-Click Outlook Bugs
Microsoft's October Office update fixes 24 critical RCE flaws, including five zero-click Outlook Reading Pane bugs rated CVSS 9.8.
- News
Microsoft Drops an Actively Exploited Zero-Day Among Record High of 1,413 Vulnerabilities
Microsoft patched a record 1,413 flaws in October, including an actively exploited Windows Shell zero-day that bypasses Mark of the Web warnings.
- News
Adobe Patches 176 Vulnerabilities Across 11 Products
Adobe's October 2026 update fixes 176 flaws across AEM, ColdFusion, Photoshop, and more, aided by AI-assisted vulnerability hunting.
- News
Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday
Microsoft's largest Patch Tuesday ever fixes 1,414 flaws, 78 critical, including an exploited Windows Shell zero-day and unauthenticated RCEs.
- Newsletter
Oct 13 Digest: Ivanti's VPN Root-Access Chain, Microsoft's Record Patch Tuesday, $93M Ledger Implant Heist
This week: an Ivanti zero-day chain gave root access to patched VPNs, Microsoft shipped a record Patch Tuesday, and a $93M Ledger hardware implant surfaced.
- News
Android's October 2026 Security Update Patches 25 Vulnerabilities, Including 7 Critical Bugs
Google's October 2026 Android patch level fixes 25 flaws across Framework and System, with seven rated critical and none exploited in the wild.
- News
Citrix Confirms Two NetScaler RCE Zero-Days, Ships Patches as CVE-2026-88771 and CVE-2026-88772
Citrix confirmed and patched two exploited NetScaler RCE zero-days watchTowr warned about a day earlier — August's fixed builds remain vulnerable.
- News
Microsoft: September 2026 Updates Break Windows File History Backup
September's cumulative updates broke File History across Windows 10 and 11, with backups failing silently and no fix yet available.
- News
SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE
CVE-2026-28326 (CVSS 8.8) is a hard-coded static key in SolarWinds Access Rights Manager, patched in ARM 2026.2.1.
- News
Microsoft Fixes Broken Copy-and-Paste for Excel 2016 Users
KB5002914 broke copy-paste, autofill, and formula dragging in Excel; Microsoft's KB5002655 fixes it for MSI-based Office 2016, other versions still pending.
- News
Microsoft: September Updates Cause RDS Failures on Windows Server
Microsoft confirms September 2026 updates cause RDS/RDP failures on Windows Server 2019, 2022, and 2025, and has published workarounds for admins.
- News
Microsoft Fixes Teams and Outlook Launch Failures on ARM Windows PCs
A bug tied to August's security updates broke Teams and new Outlook on ARM devices like Surface Pro 11; September's Patch Tuesday fixes it.
- News
Adobe's September 2026 Patch Tuesday Fixes 170+ Flaws Across Experience Manager, ColdFusion & More
Adobe patched over 170 vulnerabilities this cycle, led by 107 in Experience Manager and critical RCEs in ColdFusion and Campaign Classic.
- News
Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
September's Patch Tuesday breaks records with 974 CVEs fixed, including two actively exploited Windows zero-days now on CISA's KEV catalog.
- News
Microsoft Blames August 2026 Windows Gaming Crashes on RGB Lighting Devices
Microsoft says August 2026 Patch Tuesday updates are causing games to crash or fail to launch due to conflicts with RGB lighting peripheral software.
- News
Microsoft's Patch Tuesday Deluge Continues With August 2026 Updates
Microsoft's August 2026 Patch Tuesday drops critical fixes including a CVSS 9.8 Windows DNS RCE requiring no user interaction.
- News
Adobe Patches Three CVSS 10.0 Flaws in ColdFusion and Campaign Classic
Adobe's August 2026 patch cycle fixes 3 maximum-severity RCE vulnerabilities across ColdFusion and Campaign Classic. Priority 1 — patch within 72 hours.
- News
Microsoft Patches LegacyHive Windows Zero-Day That Grants Admin Privileges
CVE-2026-62832 in Windows User Profile Service lets local users hijack registry hives and escalate to admin. Patch now via August Patch Tuesday.
- News
Microsoft Plugs Nearly 400 Security Holes in August 2026 Patch Tuesday
Microsoft's August 2026 Patch Tuesday addresses 398 CVEs including a WinSock zero-day actively exploited in the wild and two publicly disclosed flaws.
- Security
CVE-2026-68820: Windows WinSock Driver Use-After-Free Privilege Escalation
Actively exploited use-after-free in Windows afd.sys (WinSock driver) enables local privilege escalation to SYSTEM. CVSS 7.0. Patch immediately.
- News
Records Are Made to Be Broken: Patch Tuesday July 2026 Raises Triage Stakes
Microsoft's July 2026 Patch Tuesday set a new record with 622 CVEs addressed in a single release, including three actively exploited zero-days and more...
- News
Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday
Security researcher Chaotic Eclipse released LegacyHive, a proof-of-concept exploit for a Windows User Profile Service privilege escalation vulnerability,...
- Security
CVE-2026-56155: Microsoft AD FS Access Control Flaw Enables Golden SAML Attacks
Microsoft's July 2026 Patch Tuesday fixes CVE-2026-56155, an actively exploited privilege escalation flaw in Active Directory Federation Services....
- News
A Record-Breaking Patch Tuesday for June 2026
Microsoft's June 2026 Patch Tuesday addressed nearly 200 security vulnerabilities — the highest single-month patch count in the company's history —...
- News
Microsoft June 2026 Updates Break Recycle Bin Confirmation Prompts on All Windows Versions
A bug introduced by June 2026 security updates causes Windows to display internal $R filenames instead of original filenames in the Recycle Bin deletion...
- News
Microsoft Patches Exploited Exchange Server Vulnerability CVE-2026-42897
Microsoft has released a patch for CVE-2026-42897, an Exchange Server zero-day that has been under active exploitation since at least May 14, 2026. The...
- News
Microsoft Patches Record 206 Flaws Including Three Zero-Days and Critical RCE Bugs
Microsoft's June 2026 Patch Tuesday is the largest single release on record, fixing 206 vulnerabilities across its software portfolio — including three...
- News
Microsoft Patches YellowKey, GreenPlasma, and MiniPlasma Zero-Days
Microsoft's June 2026 Patch Tuesday fixes three actively exploited Windows zero-days: two SYSTEM privilege escalation flaws and a BitLocker bypass...
- News
Android June 2026 Update Patches Exploited Zero-Day and 123 Other Vulnerabilities
Google's June 2026 Android security bulletin addresses 124 vulnerabilities including CVE-2025-48595, an actively exploited zero-day used in limited targeted…
- News
Google Fixes One Actively Exploited Android Zero-Day, 124 Flaws in June 2026 Update
Google's June 2026 Android security update patches 124 vulnerabilities including one zero-day flaw that has been actively exploited in targeted attacks…
- News
Microsoft: Domain Controller Lookup May Fail on Windows
Microsoft has confirmed a new known issue affecting Windows Server 2016 systems where domain controller lookups fail after installing the KB5087537 May 2026.
- News
Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across
Microsoft has released updates fixing CVE-2026-45659, a CVSS 8.8 remote code execution vulnerability in SharePoint Server that requires no specialized.
- News
Microsoft Warns of New Defender Zero-Days Exploited in Attacks
Microsoft has issued emergency patches for two Windows Defender vulnerabilities that were actively exploited as zero-days before fixes were available....
- News
Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild
Microsoft has shared mitigations for CVE-2026-42897 until a permanent patch can be released for affected Exchange Server versions actively being targeted...
- News
Microsoft May 2026 Patch Tuesday: 137 Flaws Fixed, Zero
Microsoft's May 2026 Patch Tuesday addresses 137 vulnerabilities including nine critical flaws — but for the first time in two years, not a single...
- News
Microsoft May 2026 Patch Tuesday Fixes 120 Flaws, No
Microsoft's May 2026 Patch Tuesday delivers security updates for 120 vulnerabilities across Windows, Edge, Office, Azure, and more — with no zero-days...
- News
Microsoft Patches 138 Vulnerabilities Including DNS and Netlogon RCE Flaws
Microsoft's May 2026 Patch Tuesday addresses 138 security vulnerabilities across its product portfolio, including 30 rated Critical — with notable DNS...
- News
SAP Fixes Critical Vulnerabilities in Commerce Cloud and S/4HANA
SAP's May 2026 Security Patch Day addresses 15 vulnerabilities across multiple enterprise products, including two critical-severity flaws in Commerce...
- News
ThreatsDay Bulletin: Edge Plaintext Passwords, ICS 0-Days
This week's ThreatsDay threat roundup covers Microsoft Edge storing passwords in plaintext, industrial control system zero-days under active exploitation,...
- News
cPanel & WHM Release Fixes for Three New Vulnerabilities
cPanel has released security updates addressing three vulnerabilities in cPanel and Web Host Manager (WHM), including flaws enabling privilege escalation,...
- News
CISA Gives Federal Agencies Four Days to Patch Actively
CISA has added a high-severity Ivanti Endpoint Manager Mobile vulnerability to the Known Exploited Vulnerabilities catalog and issued an emergency...
- News
Microsoft Patch Tuesday, March 2026 Edition
Microsoft patched 77 security vulnerabilities in March 2026 with no actively exploited zero-days, a welcome reprieve following February's five-zero-day...
- News
Patch Tuesday, April 2026 Edition
Microsoft released patches for 167 security vulnerabilities in April 2026, including an actively exploited SharePoint Server zero-day and the publicly...
- News
CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal
CISA has added four actively exploited vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers to its Known...
- News
Microsoft Releases Emergency Updates to Fix Windows Server
Microsoft released out-of-band updates to address critical issues affecting Windows Server systems that emerged after the installation of April 2026 Patch...
- News
Microsoft Drops Its Second-Largest Monthly Patch Batch on Record
Microsoft's April 2026 Patch Tuesday addressed 169 CVEs — the second-largest monthly update in company history — including one actively exploited...
- News
Microsoft Issues Patches for SharePoint Zero-Day and 168
Microsoft's April 2026 Patch Tuesday addresses a record 169 security vulnerabilities including a SharePoint zero-day actively exploited in the wild, 8...
- News
Fortinet FortiClient EMS Zero-Day CVE-2026-35616 Actively
A critical zero-day in FortiClient EMS with a CVSS score of 9.8 is being actively exploited in the wild while Fortinet has released only an emergency...
- News
Cisco Patches Critical and High-Severity Vulnerabilities
Cisco has released security advisories addressing a batch of critical and high-severity vulnerabilities across multiple products, covering flaws that...
- News
Google Fixes Fourth Chrome Zero-Day Exploited in Attacks in 2026
Google has patched the fourth Chrome zero-day vulnerability actively exploited in attacks this year, a use-after-free flaw in the Dawn graphics engine...
- News
Citrix Urges Admins to Patch NetScaler Flaws as Soon as
Citrix has patched two NetScaler ADC and Gateway vulnerabilities — including a critical CVSS 9.3 out-of-bounds read flaw eerily similar to the previously...
- News
Windows 11 February Update Breaks C:\ Drive Access on Samsung PCs
Microsoft is investigating a new bug affecting Samsung laptops after the February 2026 security update — some users are unable to access their C: drive...
- News
Microsoft Releases Windows 11 OOB Hotpatch to Fix Three
Microsoft has pushed an out-of-band hotpatch (KB5084597) to Windows 11 Enterprise devices to address three integer-overflow RCE flaws in RRAS, one rated...
- News
Veeam Patches Five Critical RCE Vulnerabilities Exposing
Veeam Software has released a critical security update for Backup & Replication, patching five remote code execution vulnerabilities with CVSS scores...
- News
Android March 2026 Security Update Patches 129
Google's March 2026 Android security bulletin addresses 129 vulnerabilities, including CVE-2026-21385 — an actively exploited zero-day in a Qualcomm...
- Security
Microsoft February 2026 Patch Tuesday Fixes Six Actively
Microsoft's February 2026 Patch Tuesday addresses roughly 60 vulnerabilities including six actively exploited zero-days across Windows, Office, and Azure...
- Security
Microsoft Patch Tuesday February 2026: 6 Actively Exploited
Microsoft's February 2026 Patch Tuesday addresses 60 vulnerabilities including 6 actively exploited zero-days and 3 publicly disclosed issues, with...
- News
Cisco Patches Critical Webex Vulnerability Allowing Remote
Cisco has released emergency patches for a critical vulnerability in Webex that could allow unauthenticated remote code execution. Organizations urged to...
- Security
Microsoft January 2026 Patch Tuesday: 114 Flaws Fixed, One
Microsoft's first security update of 2026 addresses 114 vulnerabilities including three zero-days. One flaw is actively exploited in the wild with CISA...