Microsoft has patched CVE-2026-68844, a heap-based buffer overflow in Windows Storage Spaces Controller rated CVSS 7.8 that lets authorized local attackers execute code. The fix ships in the September 2026 Patch Tuesday release covering nearly 1,000 vulnerabilities, with exploitation considered less likely.
The vulnerability allows an authorized attacker with low privileges to execute code locally on affected systems.
Exploitation is assessed as less likely, with no known public exploits or in-the-wild attacks reported.
Enterprise teams should treat this as routine Patch Tuesday hygiene given the low likelihood of exploitation, but verify Storage Spaces Controller usage on servers before deferring the update.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
A newly published CVE (CVE-2026-116199, assigned by VulnCheck on Oct 25) covers a flaw in Snipe-IT's Google SSO login. Versions before 8.6.3 didn't check whether an account was deactivated, so a former user whose Google account was still active could sign back in with their old permissions, including admin. It only applies when Google SSO is on and usernames are email addresses, and Snipe-IT says default installs aren't affected. The fix shipped in v8.6.3 on June 15, and the latest release is v8.8.3. VulnCheck scores it 9.2 Critical (CVSS 4.0) and 8.1 High (CVSS 3.1), while Snipe-IT's advisory rates it Moderate. It isn't in CISA's KEV catalog, and no public exploit or attacks have been reported.
CISA has added CVE-2026-114625, a critical SQL injection bug in Arista VeloCloud Orchestrator, to its KEV catalog with an October 26 deadline. Fixed releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12.
CISA added CVE-2026-110447, an OS command injection flaw in Collabora Online's built-in CODE server used within Nextcloud, to its Known Exploited Vulnerabilities catalog on October 23. It allows remote code execution; federal agencies must mitigate by October 26 under BOD 26-04.
Oracle has patched CVE-2026-91241, a flaw in Oracle Business Intelligence Enterprise Edition that it rates 9.1 Critical under CVSS 3.1, in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. The fix shipped in Oracle's October 2026 Critical Patch Update, and Oracle urges customers to apply it promptly.
Oracle's Security Alert for CVE-2026-114820, rated CVSS 9.1, removes four eMudhra-linked root CA certificates from Java SE and GraalVM; Oracle lists it under JSSE, but the fix is a trust-store change.
