Patch management vulnerabilities in Exchange Server, Dell System Update, and LibreOffice are actively exploited by ransomware operators and state-sponsored groups to breach SMBs. Unpatched systems give attackers direct entry to administrator access, credential theft, and command-and-control channels that can paralyze operations for weeks.
In today's cybersecurity update for October 6th, 2026:
Microsoft issued an emergency update for Exchange Server to address CVE-2026-96940, a high-severity vulnerability (CVSS 8.8) that allows authenticated attackers to escalate privileges to administrator level. The flaw is caused by weak authorization and exploitation is considered likely. Organizations running Exchange Server should verify the update has been applied immediately.
Dell released critical security updates for Dell System Update (DSU) affecting versions before 2.3.0.0. The most severe vulnerability allows unauthenticated remote attackers to execute code with root privileges. Dell published advisory DSA-2026-324 on October 1st urging immediate upgrades.
The FBI terminated an Accenture contractor following a data breach that exposed sensitive information of thousands of FBI employees. The breach resulted from a failure to apply a critical patch to an HR platform, demonstrating how third-party vendor security failures directly impact organizations.
A Gentlemen ransomware affiliate used an AI coding assistant's Model Context Protocol (MCP) as a command-and-control channel during live cyberattacks. The operator, known as Azazel, used stolen developer credentials to access the system and conducted attacks against over two dozen organizations across six countries in logistics, insurance, and pharmaceutical sectors.
The Midnight Blizzard threat group is exploiting hotel Wi-Fi captive portals in a campaign called CaptiveCrunch to deliver malware and steal credentials from travelers, potentially compromising corporate accounts.
Critical vulnerabilities in LibreOffice and Apache OpenOffice allow malicious spreadsheets to execute attacker code upon opening without displaying macro warnings. The attack requires Java support to be enabled. No active exploitation has been reported yet.
Nikkei disclosed unauthorized access to two employee cloud accounts, with one account used to send approximately 9,000 phishing emails, highlighting the importance of multi-factor authentication.
Ongoing attacks against U.S. water utilities involve hackers exploiting internet-exposed industrial controllers with weak or default credentials, resulting in service disruptions including flooding and reduced water pressure.
Why does patch management matter more now for SMBs?
Four separate high-severity vulnerabilities released this week (CVE-2026-96940 for Exchange Server with CVSS 8.8, Dell System Update DSA-2026-324, LibreOffice macro execution flaws, and OpenOffice spreadsheet attacks) share one root cause: missing or delayed patches. The FBI contractor breach that exposed thousands of employee records happened because a critical HR platform patch went unapplied. Worse, ransomware operators like Azazel are now weaponizing AI tools to automate attacks against patched systems, meaning every unpatched device becomes a liability. SMBs must prioritize: audit all servers and workstations for pending patches, apply Exchange and Dell updates within 48 hours, and enable multi-factor authentication on cloud accounts to slow credential theft when exploits succeed anyway.
Key takeaways
- Exchange Server CVE-2026-96940 (CVSS 8.8) allows authenticated attackers to reach admin privileges. Deploy Microsoft's emergency update immediately.
- Dell System Update versions before 2.3.0.0 allow unauthenticated remote code execution as root. Third-party tools are attack vectors SMBs overlook.
- FBI contractor missed a single HR patch and exposed thousands of employee records. Patch delays compound liability across supply chains.
- LibreOffice and OpenOffice macros execute without warnings if Java is enabled. Disable Java support or block these file types until patched.
Frequently asked questions
How fast do I need to apply the Exchange Server patch?
Microsoft rated CVE-2026-96940 high-severity with likely exploitation. Treat it as a 24 to 48-hour deadline. If you cannot test and deploy within that window, temporarily isolate Exchange servers from untrusted networks or disable the affected authentication method until patched.
What does the Dell System Update vulnerability mean for my business?
DSA-2026-324 affects Dell System Update versions before 2.3.0.0 and allows unauthenticated attackers to execute code with root privileges. If your IT team uses DSU for firmware updates, upgrade immediately. Check your deployment history to confirm whether remote systems were exposed.
Should I disable Java on all workstations?
The LibreOffice and OpenOffice vulnerabilities require Java to be enabled. If your team does not use Java-dependent applications, disabling it removes this attack path. If Java is required, patch both suites and train staff never to open unexpected spreadsheet attachments until updates are verified.
How does multi-factor authentication prevent the Nikkei breach from happening to us?
Nikkei's attacker used a single compromised employee cloud account to send 9,000 phishing emails. Multi-factor authentication would have blocked the initial login, even with valid credentials. Enable MFA on all cloud email, HR, and file storage accounts immediately.
What should I do if I find unpatched systems on my network?
Document which systems are affected, prioritize servers and internet-facing devices first, and create a patch schedule for the next 30 days. Test patches in a non-production environment if possible. For critical systems, plan maintenance windows during low-traffic hours.
Sources
- https://securityaffairs.com/200476/security/cve-2026-96940-microsoft-fixes-high-severity-exchange-server-flaw.html
- https://cybersecuritynews.com/dell-system-update-tool-vulnerability/
- https://www.securityweek.com/fbi-blames-contractors-missed-patch-for-shinyhunters-breach/
- https://cybersecuritynews.com/ransomware-hacker/
- https://cybersecuritynews.com/midnight-blizzard/
- https://thehackernews.com/2026/10/libreoffice-and-openoffice-flaws-let.html
- https://www.infosecurity-magazine.com/news/nikkei-employee-cloud-account/
- https://cybersecuritynews.com/hackers-exploit-exposed-industrial-controllers/
Keep reading
Produced with AI from TC3's daily cyber briefing video. Not individually reviewed before publishing; questions go to a human at [email protected].