Sysadmins Wrestle Patching Chaos
15 posts across 2 communities in the last 60 days; 93% from r/sysadmin.
“There are a lot of tools, but you can always use WufB The GPO is free, only the web reporting costs money . This is the first solution you should always implement if not using WSUS. The problem is that you lose the ability to push updates immediately in response to 0 days. Which…”
“10.0 pre-auth SSRF is about as bad as it gets, especially on something internet-facing like the Work Place interface. Patching first, asking questions later on this one, IOCs or not. If you can't patch immediately, worth checking if you can restrict access to the Work Place…”
“I’ve been through CISA's Known Exploited list for Oct 8-16 and pulled out what matters for small-office and SMB environments. Patch now: - Ivanti Connect Secure CVE-2026-104935: auth bypass to RCE. If it's on your edge, patch and assume compromise until you've worked through…”
System administrators are overwhelmed by the sheer volume and severity of security patches released each month, particularly highlighting vulnerabilities in critical infrastructure like ADFS and SharePoint. The complexity and potential for exploitation necessitate immediate action and careful prioritization.
SOURCES (28)
“I’ve been through CISA's Known Exploited list for Oct 8-16 and pulled out what matters for small-office and SMB environments. Patch now: - Ivanti Connect Secure CVE-2026-104935: auth bypass to RCE. If it's on your edge, patch and assume compromise until you've worked through CISA's…”
“Hoping someone cleverer than me can help here. Noticed we have CVE-2024-38163 which relates to WinRE. Now this should have been automatically remediated with an older patch going back 2 years but for some reason our WinRE is still on the older version. I had a quick look and not really found much that would assist on remediating this. The KB in question doesn't seem to be readily available for download, instead only being available via Windows Update and we don't get the option for it. A”
“Good to know! I’m still a newish admin, like 1.5 years if that, and with a smaller org so trying to play a lot of roles. Thanks for letting me know! [re: Patch Tuesday Megathread - (October 13, 2026)]”
“Citrix alert, https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ASD alert: https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/critical-vulnerabilities-in-citrix-netscaler-adc-and-citrix-netscaler-gateway-products submitted by /u/disclosure5 [link] [comments]”
“2 DCs, Server 2019, both also running DNS. Domain Functional Level @ 2016. After applying the September 2026 OOB patch (KB5129238) on the PDC, we got a ton of NETLOGON event 5775s: The dynamic deletion of the DNS record '_kerberos._ tcp.contoso.sites.contoso.com 600 IN SRV 0 100 88 PDC.contoso.com' failed on the following DNS server: DNS server IP address: <PDC IP> Returned Response Code (RCODE): 5 Returned Status Code: 9017 DNS stopped working across the entire domain. Was also un”
“So if we do not have this enabled, we are good to go for patching but workstation and server OS?”
“There are a lot of tools, but you can always use WufB The GPO is free, only the web reporting costs money . This is the first solution you should always implement if not using WSUS. The problem is that you lose the ability to push updates immediately in response to 0 days. Which is fine for most orgs, just change the Wufb policy to patch immediately that night and then change it back. Frustratingly, there are no ways to install windows updates through WinRM, though there are workarounds to make”
“Now a third party entity has provided info on a vulnerability that may be exploited in the wild. https://go.n-able.com/MzU2LVVWSC00MDMAAAGkFAG-0DB4Ieiew1UlzeiHU\_WE9mGwTd387O8jbQl4usDpmOc7hQ5P21F5Lo-7piHNgtxO220= Sorry for those of you who thought your long weekend work was done with the first patch. submitted by /u/aaron72 [link] [comments]”
“10.0 pre-auth SSRF is about as bad as it gets, especially on something internet-facing like the Work Place interface. Patching first, asking questions later on this one, IOCs or not. If you can't patch immediately, worth checking if you can restrict access to the Work Place interface to known IPs as a stopgap while you get the update scheduled.”
“Not to mention, Windows updates are expected to "just work" on hundreds of millions of unique hardware/software configurations. And for the most part, they do. I'm not saying Windows updates are free of bugs, but when you're shipping code that runs in that many different environments it's almost statistically guaranteed there will be edge/corner cases you didn't account for. But those are the outliers, which disproportionately get headlines because "Millions instal”
“Can you honestly say you’ve got better ops than them? That’s why we keep doing it.”
“Depends on what service the RCE is in and under what service. It does not in anyway indicate that the central authentication service or customer data was compromised”
“CVE-2026-69836, deserialization RCE in Entra ID. Microsoft says it was already fixed on their side. First advisory said exploited in the wild, next day that flag was gone. Anyone actually change anything in those 24 hours, or just watch the advisory? submitted by /u/jencryzthers [link] [comments]”
“Brought to you by r/sysadmin Trusted VAR: [ u/SquizzOC ]( u/SquizzOC ) with Trusted Telecom Broker [ u/Each1Teach1x27 ]( u/Each1Teach1x27 ) and [ u/Necessary _Time]( u/Necessary_Time ) Trusted VAR in Canada Happy to answer in the thread or via PM if you don't want to post details like service locations publicly. This BI-WEEKLY thread is here for you to discuss vendor and service provider expectations, pricing, and quotes for network services, licensing, support, deployment, and hardware. Req”
“This week, we had Oracle’s CSPU for August with 925 CVEs. Last week, it was Microsoft's August Patch Tuesday with 398 CVEs, following July with 570. All these vendors are using AI models to assist or discover new vulns, which is great. But then the frenzy to patch all the things begins. Personally, I don’t think this patch volume is what we should expect a year from now. I predict these numbers will level off somewhere in the middle, but it’s our current reality. How are you all approaching”
“This weekend was patch weekend for us, we have more than 7000 assorted windows server to upgrade. One of the engineer accidentally patched 32b office 2024 product with the 64b patch. I was under assumption that this mismatch of the bit version will be caught by the system and it will auto fail but that did not happen. So i was wondering if this is something that can be smartly restricted instead of depending on the human / manual factor submitted by /u/abhii2686 [link] [comment”
“August 2026's patch Tuesday fixes a vulnerability in TFTP server remote code execution, CVE-2026-62893. ref: https://www.sentinelone.com/vulnerability-database/cve-2026-62893/ Affected service: WDS https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62893 Post installation of KB5121650 addresses this vulnerability. If you find yourself able to PXE boot, but get boot up errors, check your MDT server and open up server manager. Go to WDS and under Events, search for 4101 - "the”
“Might as well leave the management interface to your FW on the internet with it. Gotta be able to manage that shit from home. /s in case it’s not obvious.”
“Known issues with DCs. Not 100% sure of the issues but has anyone patched Production yet? Issues seen this month? Estate less then 1,000 servers need not apply loll submitted by /u/Mskews [link] [comments]”
“If you are running N-Central pre 2026.3 shutdown your servers internet access **now** and update immediately. More info: https://www.n-able.com/blog/n-central-security-update-august-1-2026 n-able is calling users of the product to do this immediately. Thanks for reporting u/ceden submitted by /u/Lime-TeGek [link] [comments]”