September 2026
CVE-2024-20260: Cisco ASA and FTD SSL VPN denial-of-service scope expansion
SSL/TLS connection floods can exhaust memory on affected hardware or virtual ASA and FTD appliances. Check SSL VPN or management HTTP configuration and obtain the CVE-specific fixed release; reloading restores service, not the software fix.
CVE-2009-0556: Legacy PowerPoint file code execution
A crafted file can corrupt memory and execute code when opened in affected legacy PowerPoint versions, using the logged-on user's rights. Match this CVE's specific products rather than the whole bulletin, and migrate unsupported Office.
CVE-2025-37164: HPE OneView unauthenticated remote code execution
HPE OneView's unauthenticated code-execution flaw requires current, platform-specific remediation. Enhanced hotfix notes say earlier packages are insufficient; distinguish Synergy from standalone appliances and do not treat an old hotfix record as completed protection.
CVE-2026-20805: Desktop Window Manager local information disclosure
An authorized local attacker can obtain a Desktop Window Manager user-mode memory section address. This disclosure does not itself establish SYSTEM access or code execution; match the January update and investigate suspected follow-on activity separately.
CVE-2026-20045: Cisco Unified Communications Products Code Injection Vulnerability
Unauthenticated HTTP requests to affected Cisco Unified Communications management interfaces can obtain operating-system user access and then root. Select the remedy for each listed product; a scheduled release date does not verify download availability.
CVE-2025-34026: Versa Concerto Improper Authentication Vulnerability
Versa Concerto's Traefik authentication bypass can expose administrative Actuator endpoints, heap dumps and trace logs. For 12.1.2, verify the dated hotfix rather than the version alone; patching cannot undo sensitive data already disclosed.
CVE-2026-21509: Microsoft Office OLE security-feature bypass
Opening a malicious Office file can bypass OLE protections; Preview Pane is excluded. Available edition-specific updates supersede old pending-patch wording, but conflicting registry instructions remain unresolved and service-side protection requires restarting Office applications.
CVE-2026-24858: FortiCloud SSO cross-account authentication bypass
An attacker with a FortiCloud account and registered device can cross account boundaries when a vulnerable target enables FortiCloud SSO. Verify product-specific fixes and administrator activity; Fortinet's cloud-side block is not an appliance patch.
CVE-2026-1281: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Ivanti EPMM code injection can permit unauthenticated remote execution. The linked security RPM filenames do not establish package applicability; obtain the CVE-specific release instructions and investigate potential mobile-management compromise separately from installing a patch.
CVE-2026-21510: Windows Shell and SmartScreen warning bypass
A malicious link or shortcut can bypass SmartScreen and Windows Shell warnings after a user opens it. Execution may proceed without the expected prompt; update the affected Windows branch and investigate downloaded shortcuts and follow-on activity.