September 2026
CVE-2026-21513: Windows MSHTML security-feature bypass
Opening a malicious HTML file or shortcut can bypass MSHTML security prompts and permit attacker-controlled execution. The network attack vector does not mean zero-click; preserve file-origin evidence and apply the matching Windows update.
CVE-2026-21514: Microsoft Word OLE protection bypass
Microsoft describes Word's flaw as an OLE protection bypass requiring a malicious file to be opened; Preview Pane is excluded. CISA instead describes local privilege escalation, a source disagreement retained alongside platform-specific update guidance.
CVE-2026-21519: Desktop Window Manager local privilege escalation
Desktop Window Manager type confusion can elevate an authorized local attacker to SYSTEM. Use this CVE's Windows update mapping and review privilege transitions; the flaw is distinct from DWM's separate information-disclosure issue.
CVE-2026-21525: Windows Remote Access Connection Manager denial of service
Windows RasMan's NULL-pointer flaw permits local denial of service, not remote code execution. Preserve service-crash context and apply the matching Windows update; restarting the service may restore availability without repairing the vulnerable code.
CVE-2026-21533: Windows Remote Desktop Services local privilege escalation
Remote Desktop Services can elevate an authorized local attacker to SYSTEM; this is not an unauthenticated network RDP entry point. Match Windows edition and servicing type to the update, then review local-session and endpoint evidence.
CVE-2024-43468: Configuration Manager unauthenticated SQL injection
Unauthenticated requests can trigger commands on Configuration Manager servers or their databases. Remediation requires the revised in-console package and applicable site procedures, not merely a Windows update or the original package carrying the same KB number.
CVE-2026-20700: Apple dyld arbitrary code execution in a targeted exploit chain
Apple's dyld flaw can enable code execution when an attacker already has memory-write capability. Install the supported OS update; suspected targets of the reported exploit chain need investigation beyond checking that installation succeeded.
CVE-2008-0015: Legacy Windows Video ActiveX Control RCE
A crafted page using the Windows Video ActiveX control can execute code with the logged-on user's rights in legacy Internet Explorer. Verify the control's kill-bit protection on affected hosts, while retiring unsupported Windows systems.
CVE-2022-20775: Cisco SD-WAN authenticated local path traversal to root
Cisco SD-WAN's CLI path-traversal flaw requires authenticated local access and can grant root privileges. Inventory affected control and edge components, excluding IOS XE SD-WAN; historical fix thresholds do not establish protection from newer fabric vulnerabilities.
CVE-2026-20127: Cisco Catalyst SD-WAN controller authentication bypass to fabric administration
Cisco's SD-WAN peering bypass can grant a high-privilege non-root account with NETCONF access to alter fabric configuration. Include Controller, Manager and Validator in evidence collection and updates; successful upgrading alone does not establish fabric recovery.