September 2026
CVE-2025-43520: Apple kernel memory write or system crash
A malicious application can exploit this Apple kernel buffer overflow to terminate the system or write kernel memory. Match the device's operating-system branch and install its supported security update.
CVE-2025-53521: F5 BIG-IP APM unauthenticated remote code execution
A stack-based buffer overflow in BIG-IP APM can permit remote code execution. Match the APM configuration and release branch, install the supported fix, and follow F5's additional mitigation and compromise-review guidance.
CVE-2026-3055: Citrix NetScaler Out-of-Bounds Read Vulnerability
NetScaler memory overread requires SAML identity-provider configuration, not the gateway prerequisite of the neighboring CVE. Match standard or FIPS/NDcPP update branches and investigate suspected disclosure separately; CISA's exploitation listing does not establish appliance compromise.
CVE-2026-35616: FortiClient EMS unauthenticated access-control bypass to code execution
Unauthenticated crafted requests can execute code on affected FortiClient EMS servers. Check the server release and hotfix, not endpoint client versions, then follow the applicable Fortinet hotfix or supported upgrade path.
CVE-2026-1340: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
CISA reports unauthenticated code execution in Ivanti EPMM through CVE-2026-1340. Preserve appliance and off-device evidence while obtaining its release-specific fix; this notice verifies neither a fixed build nor a particular execution account.
CVE-2012-1854: Legacy VBA insecure library loading RCE
Opening a legitimate Office document beside an attacker's DLL can trigger legacy VBA code execution with the user's rights. Inventory private VBE6.dll copies in third-party applications; an Office update may leave those runtimes unchanged.
CVE-2023-21529: Exchange Server authenticated deserialization RCE
Authenticated Exchange network calls can trigger deserialization code execution in the server-account context without requiring a user to open mail. CISA records ransomware use; match each server's cumulative-update branch and investigate separately from patch installation.
CVE-2023-36424: Windows Common Log File System privilege escalation
Windows CLFS exploitation can elevate a local attacker from Medium to High Integrity Level; the source does not establish SYSTEM access. Use a supported superseding update, not an expired historical package, and investigate suspicious privilege transitions.
CVE-2025-60710: Windows link-following privilege escalation
Improper link resolution in Host Process for Windows Tasks can elevate a local authorized attacker to SYSTEM. Microsoft's December 2025 re-release requires revised updates; November-only patch records do not establish protection against this ransomware-associated flaw.
CVE-2026-21643: Fortinet FortiClient EMS SQL Injection Vulnerability
Unauthenticated HTTP requests can exploit SQL injection on FortiClient EMS to execute code or commands. Scope the management server, not endpoint agents; this notice does not verify the fixed release for the installed branch.