September 2026
CVE-2009-0238: Legacy Microsoft Excel file remote code execution
Opening a crafted legacy Excel file can run code with the logged-on user's rights; receiving an email alone is insufficient. Match historical Excel, Viewer and Mac updates, including paired packages where required, and replace unsupported installations.
CVE-2026-32201: SharePoint unauthenticated spoofing vulnerability
SharePoint's exploited spoofing flaw permits unauthenticated access to some sensitive information and changes to that information. It does not establish arbitrary account takeover or code execution; match updates to each on-premises farm server.
CVE-2026-20122: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
Read-only API credentials can let an attacker overwrite files on SD-WAN Manager and gain vmanage-user privileges. Preserve API and licensing-upload evidence while updating; a read-only role alone does not block this exploited flaw.
CVE-2026-20128: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
Cisco now describes unauthenticated remote disclosure of an SD-WAN Manager DCA credential, while CISA retains authenticated-local prerequisites. Follow the revised vendor exposure guidance; this CVE's 20.18-and-later exclusion does not extend to neighboring flaws.
CVE-2026-20133: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Unauthenticated SD-WAN Manager API requests can expose sensitive operating-system information. This CVE does not inherit neighboring flaws' root or overwrite impacts, nor their release exclusions; preserve API evidence and use the disclosure-specific fix guidance.
CVE-2026-33825: Microsoft Defender local privilege escalation
Defender access-control weaknesses can let an authorized local attacker gain SYSTEM privileges. Verify the Antimalware Platform update and investigate suspicious endpoint activity; CISA's later exploitation listing supersedes the original no-exploitation assessment.
CVE-2025-29635: D-Link DIR-823X authenticated command injection on an end-of-life router
Authenticated command injection affects the end-of-life D-Link DIR-823X. D-Link directs retirement and replacement across hardware revisions; its support page's Resolved label is not a firmware fix or evidence that an exposed router was uncompromised.
CVE-2026-32202: Windows Shell spoofing vulnerability
Windows Shell spoofing requires the victim to execute a malicious file and can expose some sensitive information. Microsoft's July re-release requires revised updates; April-only patch evidence does not establish comprehensive remediation.
CVE-2026-0300: PAN-OS User-ID Authentication Portal unauthenticated root RCE
PAN-OS User-ID Authentication Portal exposure can allow unauthenticated root code execution on affected PA-Series and VM-Series firewalls. Check portal and ingress-interface Response Pages settings; Prisma Access, Cloud NGFW and Panorama are outside this issue's scope.
CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
Ivanti EPMM's input-validation flaw allows code execution by a remotely authenticated administrator. CISA reports exploitation, but this notice has no verified fixed build; review administrative activity and obtain the update for this CVE and branch.