September 2026
CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Crafted SD-WAN peering requests can grant high-privilege, non-root NETCONF access across vulnerable Controller, Manager and Validator deployments. Collect admin-tech evidence from every control component before upgrading; an earlier authentication-bypass update is not sufficient evidence of remediation.
CVE-2026-42897: Exchange Outlook Web Access cross-site scripting
Crafted email can trigger JavaScript in an Exchange OWA user's browser under the stated interaction conditions, not code execution on the server. Verify applicable July security updates before removing mitigation; IE-mode clients lack the required protection.
CVE-2008-4250: Legacy Windows Server Service RPC remote code execution
The legacy Windows Server Service RPC flaw permits unauthenticated code execution on Windows 2000, XP and Server 2003; Vista and Server 2008 require authentication. Historical patching does not replace retirement or investigation of unsupported assets.
CVE-2009-1537: Legacy DirectShow QuickTime parsing RCE
Crafted media can exploit Microsoft's legacy DirectShow QuickTime parser and run code with the user's rights. This is not blanket exposure of Apple's QuickTime application; match the historical Windows component and replace unsupported systems.
CVE-2010-0249: Legacy Internet Explorer use-after-free RCE
CVE-2010-0249 can execute code through crafted web content in legacy Internet Explorer. Microsoft's original bulletin reported limited attacks; the 2026 KEV addition is separate history, not a new disclosure or justification for retaining unsupported systems.
CVE-2010-0806: Legacy Internet Explorer use-after-free RCE
Crafted content viewed in affected legacy Internet Explorer versions can run code with the user's rights. MS10-018 documents the historical fix; it does not restore support, so surviving unsupported browser and platform combinations require retirement.
CVE-2026-41091: Microsoft Malware Protection Engine privilege escalation
A link-following flaw in Microsoft Malware Protection Engine can let an authorized local attacker gain SYSTEM privileges. Verify the installed engine update and review endpoint telemetry; this is not unauthenticated remote takeover.
CVE-2026-45498: Microsoft Defender local denial of service
The exploited Microsoft Defender flaw can interrupt protection through denial of service. Verify the Antimalware Platform update on each endpoint and examine Defender health telemetry; a currently healthy service does not rule out earlier disruption.
CVE-2026-0257: PAN-OS GlobalProtect authentication bypass
GlobalProtect authentication-override cookies can permit unauthorized VPN connections under the affected certificate configuration. Coordinate fixes across every cookie-generating and accepting portal or gateway, including hybrid Prisma Access deployments, and investigate sessions separately from patching.
CVE-2025-48595: Android Framework privilege escalation
Android Framework integer overflow can enable local privilege escalation beyond normal device permissions. Install the OEM security update and verify its reported patch level; this platform issue is not limited to Pixel devices.