September 2026
CVE-2026-45659: SharePoint authenticated remote code execution
SharePoint code execution requires an authenticated attacker with at least Site Member permissions. CISA records ransomware-campaign use; apply edition-specific farm updates and preserve membership, IIS and endpoint evidence without assuming this farm was compromised.
CVE-2008-4128: Cisco IOS Cross-Site Request Forgery Vulnerability
Legacy Cisco IOS 12.4 request forgery can misuse a signed-in administrator's browser to issue commands. The linked retirement notice does not identify a fixed image; confirm a hardware-compatible supported migration and preserve management evidence.
CVE-2026-15409: SonicWall SMA1000 unauthenticated WorkPlace SSRF
Unauthenticated requests can make the SMA1000 WorkPlace interface contact unintended destinations. Verify the appliance model and hotfix, update, and conduct the compromise review; SonicWall firewall SSL-VPN and SMA 100 are outside this notice's scope.
CVE-2026-15410: SonicWall SMA1000 administrator code injection
This SMA1000 code-injection flaw requires administrator access to the Appliance Management Console. Apply the current supported hotfix and investigate suspected compromise; the historical minimum build does not establish protection against later vulnerabilities.
CVE-2026-56155: AD FS local privilege escalation
An authorized local attacker can exploit AD FS access controls to gain administrator privileges. Match each federation node to its Windows update; patch completion alone cannot establish that identity-service credentials and trusts remain safe.
CVE-2026-56164: SharePoint missing-authentication privilege escalation
Missing authentication in SharePoint can let an unauthorized network attacker elevate privileges. Microsoft's Moderate severity does not negate reported exploitation; update every applicable farm server and review authentication, IIS and role-change evidence.
CVE-2026-25089: FortiSandbox second-order command injection
CISA reports unauthenticated HTTP command injection in FortiSandbox appliances, Cloud and PaaS. Confirm who controls remediation for each deployment; this notice establishes neither a fixed appliance build nor a completed managed-service rollout.
CVE-2026-39808: FortiSandbox unauthenticated command injection
Crafted HTTP requests can trigger unauthorized commands on affected FortiSandbox systems without authentication. Restrict the management path while arranging the supported update, and match the fix to the installed release branch.
CVE-2026-58644: SharePoint unauthenticated deserialization RCE
Microsoft reports exploitation of this SharePoint deserialization flaw but gives conflicting authentication prerequisites. Use its CVE-specific edition mapping across the farm; neither another SharePoint fix nor the narrower FAQ establishes this exposure is resolved.
CVE-2021-27137: DD-WRT Stack-Based Buffer Overflow Vulnerability
DD-WRT's exploited UPnP buffer overflow can allow unauthenticated code execution. The linked source correction does not identify a compatible router firmware image; match the hardware and build, and preserve evidence before remediation.