September 2026
CVE-2026-16232: Check Point SmartConsole token bypass to full administrator
The SmartConsole flaw can give an unauthenticated attacker a full-administrator login token. Restrict management exposure and Trusted Clients, preserve evidence, and install the Jumbo Hotfix Accumulator take for the deployed Check Point branch.
CVE-2026-50522: SharePoint unauthenticated remote code execution
Microsoft's SharePoint deserialization advisory conflicts on authentication prerequisites: its description says unauthenticated, while its FAQ requires Site Owner access. CISA lists exploitation; update affected farms and preserve evidence without resolving that conflict by assumption.
CVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
This FortiOS information-exposure flaw requires prior filesystem compromise through another vulnerability. Its symbolic-link persistence mechanism makes recovery distinct from updating; the reviewed notice does not establish a verified fixed-release mapping.
CVE-2026-16812: Arista VeloCloud Orchestrator unauthenticated command injection
Command injection threatens on-premises VeloCloud Orchestrator hosts and their managed data. Restrict exposure, upgrade the orchestrator branch, and examine downstream edge state and trust material when compromise is suspected.
CVE-2026-20316: Cisco FMC static credential is exploited and ransomware-linked
A hard-coded FMC password can expose sensitive data through a low-privileged account. Restrict management access, install Cisco's current hardening release, and review indicators; the initial access is not itself root access.
CVE-2026-20349: Cisco ASA and FTD remote-access VPN denial of service
Affected Cisco ASA and FTD remote-access listeners can let unauthenticated attackers trigger a reload. Check SSL VPN, IKEv2 and ZTNA configuration, then install the branch-specific hardening release to address the service-disruption risk.
CVE-2026-68820: Windows WinSock AFD local privilege escalation
A locally authenticated attacker who wins a race in Windows WinSock AFD can gain SYSTEM privileges. Microsoft and CISA report exploitation; confirm the applicable update and investigate suspicious endpoint privilege transitions separately.
CVE-2026-33824: Windows IKEv2 remote code execution
An unauthenticated attacker can send crafted packets to IKEv2-enabled Windows systems and potentially execute code. CISA lists exploitation; match the Windows update branch and assess VPN disruption before applying the documented network restrictions.
CVE-2026-55040: SharePoint authentication bypass
SharePoint's authentication bypass can permit unauthenticated user impersonation. CISA's later exploitation listing differs from Microsoft's original assessment; update every affected on-premises farm server and preserve web, authentication and audit evidence.
CVE-2026-65400: macOS Screen Sharing authentication bypass
The macOS Screen Sharing flaw can let a network attacker authenticate without valid credentials. Check service reachability and the installed macOS branch, apply its supported update, and preserve relevant authentication evidence.