CVE-2026-20072: Cisco ISE Information Disclosure Vulnerability
Cisco ISE administrators with user-management rights can export users outside their assigned group and reveal normally hidden passwords. Review those permissions and apply this CVE's patch; the flaw is not unauthenticated password access.
CVE-2026-20071: Cisco ISE Session Takeover Vulnerability
An adjacent-network attacker can hijack Cisco ISE BYOD onboarding and enter a protected 802.1X network. Review that workflow and install this CVE's branch-specific patch; the companion administrator export flaw has different fixes.
CVE-2024-20260: Cisco ASA and FTD SSL VPN denial-of-service scope expansion
SSL/TLS connection floods can exhaust memory on affected hardware or virtual ASA and FTD appliances. Check SSL VPN or management HTTP configuration and obtain the CVE-specific fixed release; reloading restores service, not the software fix.
CVE-2009-0556: Legacy PowerPoint file code execution
A crafted file can corrupt memory and execute code when opened in affected legacy PowerPoint versions, using the logged-on user's rights. Match this CVE's specific products rather than the whole bulletin, and migrate unsupported Office.
CVE-2025-37164: HPE OneView unauthenticated remote code execution
HPE OneView's unauthenticated code-execution flaw requires current, platform-specific remediation. Enhanced hotfix notes say earlier packages are insufficient; distinguish Synergy from standalone appliances and do not treat an old hotfix record as completed protection.
CVE-2026-20805: Desktop Window Manager local information disclosure
An authorized local attacker can obtain a Desktop Window Manager user-mode memory section address. This disclosure does not itself establish SYSTEM access or code execution; match the January update and investigate suspected follow-on activity separately.
CVE-2026-20045: Cisco Unified Communications Products Code Injection Vulnerability
Unauthenticated HTTP requests to affected Cisco Unified Communications management interfaces can obtain operating-system user access and then root. Select the remedy for each listed product; a scheduled release date does not verify download availability.
CVE-2025-34026: Versa Concerto Improper Authentication Vulnerability
Versa Concerto's Traefik authentication bypass can expose administrative Actuator endpoints, heap dumps and trace logs. For 12.1.2, verify the dated hotfix rather than the version alone; patching cannot undo sensitive data already disclosed.
CVE-2026-21509: Microsoft Office OLE security-feature bypass
Opening a malicious Office file can bypass OLE protections; Preview Pane is excluded. Available edition-specific updates supersede old pending-patch wording, but conflicting registry instructions remain unresolved and service-side protection requires restarting Office applications.
CVE-2026-24858: FortiCloud SSO cross-account authentication bypass
An attacker with a FortiCloud account and registered device can cross account boundaries when a vulnerable target enables FortiCloud SSO. Verify product-specific fixes and administrator activity; Fortinet's cloud-side block is not an appliance patch.