Security Notices
CVE-2026-20234: Cisco ISE hardening: Insufficiently Protected Credential Vulnerabilities
Cisco's ISE hardening entry concerns insufficiently protected credentials but identifies no particular account or credential store. Apply the ISE or ISE-PIC patch guidance without assuming a shared default password or inventing a credential-rotation scope.
CVE-2026-20235: Cisco Identity Services Engine Information Disclosure Vulnerability
An ISE administrator can retrieve sensitive information, including credential hashes, through a crafted API request. Apply the CVE-specific patch and scope suspected exposure; disclosed hashes do not establish direct plaintext-password recovery.
CVE-2026-20237: Cisco ISE hardening: Input Validation Vulnerabilities
Cisco's ISE and ISE-PIC hardening entry covers input-validation and path-handling weaknesses without a specific file-access mechanism. Follow product-specific patch guidance; the body retains conflicting published scores rather than resolving them by assumption.
CVE-2024-20260: Cisco ASA and FTD SSL VPN denial-of-service scope expansion
SSL/TLS connection floods can exhaust memory on affected hardware or virtual ASA and FTD appliances. Check SSL VPN or management HTTP configuration and obtain the CVE-specific fixed release; reloading restores service, not the software fix.
CVE-2026-20071: Cisco ISE Session Takeover Vulnerability
An adjacent-network attacker can hijack Cisco ISE BYOD onboarding and enter a protected 802.1X network. Review that workflow and install this CVE's branch-specific patch; the companion administrator export flaw has different fixes.
CVE-2026-21509: Microsoft Office OLE security-feature bypass
Opening a malicious Office file can bypass OLE protections; Preview Pane is excluded. Available edition-specific updates supersede old pending-patch wording, but conflicting registry instructions remain unresolved and service-side protection requires restarting Office applications.
CVE-2025-34026: Versa Concerto Improper Authentication Vulnerability
Versa Concerto's Traefik authentication bypass can expose administrative Actuator endpoints, heap dumps and trace logs. For 12.1.2, verify the dated hotfix rather than the version alone; patching cannot undo sensitive data already disclosed.
CVE-2026-20045: Cisco Unified Communications Products Code Injection Vulnerability
Unauthenticated HTTP requests to affected Cisco Unified Communications management interfaces can obtain operating-system user access and then root. Select the remedy for each listed product; a scheduled release date does not verify download availability.
CVE-2026-20805: Desktop Window Manager local information disclosure
An authorized local attacker can obtain a Desktop Window Manager user-mode memory section address. This disclosure does not itself establish SYSTEM access or code execution; match the January update and investigate suspected follow-on activity separately.
CVE-2025-37164: HPE OneView unauthenticated remote code execution
HPE OneView's unauthenticated code-execution flaw requires current, platform-specific remediation. Enhanced hotfix notes say earlier packages are insufficient; distinguish Synergy from standalone appliances and do not treat an old hotfix record as completed protection.