Security Notices
CVE-2025-37164: HPE OneView unauthenticated remote code execution
HPE OneView's unauthenticated code-execution flaw requires current, platform-specific remediation. Enhanced hotfix notes say earlier packages are insufficient; distinguish Synergy from standalone appliances and do not treat an old hotfix record as completed protection.
CVE-2026-21533: Windows Remote Desktop Services local privilege escalation
Remote Desktop Services can elevate an authorized local attacker to SYSTEM; this is not an unauthenticated network RDP entry point. Match Windows edition and servicing type to the update, then review local-session and endpoint evidence.
CVE-2026-21525: Windows Remote Access Connection Manager denial of service
Windows RasMan's NULL-pointer flaw permits local denial of service, not remote code execution. Preserve service-crash context and apply the matching Windows update; restarting the service may restore availability without repairing the vulnerable code.
CVE-2026-21519: Desktop Window Manager local privilege escalation
Desktop Window Manager type confusion can elevate an authorized local attacker to SYSTEM. Use this CVE's Windows update mapping and review privilege transitions; the flaw is distinct from DWM's separate information-disclosure issue.
CVE-2026-21514: Microsoft Word OLE protection bypass
Microsoft describes Word's flaw as an OLE protection bypass requiring a malicious file to be opened; Preview Pane is excluded. CISA instead describes local privilege escalation, a source disagreement retained alongside platform-specific update guidance.
CVE-2026-21513: Windows MSHTML security-feature bypass
Opening a malicious HTML file or shortcut can bypass MSHTML security prompts and permit attacker-controlled execution. The network attack vector does not mean zero-click; preserve file-origin evidence and apply the matching Windows update.
CVE-2026-21510: Windows Shell and SmartScreen warning bypass
A malicious link or shortcut can bypass SmartScreen and Windows Shell warnings after a user opens it. Execution may proceed without the expected prompt; update the affected Windows branch and investigate downloaded shortcuts and follow-on activity.
CVE-2026-1281: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Ivanti EPMM code injection can permit unauthenticated remote execution. The linked security RPM filenames do not establish package applicability; obtain the CVE-specific release instructions and investigate potential mobile-management compromise separately from installing a patch.
CVE-2026-24858: FortiCloud SSO cross-account authentication bypass
An attacker with a FortiCloud account and registered device can cross account boundaries when a vulnerable target enables FortiCloud SSO. Verify product-specific fixes and administrator activity; Fortinet's cloud-side block is not an appliance patch.
CVE-2008-0015: Legacy Windows Video ActiveX Control RCE
A crafted page using the Windows Video ActiveX control can execute code with the logged-on user's rights in legacy Internet Explorer. Verify the control's kill-bit protection on affected hosts, while retiring unsupported Windows systems.