Security Notices
CVE-2026-42897: Exchange Outlook Web Access cross-site scripting
Crafted email can trigger JavaScript in an Exchange OWA user's browser under the stated interaction conditions, not code execution on the server. Verify applicable July security updates before removing mitigation; IE-mode clients lack the required protection.
CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Crafted SD-WAN peering requests can grant high-privilege, non-root NETCONF access across vulnerable Controller, Manager and Validator deployments. Collect admin-tech evidence from every control component before upgrading; an earlier authentication-bypass update is not sufficient evidence of remediation.
CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
Ivanti EPMM's input-validation flaw allows code execution by a remotely authenticated administrator. CISA reports exploitation, but this notice has no verified fixed build; review administrative activity and obtain the update for this CVE and branch.
CVE-2026-0300: PAN-OS User-ID Authentication Portal unauthenticated root RCE
PAN-OS User-ID Authentication Portal exposure can allow unauthenticated root code execution on affected PA-Series and VM-Series firewalls. Check portal and ingress-interface Response Pages settings; Prisma Access, Cloud NGFW and Panorama are outside this issue's scope.
CVE-2026-32202: Windows Shell spoofing vulnerability
Windows Shell spoofing requires the victim to execute a malicious file and can expose some sensitive information. Microsoft's July re-release requires revised updates; April-only patch evidence does not establish comprehensive remediation.
CVE-2025-29635: D-Link DIR-823X authenticated command injection on an end-of-life router
Authenticated command injection affects the end-of-life D-Link DIR-823X. D-Link directs retirement and replacement across hardware revisions; its support page's Resolved label is not a firmware fix or evidence that an exposed router was uncompromised.
CVE-2026-20245: Cisco Catalyst SD-WAN authenticated root privilege escalation
An attacker with netadmin privileges can use a crafted file to gain root on affected SD-WAN control components. Preserve admin-tech before upgrading, then inspect indicators and verify downstream edge-device configuration.
CVE-2026-50751: Check Point deprecated IKEv1 VPN authentication bypass
Check Point's exploited VPN bypass requires Remote Access or Mobile Access, IKEv1, accepted legacy clients and no mandatory machine certificate. Gateway and Spark remediation differ; review suspicious VPN sessions separately from installing the appropriate fix.
CVE-2025-48595: Android Framework privilege escalation
Android Framework integer overflow can enable local privilege escalation beyond normal device permissions. Install the OEM security update and verify its reported patch level; this platform issue is not limited to Pixel devices.
CVE-2026-0257: PAN-OS GlobalProtect authentication bypass
GlobalProtect authentication-override cookies can permit unauthorized VPN connections under the affected certificate configuration. Coordinate fixes across every cookie-generating and accepting portal or gateway, including hybrid Prisma Access deployments, and investigate sessions separately from patching.