Security Notices
CVE-2026-7473: Arista EOS tunnel decapsulation validation flaw
Affected Arista EOS switches can forward unexpected tunnel traffic sent to a configured decapsulation IP. Arista specifies ACL mitigation, not a software upgrade; plan filters around shared-IP services and potentially disruptive TCAM changes.
CVE-2026-20245: Cisco Catalyst SD-WAN authenticated root privilege escalation
An attacker with netadmin privileges can use a crafted file to gain root on affected SD-WAN control components. Preserve admin-tech before upgrading, then inspect indicators and verify downstream edge-device configuration.
CVE-2026-50751: Check Point deprecated IKEv1 VPN authentication bypass
Check Point's exploited VPN bypass requires Remote Access or Mobile Access, IKEv1, accepted legacy clients and no mandatory machine certificate. Gateway and Spark remediation differ; review suspicious VPN sessions separately from installing the appropriate fix.
CVE-2025-48595: Android Framework privilege escalation
Android Framework integer overflow can enable local privilege escalation beyond normal device permissions. Install the OEM security update and verify its reported patch level; this platform issue is not limited to Pixel devices.
CVE-2026-0257: PAN-OS GlobalProtect authentication bypass
GlobalProtect authentication-override cookies can permit unauthorized VPN connections under the affected certificate configuration. Coordinate fixes across every cookie-generating and accepting portal or gateway, including hybrid Prisma Access deployments, and investigate sessions separately from patching.
CVE-2026-45498: Microsoft Defender local denial of service
The exploited Microsoft Defender flaw can interrupt protection through denial of service. Verify the Antimalware Platform update on each endpoint and examine Defender health telemetry; a currently healthy service does not rule out earlier disruption.
CVE-2026-41091: Microsoft Malware Protection Engine privilege escalation
A link-following flaw in Microsoft Malware Protection Engine can let an authorized local attacker gain SYSTEM privileges. Verify the installed engine update and review endpoint telemetry; this is not unauthenticated remote takeover.
CVE-2008-4128: Cisco IOS Cross-Site Request Forgery Vulnerability
Legacy Cisco IOS 12.4 request forgery can misuse a signed-in administrator's browser to issue commands. The linked retirement notice does not identify a fixed image; confirm a hardware-compatible supported migration and preserve management evidence.
CVE-2026-45659: SharePoint authenticated remote code execution
SharePoint code execution requires an authenticated attacker with at least Site Member permissions. CISA records ransomware-campaign use; apply edition-specific farm updates and preserve membership, IIS and endpoint evidence without assuming this farm was compromised.
CVE-2026-20230: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
Unified CM and Unified CM SME systems with WebDialer enabled face unauthenticated file writes that may later enable root escalation. Check actual service state, then select Cisco's update or assess temporary disablement's workflow impact.