Security Notices
CVE-2025-25249: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
CISA lists a packet-triggered buffer overflow affecting FortiOS, FortiSwitchManager and FortiSASE as exploited. Inventory the products separately; this notice does not provide a verified fixed-release matrix, so remediation requires Fortinet's product-specific guidance.
CVE-2026-85880: Windows ALPC local privilege escalation
This exploited Windows ALPC flaw lets code in a low-privilege AppContainer escape to SYSTEM. Match the host's release and architecture to its security update; patch completion does not exclude earlier endpoint compromise.
CVE-2026-81963: Windows Update Stack privilege escalation to SYSTEM
An exploited Windows Update Stack flaw can elevate a local attacker to SYSTEM. Match the Windows release to its verified KB and build, then investigate suspicious endpoint activity separately from confirming the update.
CVE-2026-76460: Cisco ISE authentication bypass is actively exploited
Cisco reports active exploitation of an ISE and ISE-PIC authentication bypass that can lead to root access. Check every node, preserve off-device evidence, and separate patch installation from investigation and trusted recovery.
CVE-2026-58704: Pixel cellular-modem privilege escalation
The exploited Pixel cellular-modem flaw can bypass permission checks. Install the current Pixel update, restart, and verify the security patch level; a successful update does not establish whether earlier exploitation occurred.
CVE-2026-76461: Cisco Secure Email Gateway crafted-email root command execution
Cisco Secure Email Gateway SQL injection can give unauthenticated attackers root command execution. Preserve mail and network evidence, match the AsyncOS upgrade path, and use Cisco TAC when compromise is suspected.
CVE-2026-86060: MikroTik RouterOS MikroTrick policy-mask privilege escalation
MikroTik RouterOS policy-mask manipulation can escalate privileges. Upgrade the affected release, restrict untrusted SSH access, and inspect users, scripts and configuration even when the router does not report a Flagged state.
CVE-2026-67277: MikroTik RouterOS btest unauthenticated memory disclosure and denial of service
Missing authentication in RouterOS btest can disclose kernel memory or interrupt service. Check the service and release, then install the supported fix; restricting SSH alone does not establish that this btest flaw is resolved.
Check Point Confirms Active Exploitation of VPN RCE CVE-2026-85102
Check Point reports active exploitation of a pre-authentication VPN certificate-handling flaw. Match Security Gateway or Spark builds to the supported fix, preserve logs, and investigate suspicious Mobile Access logins separately from patch installation.
Palo Alto Updates GlobalProtect CVE-2026-0307 Fixed Builds
Palo Alto revises GlobalProtect CVE-2026-0307 fixed builds. Update both clients and infrastructure, validate the paired fix, and retain evidence.