Security Notices
CVE-2026-20127: Cisco Catalyst SD-WAN controller authentication bypass to fabric administration
Cisco's SD-WAN peering bypass can grant a high-privilege non-root account with NETCONF access to alter fabric configuration. Include Controller, Manager and Validator in evidence collection and updates; successful upgrading alone does not establish fabric recovery.
CVE-2022-20775: Cisco SD-WAN authenticated local path traversal to root
Cisco SD-WAN's CLI path-traversal flaw requires authenticated local access and can grant root privileges. Inventory affected control and edge components, excluding IOS XE SD-WAN; historical fix thresholds do not establish protection from newer fabric vulnerabilities.
CVE-2008-0015: Legacy Windows Video ActiveX Control RCE
A crafted page using the Windows Video ActiveX control can execute code with the logged-on user's rights in legacy Internet Explorer. Verify the control's kill-bit protection on affected hosts, while retiring unsupported Windows systems.
CVE-2026-20700: Apple dyld arbitrary code execution in a targeted exploit chain
Apple's dyld flaw can enable code execution when an attacker already has memory-write capability. Install the supported OS update; suspected targets of the reported exploit chain need investigation beyond checking that installation succeeded.
CVE-2024-43468: Configuration Manager unauthenticated SQL injection
Unauthenticated requests can trigger commands on Configuration Manager servers or their databases. Remediation requires the revised in-console package and applicable site procedures, not merely a Windows update or the original package carrying the same KB number.
CVE-2026-1603: Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
An alternate authentication path in Ivanti Endpoint Manager can expose specific stored credentials without authentication. This is EPM, not EPMM; the fixed build remains unverified, and updating cannot invalidate credentials already disclosed.
CVE-2023-43000: Apple WebKit use-after-free memory corruption
Malicious web content can trigger WebKit use-after-free memory corruption. Update the supported Apple OS and Safari branch, and explicitly check legacy devices for the backported fix rather than mistaking historical fixed releases for affected ranges.
CVE-2026-35616: FortiClient EMS unauthenticated access-control bypass to code execution
Unauthenticated crafted requests can execute code on affected FortiClient EMS servers. Check the server release and hotfix, not endpoint client versions, then follow the applicable Fortinet hotfix or supported upgrade path.
CVE-2026-3055: Citrix NetScaler Out-of-Bounds Read Vulnerability
NetScaler memory overread requires SAML identity-provider configuration, not the gateway prerequisite of the neighboring CVE. Match standard or FIPS/NDcPP update branches and investigate suspected disclosure separately; CISA's exploitation listing does not establish appliance compromise.
CVE-2025-53521: F5 BIG-IP APM unauthenticated remote code execution
A stack-based buffer overflow in BIG-IP APM can permit remote code execution. Match the APM configuration and release branch, install the supported fix, and follow F5's additional mitigation and compromise-review guidance.