Security Notices
CVE-2026-0300: PAN-OS User-ID Authentication Portal unauthenticated root RCE
PAN-OS User-ID Authentication Portal exposure can allow unauthenticated root code execution on affected PA-Series and VM-Series firewalls. Check portal and ingress-interface Response Pages settings; Prisma Access, Cloud NGFW and Panorama are outside this issue's scope.
CVE-2026-32202: Windows Shell spoofing vulnerability
Windows Shell spoofing requires the victim to execute a malicious file and can expose some sensitive information. Microsoft's July re-release requires revised updates; April-only patch evidence does not establish comprehensive remediation.
CVE-2025-29635: D-Link DIR-823X authenticated command injection on an end-of-life router
Authenticated command injection affects the end-of-life D-Link DIR-823X. D-Link directs retirement and replacement across hardware revisions; its support page's Resolved label is not a firmware fix or evidence that an exposed router was uncompromised.
CVE-2026-33825: Microsoft Defender local privilege escalation
Defender access-control weaknesses can let an authorized local attacker gain SYSTEM privileges. Verify the Antimalware Platform update and investigate suspicious endpoint activity; CISA's later exploitation listing supersedes the original no-exploitation assessment.
CVE-2026-50751: Check Point deprecated IKEv1 VPN authentication bypass
Check Point's exploited VPN bypass requires Remote Access or Mobile Access, IKEv1, accepted legacy clients and no mandatory machine certificate. Gateway and Spark remediation differ; review suspicious VPN sessions separately from installing the appropriate fix.
CVE-2025-48595: Android Framework privilege escalation
Android Framework integer overflow can enable local privilege escalation beyond normal device permissions. Install the OEM security update and verify its reported patch level; this platform issue is not limited to Pixel devices.
CVE-2026-0257: PAN-OS GlobalProtect authentication bypass
GlobalProtect authentication-override cookies can permit unauthorized VPN connections under the affected certificate configuration. Coordinate fixes across every cookie-generating and accepting portal or gateway, including hybrid Prisma Access deployments, and investigate sessions separately from patching.
CVE-2026-45498: Microsoft Defender local denial of service
The exploited Microsoft Defender flaw can interrupt protection through denial of service. Verify the Antimalware Platform update on each endpoint and examine Defender health telemetry; a currently healthy service does not rule out earlier disruption.
CVE-2026-41091: Microsoft Malware Protection Engine privilege escalation
A link-following flaw in Microsoft Malware Protection Engine can let an authorized local attacker gain SYSTEM privileges. Verify the installed engine update and review endpoint telemetry; this is not unauthenticated remote takeover.
CVE-2010-0806: Legacy Internet Explorer use-after-free RCE
Crafted content viewed in affected legacy Internet Explorer versions can run code with the user's rights. MS10-018 documents the historical fix; it does not restore support, so surviving unsupported browser and platform combinations require retirement.