Security Notices
CVE-2010-0249: Legacy Internet Explorer use-after-free RCE
CVE-2010-0249 can execute code through crafted web content in legacy Internet Explorer. Microsoft's original bulletin reported limited attacks; the 2026 KEV addition is separate history, not a new disclosure or justification for retaining unsupported systems.
CVE-2009-1537: Legacy DirectShow QuickTime parsing RCE
Crafted media can exploit Microsoft's legacy DirectShow QuickTime parser and run code with the user's rights. This is not blanket exposure of Apple's QuickTime application; match the historical Windows component and replace unsupported systems.
CVE-2008-4250: Legacy Windows Server Service RPC remote code execution
The legacy Windows Server Service RPC flaw permits unauthenticated code execution on Windows 2000, XP and Server 2003; Vista and Server 2008 require authentication. Historical patching does not replace retirement or investigation of unsupported assets.
CVE-2026-7473: Arista EOS tunnel decapsulation validation flaw
Affected Arista EOS switches can forward unexpected tunnel traffic sent to a configured decapsulation IP. Arista specifies ACL mitigation, not a software upgrade; plan filters around shared-IP services and potentially disruptive TCAM changes.
CVE-2026-20245: Cisco Catalyst SD-WAN authenticated root privilege escalation
An attacker with netadmin privileges can use a crafted file to gain root on affected SD-WAN control components. Preserve admin-tech before upgrading, then inspect indicators and verify downstream edge-device configuration.
CVE-2008-4128: Cisco IOS Cross-Site Request Forgery Vulnerability
Legacy Cisco IOS 12.4 request forgery can misuse a signed-in administrator's browser to issue commands. The linked retirement notice does not identify a fixed image; confirm a hardware-compatible supported migration and preserve management evidence.
CVE-2026-45659: SharePoint authenticated remote code execution
SharePoint code execution requires an authenticated attacker with at least Site Member permissions. CISA records ransomware-campaign use; apply edition-specific farm updates and preserve membership, IIS and endpoint evidence without assuming this farm was compromised.
CVE-2026-20230: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
Unified CM and Unified CM SME systems with WebDialer enabled face unauthenticated file writes that may later enable root escalation. Check actual service state, then select Cisco's update or assess temporary disablement's workflow impact.
CVE-2026-34910: UniFi OS input-validation flaw
UniFi OS input-validation failures can permit command injection from an attacker with network access. Match the exact console or server product to its fixed release, then review system and access logs for unexplained activity.
CVE-2026-34909: UniFi OS path traversal
UniFi OS path traversal can expose underlying files to an attacker with network access. Apply the product-specific update and preserve access logs; the reviewed scope does not establish arbitrary file upload or placement.