Security Notices
CVE-2026-10520: Ivanti Sentry OS Command Injection Vulnerability
Ivanti Sentry command injection can permit unauthenticated root access when the appliance is unmanaged and vulnerable endpoints are externally reachable. Managed access controls limit exposure but do not establish a software fix; the fixed-build mapping remains unverified.
CVE-2008-4128: Cisco IOS Cross-Site Request Forgery Vulnerability
Legacy Cisco IOS 12.4 request forgery can misuse a signed-in administrator's browser to issue commands. The linked retirement notice does not identify a fixed image; confirm a hardware-compatible supported migration and preserve management evidence.
CVE-2026-45659: SharePoint authenticated remote code execution
SharePoint code execution requires an authenticated attacker with at least Site Member permissions. CISA records ransomware-campaign use; apply edition-specific farm updates and preserve membership, IIS and endpoint evidence without assuming this farm was compromised.
CVE-2026-20230: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
Unified CM and Unified CM SME systems with WebDialer enabled face unauthenticated file writes that may later enable root escalation. Check actual service state, then select Cisco's update or assess temporary disablement's workflow impact.
CVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
This FortiOS information-exposure flaw requires prior filesystem compromise through another vulnerability. Its symbolic-link persistence mechanism makes recovery distinct from updating; the reviewed notice does not establish a verified fixed-release mapping.
CVE-2026-50522: SharePoint unauthenticated remote code execution
Microsoft's SharePoint deserialization advisory conflicts on authentication prerequisites: its description says unauthenticated, while its FAQ requires Site Owner access. CISA lists exploitation; update affected farms and preserve evidence without resolving that conflict by assumption.
CVE-2026-16232: Check Point SmartConsole token bypass to full administrator
The SmartConsole flaw can give an unauthenticated attacker a full-administrator login token. Restrict management exposure and Trusted Clients, preserve evidence, and install the Jumbo Hotfix Accumulator take for the deployed Check Point branch.
CVE-2021-27137: DD-WRT Stack-Based Buffer Overflow Vulnerability
DD-WRT's exploited UPnP buffer overflow can allow unauthenticated code execution. The linked source correction does not identify a compatible router firmware image; match the hardware and build, and preserve evidence before remediation.
CVE-2026-58644: SharePoint unauthenticated deserialization RCE
Microsoft reports exploitation of this SharePoint deserialization flaw but gives conflicting authentication prerequisites. Use its CVE-specific edition mapping across the farm; neither another SharePoint fix nor the narrower FAQ establishes this exposure is resolved.
CVE-2026-39808: FortiSandbox unauthenticated command injection
Crafted HTTP requests can trigger unauthorized commands on affected FortiSandbox systems without authentication. Restrict the management path while arranging the supported update, and match the fix to the installed release branch.