Security Notices
CVE-2026-68820: Windows WinSock AFD local privilege escalation
A locally authenticated attacker who wins a race in Windows WinSock AFD can gain SYSTEM privileges. Microsoft and CISA report exploitation; confirm the applicable update and investigate suspicious endpoint privilege transitions separately.
CVE-2026-20349: Cisco ASA and FTD remote-access VPN denial of service
Affected Cisco ASA and FTD remote-access listeners can let unauthenticated attackers trigger a reload. Check SSL VPN, IKEv2 and ZTNA configuration, then install the branch-specific hardening release to address the service-disruption risk.
CVE-2026-20316: Cisco FMC static credential is exploited and ransomware-linked
A hard-coded FMC password can expose sensitive data through a low-privileged account. Restrict management access, install Cisco's current hardening release, and review indicators; the initial access is not itself root access.
CVE-2026-16812: Arista VeloCloud Orchestrator unauthenticated command injection
Command injection threatens on-premises VeloCloud Orchestrator hosts and their managed data. Restrict exposure, upgrade the orchestrator branch, and examine downstream edge state and trust material when compromise is suspected.
CVE-2026-83549: SonicWall SMA1000 administrator command injection and RCE
SonicWall SMA1000 administrators can exploit command injection through the Appliance Management Console. Apply the supported hotfix and request a support-led compromise review; this is distinct from the separate unauthenticated WorkPlace flaw.
CVE-2026-83548: SonicWall SMA1000 pre-authentication SSRF and proxy bypass
An unintended SMA1000 WorkPlace proxy path can expose sensitive functionality without authentication. Install SonicWall's supported hotfix, preserve exposure history, and obtain a support-led indicator review rather than treating the update as proof of recovery.
CVE-2026-76460: Cisco ISE authentication bypass is actively exploited
Cisco reports active exploitation of an ISE and ISE-PIC authentication bypass that can lead to root access. Check every node, preserve off-device evidence, and separate patch installation from investigation and trusted recovery.
CVE-2026-58704: Pixel cellular-modem privilege escalation
The exploited Pixel cellular-modem flaw can bypass permission checks. Install the current Pixel update, restart, and verify the security patch level; a successful update does not establish whether earlier exploitation occurred.
CVE-2026-76461: Cisco Secure Email Gateway crafted-email root command execution
Cisco Secure Email Gateway SQL injection can give unauthenticated attackers root command execution. Preserve mail and network evidence, match the AsyncOS upgrade path, and use Cisco TAC when compromise is suspected.
CVE-2026-86060: MikroTik RouterOS MikroTrick policy-mask privilege escalation
MikroTik RouterOS policy-mask manipulation can escalate privileges. Upgrade the affected release, restrict untrusted SSH access, and inspect users, scripts and configuration even when the router does not report a Flagged state.