Firewalls & VPN
CVE-2026-3055: Citrix NetScaler Out-of-Bounds Read Vulnerability
NetScaler memory overread requires SAML identity-provider configuration, not the gateway prerequisite of the neighboring CVE. Match standard or FIPS/NDcPP update branches and investigate suspected disclosure separately; CISA's exploitation listing does not establish appliance compromise.
CVE-2025-53521: F5 BIG-IP APM unauthenticated remote code execution
A stack-based buffer overflow in BIG-IP APM can permit remote code execution. Match the APM configuration and release branch, install the supported fix, and follow F5's additional mitigation and compromise-review guidance.
CVE-2026-20131: Cisco FMC unauthenticated Java deserialization RCE as root
Unauthenticated Java deserialization in Cisco FMC's web management interface can execute code as root. Cisco's SCC SaaS fix does not update independently managed FMC; use the Software Checker and preserve evidence before remediation.
CVE-2026-0300: PAN-OS User-ID Authentication Portal unauthenticated root RCE
PAN-OS User-ID Authentication Portal exposure can allow unauthenticated root code execution on affected PA-Series and VM-Series firewalls. Check portal and ingress-interface Response Pages settings; Prisma Access, Cloud NGFW and Panorama are outside this issue's scope.
CVE-2026-50751: Check Point deprecated IKEv1 VPN authentication bypass
Check Point's exploited VPN bypass requires Remote Access or Mobile Access, IKEv1, accepted legacy clients and no mandatory machine certificate. Gateway and Spark remediation differ; review suspicious VPN sessions separately from installing the appropriate fix.
CVE-2026-0257: PAN-OS GlobalProtect authentication bypass
GlobalProtect authentication-override cookies can permit unauthorized VPN connections under the affected certificate configuration. Coordinate fixes across every cookie-generating and accepting portal or gateway, including hybrid Prisma Access deployments, and investigate sessions separately from patching.
CVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
This FortiOS information-exposure flaw requires prior filesystem compromise through another vulnerability. Its symbolic-link persistence mechanism makes recovery distinct from updating; the reviewed notice does not establish a verified fixed-release mapping.
CVE-2026-15410: SonicWall SMA1000 administrator code injection
This SMA1000 code-injection flaw requires administrator access to the Appliance Management Console. Apply the current supported hotfix and investigate suspected compromise; the historical minimum build does not establish protection against later vulnerabilities.
CVE-2026-15409: SonicWall SMA1000 unauthenticated WorkPlace SSRF
Unauthenticated requests can make the SMA1000 WorkPlace interface contact unintended destinations. Verify the appliance model and hotfix, update, and conduct the compromise review; SonicWall firewall SSL-VPN and SMA 100 are outside this notice's scope.
CVE-2026-83548: SonicWall SMA1000 pre-authentication SSRF and proxy bypass
An unintended SMA1000 WorkPlace proxy path can expose sensitive functionality without authentication. Install SonicWall's supported hotfix, preserve exposure history, and obtain a support-led indicator review rather than treating the update as proof of recovery.