Tagged: CVE
24 posts · browse all tags
-
CVE-2026-76504 and Cisco's October 2026 Fixes: SD-WAN Manager, NX-OS, APIC and License On-Prem
One exploited Catalyst SD-WAN Manager authentication bypass (CVE-2026-76504, CVSS 9.8, on CISA KEV) and a seven-day-later batch of 14 advisories covering NX-OS, APIC and License On-Prem, including a CVSS 10.0 that is not the one being exploited.
-
FortiBleed Update: the FBI and Secret Service Advisory, and the FortiMail Zero-Day CVE-2026-104286
The FBI and Secret Service now put FortiBleed at 86,644 compromised FortiGates and say attackers are locking admins out. Separately, FortiMail CVE-2026-104286 (CVSS 9.8) was exploited before a patch existed. What changed, what is unrelated, and what to check.
-
FortiClient EMS 7.4.5: The Fix for One Critical Bug, the First Version Hit by the Next
FortiClient EMS 7.4.5 fixed CVE-2026-21643 and was the first version affected by CVE-2026-35616. Both are critical and unauthenticated. Affected versions, fixed builds and the 7.4.7 upgrade traps, from Fortinet's own advisories.
-
Certificate Required, Credentials Not: CVE-2026-93952 and the Second VeloCloud Orchestrator 10.0 of the Summer
Arista's SA 0183 discloses CVE-2026-93952, an actively exploited CVSS 10.0 flaw in on-prem VeloCloud Orchestrator that only bites when Edges authenticate with certificates. Fixes exist for 5.2 and 6.4, not yet 6.1 or 7.0, and July's patched builds are still exposed.
-
Three CVEs, One Deadline, and a Bug That Waited Thirteen Years: This Week's Linux Kernel Headlines
CISA added three actively exploited Linux kernel CVEs to its KEV catalog this week with a two-day federal patch deadline. A fourth, a thirteen-year-old Open vSwitch bug with a public root exploit, hasn't made that list yet. Here's what each one actually does.
-
Close Enough to Matter: Inside CVE-2026-58704 on Pixel's Cellular Modem
Google patched an actively exploited elevation-of-privilege bug in the Pixel modem this month, alongside 109 other fixes that got far less attention. What's actually confirmed, what isn't, and who's doing more of the finding now.
-
Arista VeloCloud Edge HA Part 1: How Failover Actually Works, and CVE-2026-86106
On 9 September 2026 Arista disclosed four VeloCloud Edge and Gateway CVEs in one batch. This one, CVE-2026-86106, lives entirely inside the HA peer channel between two Edges, so Part 1 goes deep on how that channel actually works before explaining the bug in it.
-
Arista VeloCloud Edge HA Part 2: CVE-2026-86107, CVE-2026-86108, CVE-2026-86109, and the Fix
The other three VeloCloud Edge and Gateway CVEs from Arista's 9 September 2026 batch: a VCMP tunnel crash, an OS command injection in the management workflow, and a signature-validation gap in the update mechanism. All three share their fixed releases with Part 1's HA bypass.
-
Same Class, Different Door: CVE-2026-0310 and PAN-OS's Second Root-RCE Buffer Overflow of 2026
CVE-2026-0310 gives PAN-OS its second unauthenticated root-RCE buffer overflow of the year. A close comparison with May's CVE-2026-0300, and what the pattern says about perimeter firewalls generally.
-
Same Day, Two Advisories: Cisco's Nexus 9000 Root RCE and the IOS XR Hardening Bundle
Cisco's September 2 disclosures: an unauthenticated root RCE on ten Nexus 9000 models via two unrestricted TCP ports, and a seven-CVE IOS XR hardening bundle with no workaround anywhere in the product line. Plus why that second detail matters more than any CVSS score.
-
The Chain Nobody's Advisory Describes: FortiSandbox's Three CVEs, Read Together
A follow-up to this site's CVE-2026-25089 post: a threat intel firm reports that bug chained with two more FortiSandbox CVEs (file-read plus privesc) for unauthenticated root in practice. What's confirmed by Fortinet's own advisories versus what's one firm's account, held carefully apart.
-
Start VNC, Start a Shell: Inside CVE-2026-25089 on FortiSandbox
CVE-2026-25089 is a CVSS 9.8 unauthenticated OS command injection in FortiSandbox's Web UI, actively exploited since mid-June and on CISA's KEV list since July. No password, no CVE chaining, just a crafted request to a device that already sits inline reading everything suspicious you feed it.
-
A Backdoor Named forticloud-sync: Inside the Gunra Ransomware Advisory and Two Fortinet CVEs From Early 2025
Six agencies, one ransomware gang, and two Fortinet CVEs that have been patchable since early 2025 and are still getting exploited. The most interesting detail in the advisory isn't the encryption — it's an MFA bypass that leaves the identity provider's own logs looking completely clean.
-
The One DNS Patch That's Actually Wormable: Inside CVE-2026-62878 on Windows DNS Server
August 2026 Patch Tuesday shipped four separate Windows DNS Server RCE fixes. Only one is unauthenticated, needs no user interaction, and is a wormable stack-based buffer overflow: CVE-2026-62878, CVSS 9.8, on a service that's usually running directly on your domain controllers.
-
Two Ways to Lose a VPN Gateway: FortiBleed's Credential Harvest and PAN-OS's Forged Auth Cookie
Two 2026 VPN gateway incidents, same attack surface, opposite root causes. FortiBleed has no CVE and no patch: a hashing migration that never finished, cracked at scale. CVE-2026-0257 is a real code defect: a certificate reused for two trust purposes that led straight to Qilin ransomware.
-
One Crafted Request From a Reload: Inside CVE-2026-20349 on Cisco Secure Firewall ASA and FTD
An unauthenticated attacker who can reach the Remote Access SSL VPN service on an ASA or FTD device can crash it with one crafted HTTP request. No login, no workaround, just a reload. What CVE-2026-20349 actually is, and why VPN-facing edges keep being the softest part of the firewall.
-
Seven CWEs, One Advisory: Cisco's August 2026 IOS XE Hardening Release
Cisco's IOS XE team ran the same internal-review model it used on Catalyst SD-WAN in August, grouping fixes by CWE class instead of shipping one CVE per bug. Seven CVE IDs, seven vulnerability classes, no known exploitation, and the same AI-assisted discovery line in the source section.
-
The Wildcard That Wasn't: CVE-2026-26035 and FortiWeb's RADIUS Admin Login Bypass
A non-default setting meant to make RADIUS group matching more flexible turns into a way to log into FortiWeb's GUI and CLI with a username and password that don't need to be correct. CVE-2026-26035, and why "wildcard" is a word worth treating with suspicion in any auth config.
-
Wearing Someone Else's Certificate: CVE-2026-70468 and FortiManager's FGFM Trust Model
A specific CLI option, a valid certificate, and a crafted FGFM request are enough to let one managed FortiGate impersonate any other in the eyes of its FortiManager. CVE-2026-70468, and what it says about certificate trust in a one-to-many management protocol.
-
NatJack: What a NAT-Table Hijack Means When You're the One Designing the NAT Boundary
NatJack broke a twenty-year-old assumption about who you can trust behind a shared NAT. Most of the coverage this week is either pure vulnerability research or "check your home router." This is the multi-tenant hub version of that question.
-
One CSV Upload From Root: Inside CVE-2026-20245 on Cisco Catalyst SD-WAN Manager
A rogue peering connection, a password changed and quietly changed back, then one crafted CSV file that turned an admin session into root. Mandiant's writeup of CVE-2026-20245 is the missing middle chapter between this site's UAT-8616 post and August's hardening release.
-
Declare Yourself Trusted: Inside UAT-8616's Three-Year Run Against Cisco Catalyst SD-WAN
Two maximum-severity Cisco Catalyst SD-WAN authentication bypasses, one threat actor, three years of quiet control-plane access. What CVE-2026-20182 and CVE-2026-20127 actually broke, how UAT-8616 used it, and what the fix demands beyond patching.
-
Marking Its Own Homework: Inside Cisco's August 2026 Catalyst SD-WAN Hardening Release
Three months after UAT-8616 forced Cisco's hand on SD-WAN, a different kind of disclosure: an internal security review, five CWE-grouped CVEs up to CVSS 9.9, and an admission that some of the bugs were found by AI models, not people.
-
CVE-2026-45504 Part 2: Inside the WOPI SSRF and Arbitrary File Read
A technical walkthrough of what CVE-2026-45504 actually does: a missing scheme check on an EWS ReferenceAttachment's provider URL, cited to Microsoft's advisory and HawkTrace's published research rather than reproduced as working exploit code.