All news with #advisory tag

🛡️ Microsoft warns that the KB5127648 security update for Windows 11 can prevent users from re-enabling Smart App Control on affected devices. The feature, which integrates with Microsoft Defender and SmartScreen, may appear grayed out on systems running Windows 11 version 24H2 and later. Devices that already have Smart App Control enabled remain protected. Microsoft published registry and Group Policy workarounds for IT administrators until an official fix is released.

🛡️ Noma Security found a vulnerability in Anthropic’s Claude Code Desktop that let malicious JavaScript in HTML files execute via the app’s preview pane, potentially exposing local files and credentials. Files under 256KB were safely loaded with strict CSPs, but larger files were written to disk and rendered as file://, bypassing protections and allowing filesystem access. Anthropic collaborated on fixes and is preparing advisories and a CVE.

🔒 Microsoft warns that non-admin users may be unable to connect via Remote Desktop after recent Windows updates when the Administrator protection feature is enabled. The feature, rolled out with KB5067036 and enabled by default in some security baselines, restricts users to standard permissions and requires Windows Hello for elevated actions. Microsoft says connections may fail with error 0xC000000D after installing KB5124010 or later on several Windows 11 versions. IT admins can temporarily mitigate the issue by disabling Administrator protection via Group Policy or Intune.

🔔 Ivanti urged customers to immediately patch an actively exploited zero-day in the Ivanti Connect Secure (ICS) SSL VPN, tracked as CVE-2026-104935. The high-severity authentication bypass affects multiple ICS versions and allows unauthenticated remote actors to execute arbitrary commands without user interaction. Ivanti reports limited exploitation in the wild and recommends upgrading to fixed versions and running the Integrity Checker Tool.

🔒 Microsoft warns that Windows devices running unsupported versions will stop receiving security updates after the Windows Update certificates expire in May and June 2027. Administrators and users must upgrade to supported versions or install specified security updates before those dates to retain update access. Replacement certificates have already been distributed to supported systems that are up to date, while unsupported systems will lose Windows Update services if not upgraded.

🛡️ Cisco has published advisories for five critical NX-OS vulnerabilities affecting Nexus 3000 and 9000 Series switches that could allow arbitrary code execution with root privileges or cause device reloads leading to denial-of-service. The flaws involve NX-API, Next Generation OAM (NGOAM), and MPLS OAM features and stem from insufficient input validation; some features are disabled by default. Cisco recommends upgrading NX-OS to fixed releases, disabling unused features, and applying Live Protect shields where immediate upgrades are not possible.

🔒 The FBI and US Secret Service warned administrators to harden Fortinet FortiGate firewalls and SSL VPN gateways after reporting the persistent FortiBleed campaign. Agencies cited SOCRadar data indicating 86,644 compromised devices across 194 countries and linked ransomware affiliates to use of stolen credentials. The notice details attacker techniques including credential stuffing, GPU-accelerated cracking, and creation of administrative accounts to maintain stealthy persistence. Organizations are urged to isolate affected hosts, perform threat hunting, reset credentials, enable phishing-resistant MFA, and follow CISA eviction guidance.

🔒 A critical arbitrary file access vulnerability, CVE-2026-21589 (9.3), affects eight Atlassian Data Center products and allows unauthenticated attackers to read files in the web app root. Atlassian urges immediate patching to fixed releases and offers limited mitigations (WAF rules, Tomcat RewriteValve, urlrewrite.xml) for those that cannot upgrade. Customers should isolate internet-facing instances, search logs for traversal patterns, and rotate exposed credentials if compromise is suspected.

🔐 On October 11, 2026 the DNS root will replace its key-signing key (KSK) with KSK-2024 (key tag 38696). Most site operators need take no action, but operators of DNSSEC-validating resolvers must ensure their trust anchors include KSK-2024 before the switch to avoid service outages. Cloudflare’s resolvers already include the new key and offer a RFC 8509-based readiness test at dnstest.dev to check whether the resolver your browser uses trusts the new root key. The post explains KSK vs ZSK roles, RFC 5011 automatic updates, and why embedding the new anchor in resolver software helps avoid issues seen during the 2018 rollover.

🔒 Microsoft issued out-of-band updates for a high-severity flaw in Microsoft Exchange Server that can allow an authenticated attacker to elevate privileges and access other users' mailboxes within the same organization. Tracked as CVE-2026-96940 with a CVSS score of 8.8, Microsoft applied a service-side fix for Exchange Online, while on-premises customers must install provided updates for specified Exchange Server builds. The company named researcher Jan Mitchell as the reporter and rated exploitability as "Exploitation More Likely."

🛡️ Dell warned customers to update the System Update (DSU) CLI after a critical path traversal vulnerability (CVE-2026-86360) was disclosed that can allow unauthenticated attackers to execute code with root privileges. The company released DSU 2.3.0.0 to patch this and four other high-severity issues, and urged immediate upgrades. U.S. agencies previously warned vendors to eliminate path traversal weaknesses, and organizations should patch promptly to reduce risk.

🔍 Amazon OpenSearch Service introduces a validation advisory for domain configuration changes that flags risky but permissible updates. Each validation is classified as Critical (blocks change) or Warning (advisory that can be acknowledged). Warnings can be acknowledged on submit, in dry-run results, via CloudFormation, and through API responses and EventBridge notifications.

🔒 CISA has issued an alert about a critical pre-authentication vulnerability (CVE-2026-84411) in MikroTik RouterOS that can lead to remote code execution or denial of service. The flaw is an integer underflow in the web-management HTTP request handling and can be triggered by a single crafted request to achieve root-level code execution. Affected RouterOS releases are reported to be below 7.24, and MikroTik recommends updating to 7.23 or later; the vendor has not yet published its own advisory.

🛡️ Cisco warned on September 30 that attackers are actively exploiting a critical zero‑day, CVE‑2026‑76504, in Catalyst SD‑WAN Manager that allows unauthenticated API access as the admin user. The flaw, tied to mishandled URI encoding in session login requests, scored 9.8/10 and has fixed releases available across affected release trains. Cisco confirmed active exploitation and advised upgrades; no workaround exists and internet‑exposed Managers are at highest risk.

🔒 TeamViewer has issued an urgent advisory urging customers to update immediately after disclosing multiple high-severity vulnerabilities in its Full Client and Host software for Windows, macOS, and Linux. The most critical issue is a remote session access control bypass (CVE-2026-92370) that could allow unauthorized remote actions leading to remote code execution. Four other flaws include path traversal, heap overflow, TOCTOU race condition, and improper path validation, which can enable local or remote code execution and privilege escalation. TeamViewer recommends upgrading to version 15.82, noting no evidence of public exploits or active in-the-wild abuse so far.

🔔 Kiteworks has lifted a temporary shutdown notice it issued after receiving threat intelligence from federal authorities, allowing customers to bring systems back online. Self-hosted Advanced Forms users should contact Customer Support for assistance, while Kiteworks-hosted systems are reported to be operating normally. The vendor recommended customers run the latest release, 9.5.1, and said there were no confirmed breaches. Industry observers noted this precautionary action amid speculation of a potential zero-day exploit targeting MFT platforms.

🔒 Unit 42 alerts that Citrix has reported active exploitation of two critical NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, both rated 9.5 on CVSS v4.0. The flaws enable unauthenticated remote code execution and a DTLS memory overflow that may cause RCE or DoS on NetScaler ADC and Gateway devices. Unit 42 urges immediate patching, system isolation, evidence preservation, and threat hunting while offering Incident Response assistance.

🖥️ Microsoft announced it will deprecate the Windows Deployment Services (WDS) server role starting with the next Windows Server release. WDS, a successor to RIS, enabled network-based OS installs at scale but has seen partial deprecation steps since 2021, including removed features and reduced support for desktop OS deployment. Microsoft recommends migrating to alternatives such as Configuration Manager and notes current supported Server releases remain unaffected until removal.

🛡️ The US Cybersecurity and Infrastructure Security Agency (CISA) has upgraded its vulnerability reporting and coordination platform to VINCE-NT, a modernized, CISA-managed version of Carnegie Mellon’s VINCE. The change, announced on September 17, shifts ownership to CISA’s Coordinated Vulnerability Disclosure (CVD) team and introduces automation, built-in collaboration tools, and a revamped interface to simplify reporting and improve triage. Active cases will be migrated over the coming weeks while inactive cases remain on the original VINCE; organizations are advised to update internal reporting procedures to submit vulnerabilities via VINCE-NT.

🛡️ The Internet Systems Consortium (ISC) released BIND 9.20.29 and 9.21.26 to remediate fourteen vulnerabilities disclosed on 16 September, including a DoH-related crash triggered by an invalid SIG(0) when the client closes a connection early. ISC reports no known active exploitation of these flaws and provides no workarounds; twelve of the issues also affect the unsupported 9.18 branch. The advisories detail affected versions, CVSS scores, conditions to exploit each flaw, and that public test reproductions exist to confirm fixes.