LIVE INTELLIGENCE

The Wire

Verified technology, security, and framework changes — structured for the people responsible for keeping systems running.

UPDATED CONTINUOUSLY

145 VERIFIED SHIFTS

SW-000230CISCO · CISCO LICENSE ON-PREM (FORMERLY SMART SOFTWARE MANAGER ON-PREM) · CISCO LICENSE ON-PREMCRITICALACTION REQUIRED4H AGO

Cisco patches multiple internally-found critical flaws in License On-Prem (SSM On-Prem)

Cisco's internal security review of Cisco License On-Prem (formerly Smart Software Manager On-Prem) identified several vulnerability classes, grouped into four CVEs covering missing authentication, improper cryptographic signature verification, insufficiently protected credentials, and code injection. The highest CVSS score reaches 10.0. Cisco has released fixed software; no workarounds exist. No public exploitation is known; issues were found via internal testing, including use of frontier AI models.

SECURITY · IDENTITY · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000231CISCO · MERAKI · MERAKI CAMPUS GATEWAYS, MG, MR, MS, MV, MX DEVICESCRITICALACTION REQUIRED4H AGO

Cisco Meraki Security Hardening Release Fixes Critical Internally Found Vulnerabilities

Cisco published a security hardening advisory for its Meraki product line covering Campus Gateways, MG Cellular Gateways, MR Wireless APs, MS Switches, MV Smart Cameras, and MX Security/SD-WAN appliances. The vulnerabilities were discovered internally (not actively exploited) and grouped by CWE class, each assigned a CVE ID with CVSS scores up to 9.6. Cisco has released fixed software for each affected product line; no workarounds exist.

SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000232CISCO · APPLICATION POLICY INFRASTRUCTURE CONTROLLER (APIC)CRITICALACTION REQUIRED4H AGO

Cisco discloses three critical APIC vulnerabilities via internal hardening release (CVSS 9.8)

Cisco published a security advisory covering three CVEs (CVE-2026-76498, CVE-2026-76499, CVE-2026-76500) affecting the Application Policy Infrastructure Controller (APIC), discovered internally during proactive security testing. The highest CVSS base score is 9.8. No workarounds exist; Cisco has released fixed software. There is no evidence of public exploitation.

SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000233AWS · AMAZON ATHENA · ATHENA QUERY FEDERATION - SYNAPSE CONNECTORHIGHACTION REQUIRED4H AGO

AWS discloses SQL injection flaw (CVE-2026-12283) in Athena Synapse connector

AWS published a security bulletin for CVE-2026-12283, a vulnerability in the Athena Federated Query Synapse connector that lets a user with Azure Synapse access craft a table name causing unintended data to be returned when queried via Athena. The issue affects connector versions from v2022.20.1 through v2026.19.1 and is fixed in v2026.21.1.

DATA · CLOUD · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000234AMAZON WEB SERVICES · ION-JAVAHIGHACTION REQUIRED4H AGO

ion-java memory-amplification DoS bugs: v1.12.0 fix incomplete, upgrade to 1.12.1+

AWS disclosed two denial-of-service vulnerabilities in the ion-java library (CVE-2026-75935 and CVE-2026-75936) affecting versions before 1.12.0, caused by memory amplification via declared-length preallocation and compressed-data expansion. A September 2026 update to this bulletin states the originally recommended mitigation (disabling GZIP decompression) does not fully fix the issue on primary parse paths, and customers must instead upgrade to ion-java 1.12.1 or later, per the corrected Security Bulletin 2026-100-AWS.

SECURITY · DATA · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000235AWS · CONTAINERD · CRI PLUGINHIGHACTION REQUIRED4H AGO

AWS discloses five containerd CRI plugin CVEs affecting EKS, ECS, Fargate, Bottlerocket

AWS published a security bulletin describing five vulnerabilities in the containerd CRI plugin (versions 1.7 through 2.3) that affect AWS managed container services including EKS, ECS, Fargate, Bottlerocket, and Amazon Linux. The flaws include image cache poisoning via checkpoint references (CVE-2026-50195, CVSS 8.8), unsanitized image LABEL propagation enabling host command execution (CVE-2026-53488, CVSS 8.3), CDI annotation injection bypassing device enforcement (CVE-2026-53492, CVSS 6.8), symlinked log path exploitation for arbitrary host file read (CVE-2026-53489, CVSS 6.5), and a memory exhaustion DoS from crafted images (CVE-2026-47262, CVSS 6.5). Fixes are available upstream, and AWS is deploying patched runtimes across managed fleets while self-managed users must patch independently.

SECURITY · CLOUD · DEVOPS · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000236AWS · S2N-TLSHIGHACTION REQUIRED4H AGO

s2n-tls fixes TLS 1.3 record-drop flaw and QUIC memory leak (CVE-2026-16317/16318)

AWS disclosed two vulnerabilities in the open-source s2n-tls library affecting versions up to v1.7.5, both fixed in v1.7.6. CVE-2026-16317 allows an active man-in-the-middle to silently drop TLS 1.3 application data records undetected due to missing validation of the outer content_type byte. CVE-2026-16318 causes a memory leak in QUIC-enabled TLS 1.3 connections during HelloRetryRequest handshakes due to incorrect memory allocation handling.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICESVIEW SHIFT

SW-000237AMAZON WEB SERVICES · STRANDS AGENTS TOOLS · STRANDS-AGENTS-TOOLS PACKAGEHIGHACTION REQUIRED4H AGO

CVE-2026-19111: IDOR in Strands Agents Tools memory tools enables cross-tenant data access

An insecure direct object reference vulnerability (CVE-2026-19111) in the strands-agents-tools package's mongodb_memory, elasticsearch_memory, and mem0_memory tools lets a remote authenticated user manipulate the namespace parameter via a crafted LLM prompt to read, modify, or delete another tenant's memories, or inject false memories. The standalone mongodb_memory and elasticsearch_memory functions also expose connection parameters that could redirect the memory layer to an attacker-controlled cluster. Versions before 0.8.3 are affected; 0.8.3 fixes the issue.

AI · SECURITY · DATA · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICESVIEW SHIFT

SW-000238CISCO · NX-OS SOFTWARE · MDS 9000 SERIES, NEXUS 3000/7000/9000 SERIES, UCS 6300/6400/6500/6600 SERIES AND UCS X-SERIES FABRIC INTERCONNECTSCRITICALACTION REQUIRED4H AGO

Cisco discloses six internally found NX-OS vulnerabilities, max CVSS 9.8, fixes available

Cisco's internal security review of NX-OS Software identified six vulnerabilities (CVE-2026-76453, -76455 through -76459) spanning improper neutralization, improper access control, improper input validation, out-of-bounds read, improper exception handling, and out-of-bounds write (CWE-707, CWE-20, CWE-284, CWE-125, CWE-703, CWE-787). The highest CVSS base score is 9.8. These were discovered during internal testing (including use of frontier AI models) and are not known to be publicly announced or exploited. No workarounds exist; Cisco has released fixed software for affected platforms.

NETWORK · SECURITY · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000239CISCO · CISCO FINESSEMEDIUMACTION REQUIRED4H AGO

Cisco Finesse RFI flaw (CVE-2026-20175) allows browser-based attacks via crafted link

Cisco disclosed a medium-severity remote file inclusion vulnerability (CVE-2026-20175) in Cisco Finesse caused by insufficient validation of user-supplied input in HTTP requests. An unauthenticated remote attacker could persuade a user to click a crafted link to load arbitrary remote files into an active session, enabling browser-based attacks, script execution in the affected interface, or access to sensitive information. No workarounds exist; Cisco has released fixed software.

SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000240CISCO · PACKAGED CONTACT CENTER ENTERPRISE (PCCE) AND UNIFIED CONTACT CENTER ENTERPRISE (UCCE)MEDIUMACTION REQUIRED4H AGO

Cisco patches XSS flaws in Packaged/Unified CCE management interface

Cisco disclosed two cross-site scripting (XSS) vulnerabilities (CVE-2026-20055, CVE-2026-20109) in the web-based management interface of Packaged Contact Center Enterprise and Unified Contact Center Enterprise. An authenticated administrative attacker could inject malicious script to execute arbitrary code or access browser-based data in the context of the interface. No workarounds exist; fixed software is available. Cisco PSIRT is not aware of public exploitation.

SECURITY · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000241CISCO · CISCO CROSSWORK NETWORK CONTROLLERMEDIUMACTION REQUIRED4H AGO

Cisco Crosswork Network Controller fixes server-side template injection flaw (CVE-2026-20220)

Cisco disclosed a medium-severity vulnerability (CVSS 6.3) in the web-based management interface of Crosswork Network Controller caused by insufficient input validation in the configuration template engine. An authenticated attacker with template user write permissions could execute arbitrary commands on the underlying OS, limited to file system areas where that user has write access. No workarounds exist; Cisco has released fixed software.

NETWORK · SECURITY · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000242CISCO · CISCO UMBRELLA VIRTUAL APPLIANCE · CISCO UMBRELLA VIRTUAL APPLIANCEMEDIUMACTION REQUIRED4H AGO

Cisco patches privilege escalation flaw in Umbrella Virtual Appliance vmadmin CLI

Cisco disclosed CVE-2026-20246, a medium-severity (CVSS 6.0) privilege escalation vulnerability in the vmadmin CLI of Cisco Umbrella Virtual Appliance. The flaw stems from insufficient validation of user-supplied commands and allows an authenticated, local attacker with vmadmin privileges to elevate to root. Cisco has released fixed software and reports no workarounds and no known public exploitation.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000243AMAZON WEB SERVICES · AWS COMMON RUNTIME · AWS-C-HTTPHIGHACTION REQUIRED4H AGO

AWS discloses CVE-2026-12043 heap double-free in aws-c-http HTTP/2 handling

AWS published security bulletin 2026-043-AWS describing CVE-2026-12043, a heap double-free vulnerability in the aws-c-http library caused by improper handling of HPACK dynamic table size updates. A malicious HTTP/2 server could send a crafted sequence of HEADERS frames to corrupt memory on a connecting client, with potential for arbitrary code execution. The issue affects aws-c-http versions 0.4.22 through 0.10.15 and is fixed in 0.11.0.

SECURITY · NETWORK · DEVOPS · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000244AWS · AWS OPS WHEELCRITICALACTION REQUIRED4H AGO

AWS Ops Wheel v2 flaws allow unauthenticated admin access (CVE-2026-6911, CVE-2026-6912)

AWS published a security bulletin for AWS Ops Wheel, an open-source CloudFormation-deployed tool, describing two vulnerabilities in its v2 deployment: a missing JWT signature verification flaw and an overly permissive Cognito attribute write configuration. Both were fixed in subsequent pull requests, and AWS recommends redeploying from the latest version.

SECURITY · IDENTITY · CLOUD · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000245AWS · AWSLABS.AWS-API-MCP-SERVER · AWS API MCP SERVERHIGHACTION REQUIRED5H AGO

AWS API MCP Server CVE-2026-16584: startup failure can bypass security policy checks

AWS disclosed CVE-2026-16584 affecting the open-source AWS API MCP Server (awslabs.aws-api-mcp-server), versions >=0.2.13 and <1.3.47. If the server's security-policy enforcement data fails to load at startup, the server continues running with per-request policy checks skipped for the life of the process, allowing denied or gated AWS CLI operations to execute unchecked. IAM permissions remain enforced and are unaffected. The issue is fixed in version 1.3.47.

SECURITY · AI · CLOUD · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000246AWS · AMAZON BEDROCK AGENTCORE · BEDROCK AGENTCORE PYTHON SDK (BEDROCK-AGENTCORE)HIGHACTION REQUIRED5H AGO

CVE-2026-15737: AgentCore Python SDK leaked prompts via OpenTelemetry spans

AWS disclosed CVE-2026-15737 affecting the Bedrock AgentCore Python SDK (bedrock-agentcore) versions 1.4.8 and 1.5.0. The SDK's OpenTelemetry instrumentation wrote raw user prompts and full agent responses into span attributes on every invocation without filtering, exposing this data in the customer's aws/spans CloudWatch log group to any local authenticated user with CloudWatch Logs read access.

SECURITY · AI · CLOUD · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000247SIEMENS · WTV676 AND WTV776MEDIUMACTION REQUIRED5H AGO

Siemens WTV676/WTV776 denial-of-service flaw lets attacker disable Web Access (CVE-2026-89207)

Siemens WTV676 and WTV776 devices with Web Interface versions below V3.94 and V4.17 respectively contain an improper input validation vulnerability (CVE-2026-89207, CVSS 3.1 base score 6.5, medium) that allows an unauthenticated remote attacker to force the device into protection mode, disabling remote Web Access connectivity. Siemens has released fixed versions and recommends updating.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CISA (REPUBLISHING SIEMENS PRODUCTCERT SSA-823812)VIEW SHIFT

SW-000248AWS · KUBERNETES · AMAZON EFS CSI DRIVERHIGHACTION REQUIRED5H AGO

AWS discloses mount option injection flaw in EFS CSI Driver (CVE-2026-6437)

AWS published a security bulletin describing CVE-2026-6437, a vulnerability in the Amazon EFS CSI Driver that allows a user with PersistentVolume creation privileges to inject arbitrary mount options through two unsanitized fields. The issue affects versions up to and including v3.0.0 and is fixed in v3.0.1.

STORAGE · SECURITY · CLOUD · DEVOPS · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000249AMAZON WEB SERVICES (AWS) · AMAZON Q DEVELOPER IDE PLUGINS · LANGUAGE SERVERS FOR AWSHIGHACTION REQUIRED5H AGO

AWS patches trust-boundary and symlink flaws in Q Developer language servers

AWS disclosed two vulnerabilities, CVE-2026-12957 and CVE-2026-12958, in Language Servers for AWS, the runtime underlying Amazon Q Developer's AI coding assistant across its VS Code, JetBrains, Eclipse, and Visual Studio IDE plugins. CVE-2026-12957 is an improper trust boundary enforcement issue (versions before 1.65.0) allowing automatic execution of commands from a maliciously crafted workspace's project configuration files if a user trusts the workspace when prompted. CVE-2026-12958 is a missing symlink-validation issue (versions before 1.69.0) that can let a crafted symlink in a workspace resolve to a file path outside the trust boundary. Both are fixed in Language Servers for AWS version 1.69.0 and the corresponding Amazon Q Developer plugin releases. No workarounds exist.

SECURITY · DEVOPS · AI · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICESVIEW SHIFT

SW-000216CISCO · NX-OS SOFTWARE · NEXUS 3000 AND 9000 SERIES SWITCHESCRITICALACTION REQUIRED3D AGO

Critical RCE flaw in MPLS OAM on Cisco Nexus 3000/9000 NX-OS switches (CVE-2026-76465)

Cisco disclosed a critical vulnerability (CVSS 9.8) in the MPLS OAM feature of NX-OS Software affecting Nexus 3000 Series Switches and Nexus 9000 Series Switches in standalone NX-OS mode. An unauthenticated remote attacker can send a crafted MPLS echo-request to execute arbitrary code with root privileges or cause a denial of service. No workarounds exist; Cisco has released fixed software and a temporary Live Protect shield mitigation.

NETWORK · SECURITY · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000202CISCO · CISCO IDENTITY SERVICES ENGINE (ISE) AND ISE PASSIVE IDENTITY CONNECTOR (ISE-PIC)MEDIUMACTION REQUIRED3D AGO

Cisco ISE and ISE-PIC path traversal flaw lets admins read or delete arbitrary files

Cisco disclosed a medium-severity path traversal vulnerability (CVE-2026-20146) in Cisco Identity Services Engine (ISE) and ISE-PIC. An authenticated attacker with valid administrative credentials could send a crafted HTTP request to read or delete arbitrary files on the underlying OS due to improper input validation. No workarounds exist; fixed patches are planned for September 2026 across supported release trains.

IDENTITY · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000203CISCO · CISCO IDENTITY SERVICES ENGINE (ISE) AND ISE PASSIVE IDENTITY CONNECTOR (ISE-PIC)CRITICALACTION REQUIRED3D AGO

Cisco patches critical RCE and high-severity info-disclosure flaws in ISE/ISE-PIC

Cisco disclosed two independent vulnerabilities in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC): CVE-2026-20181, a critical (CVSS 9.1) authenticated remote code execution flaw allowing privilege escalation to root, and CVE-2026-20190, a high-severity (CVSS 7.5) unauthenticated information disclosure flaw exposing sensitive data including hashed credentials. No workarounds exist; Cisco has released fixed software for both issues.

SECURITY · IDENTITY · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000205AWS · JSII-DIFF (AWS JSII)HIGHACTION REQUIRED3D AGO

CVE-2026-15895: OS command injection in jsii-diff versions before 1.131.0

AWS disclosed CVE-2026-15895, an OS command injection vulnerability in jsii-diff, a CLI tool used to compare API differences between jsii assemblies. Specially formatted command line arguments can be used to execute arbitrary shell commands. The issue affects jsii-diff versions prior to 1.131.0 and is fixed in that version.

DEVOPS · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000206CISCO · SECURE ENDPOINT CONNECTOR (WINDOWS, LINUX, MAC) AND SECURE ENDPOINT PRIVATE CLOUD · CISCO SECURE ENDPOINTHIGHACTION REQUIRED3D AGO

Cisco patches multiple ClamAV DoS vulnerabilities in Secure Endpoint Connector

Cisco disclosed seven ClamAV vulnerabilities (CVE-2026-20213 through CVE-2026-20217, CVE-2026-20243, CVE-2026-20244) affecting the ClamAV scanning engine used by Cisco Secure Endpoint Connector on Windows, Linux, and Mac. The flaws stem from improper boundary checks and temporary resource handling in file format parsers (InstallShield, PE, FSG, 7z, PESpin, ALZ, DMG), allowing an unauthenticated remote attacker to crash the ClamAV scanning process and cause a denial of service. No workarounds exist; Cisco has released fixed software for affected connector versions.

SECURITY · ENDPOINT · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000207CISCO · CISCO UNIFIED COMMUNICATIONS MANAGER (UNIFIED CM) AND UNIFIED CM SESSION MANAGEMENT EDITION (UNIFIED CM SME)CRITICALACTION REQUIRED3D AGO

Cisco Unified CM SSRF flaw (CVE-2026-20230) under active exploitation, rated Critical

Cisco disclosed a server-side request forgery vulnerability in Unified Communications Manager and Unified CM SME caused by improper input validation of HTTP requests when the WebDialer service is enabled. An unauthenticated remote attacker could exploit it to write files to the underlying OS, potentially escalating to root. Cisco has confirmed active exploitation in the wild as of June 2026 and released fixed software; no workarounds exist, though disabling WebDialer mitigates risk.

COLLABORATION · SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000208GRID PROTECTION ALLIANCE · INDUSTRIAL CONTROL SYSTEMS · OPENPDC AND OPENHISTORIANCRITICALACTION REQUIRED3D AGO

CISA Details Six Vulnerabilities in GPA openPDC and openHistorian, Up to CVSS 9.8

CISA published ICS advisory ICSA-26-281-02 on October 8, 2026 describing six vulnerabilities (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022, CVE-2026-105278) affecting Grid Protection Alliance's openPDC (<2.9.477 and <2.9.482, including the Docker image) and openHistorian (<2.8.580 and <2.8.585). Issues include unauthenticated/deserialization-based remote code execution, unauthenticated data publisher interfaces, SSRF via a Modbus connection feature, and a hard-coded administrative credential in the Docker image. GPA has released patched versions for openPDC and openHistorian and changed default network bindings; no fix is planned for the Docker image.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)VIEW SHIFT

SW-000209RED LION CONTROLS · N-TRON 700 SERIESHIGHACTION REQUIRED3D AGO

CISA details 7 vulnerabilities in Red Lion N-Tron 700 Series industrial switches

CISA published ICS advisory ICSA-26-281-01 describing seven vulnerabilities in Red Lion Controls' N-Tron 700 Series industrial switches, affecting firmware versions up to 3.11.0 and bootloader versions up to 2.0.6.1. The flaws include hard-coded and weakly protected credentials, unauthenticated SNMP-based administrative actions, unauthenticated firmware/bootloader updates, a remotely triggerable reboot condition, and a physical-access authentication bypass. CVSS v3 scores range up to 8.3 (High) and CVSS v4 scores up to 9.3 (Critical). The reporter was Idaho National Laboratory; no known public exploitation has been reported.

NETWORK · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)VIEW SHIFT

SW-000210CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)HIGHACTION REQUIRED3D AGO

CISA, FBI, allies warn Integrity Technology Group enables Chinese state data-theft campaign

A joint advisory from the FBI, CISA, NSA, and international partners (AA26-281A, published Oct 8, 2026) details how the China-based Integrity Technology Group enables Chinese government-linked threat actors—associated with Flax Typhoon, Ethereal Panda, and Red Juliett activity—to exploit networks worldwide, including US critical infrastructure in government, critical manufacturing, healthcare, and IT sectors. The actors combine open-source scanning tools, a custom scanner called MicroScan, XSS-based credential harvesting, password spraying/guessing against Microsoft Exchange via the EBurst tool, SoftEther VPN for persistence, and custom scripts (Curlc4.txt, DC.exe, office-cli) to exfiltrate emails, credentials, and Active Directory data. Eight historical CVEs are listed as exploited via MicroScan scripts.

SECURITY · NETWORK · EMAIL · IDENTITY · ENDPOINT · SECURITY ADVISORY · VULNERABILITYSOURCE CISA (JOINT ADVISORY WITH FBI, NSA, NCSC-UK, ASD'S ACSC, CANADIAN CENTRE FOR CYBER SECURITY, JAPAN NPA/NCO, NCSC-NZ, AND SPAIN'S CNI)VIEW SHIFT

SW-000211SATEL · SATEL NETCO DESIGNHIGHACTION REQUIRED3D AGO

CISA advisory: Satel Netco Design vulnerable to XSS, ReDoS, and path traversal flaws

CISA published an ICS advisory detailing four vulnerabilities in Satel Netco Design versions prior to v2.1.7, including stored cross-site scripting, inefficient regular expression complexity (ReDoS), and two relative path traversal issues affecting data import and export functionality. The highest-severity flaw (CVE-2026-101024) carries a CVSS v3.1 score of 8.8 and could allow unauthorized file creation, modification, or arbitrary code execution. Satel advises updating to v2.1.7.

SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISAVIEW SHIFT

SW-000212AMAZON WEB SERVICES · AMAZON AGENT PLUGINS FOR AWS · DATABASES-ON-AWS PLUGINHIGHACTION REQUIRED3D AGO

OS command injection flaw (CVE-2026-107322) in AWS databases-on-aws plugin before 1.7.1

AWS disclosed CVE-2026-107322, an OS command injection vulnerability in the databases-on-aws plugin for Amazon Agent Plugins for AWS, affecting versions 1.0.0 through 1.7.0. An incomplete input denylist could let a remote unauthenticated actor supply crafted content that, if an AI coding agent later passes it to the local psql connection helper, results in command execution on the host with the helper process's permissions. The Aurora DSQL service itself and database privilege enforcement are not affected. A fix is available in version 1.7.1 (or commit 8b13a503746a4ebb0402b936645163224058bde3 and later for pinned revisions), released August 26, 2026.

EFFECTIVE AUG 26, 2026SECURITY · DATA · DEVOPS · AI · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICESVIEW SHIFT

SW-000213CISCO · CISCO LICENSE ON-PREM (FORMERLY SMART SOFTWARE MANAGER ON-PREM) · CISCO LICENSE ON-PREMCRITICALACTION REQUIRED3D AGO

Cisco patches critical arbitrary password reset flaw in License On-Prem (CVE-2026-20328, CVSS 9.1)

Cisco disclosed four vulnerabilities in Cisco License On-Prem (formerly SSM On-Prem) affecting the web-based management interface and API endpoints. The most severe, CVE-2026-20328, allows an unauthenticated remote attacker to reset the password of any account, including administrators, granting full unauthorized access. A second critical flaw, CVE-2026-76454, allows an unauthenticated attacker to write arbitrary files or cause denial of service via the Smart Licensing Utility API. Two medium-severity flaws (CVE-2026-76437 command injection, CVE-2026-76452 SQL injection) require existing administrative credentials to exploit. No workarounds exist; Cisco has released fixed software. Cisco Smart Licensing Utility is confirmed not affected.

SECURITY · IDENTITY · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000214AMAZON WEB SERVICES · AWS-CDK-LIB · AWS CDKHIGHACTION REQUIRED3D AGO

CVE-2026-107608: Symlink injection in AWS CDK Docker asset bundling before v2.267.0

AWS disclosed CVE-2026-107608 affecting all aws-cdk-lib versions prior to 2.267.0. A malicious or misconfigured Docker file used during AWS CDK asset bundling could insert symlinked files or directories into the bundling output without those symlinks being part of the original input, potentially exposing unexpected file content. The issue is fixed in aws-cdk-lib 2.267.0.

DEVOPS · SECURITY · SECURITY ADVISORY · VULNERABILITYSOURCE AWSVIEW SHIFT

SW-000215CISCO · NX-OS SOFTWARE · NEXUS 3000 SERIES SWITCHES, NEXUS 9000 SERIES SWITCHES (STANDALONE NX-OS MODE), UCS 6300 SERIES FABRIC INTERCONNECTSCRITICALACTION REQUIRED3D AGO

Cisco NX-OS NX-API flaw allows unauthenticated root RCE, CVSS 9.8

Cisco disclosed a critical vulnerability (CVE-2026-76471) in the NX-API feature of NX-OS Software affecting Nexus 3000, Nexus 9000 (standalone mode), and UCS 6300 Series Fabric Interconnects. Insufficient input validation of data sent to NX-API could let an unauthenticated remote attacker execute arbitrary code with root privileges or cause a denial of service. No workarounds exist; fixed software has been released. Cisco PSIRT is unaware of public exploitation.

NETWORK · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000217CISCO · CISCO APPLICATION POLICY INFRASTRUCTURE CONTROLLER (APIC)MEDIUMACTION REQUIRED3D AGO

Cisco APIC API command injection flaw (CVE-2026-20321) allows root-level command execution

Cisco disclosed a medium-severity vulnerability (CVSS 6.5) in the web-based management API of Cisco Application Policy Infrastructure Controller (APIC). An authenticated remote attacker with valid administrative credentials could exploit insufficient input validation of user-controlled command arguments to execute arbitrary commands as root on the underlying OS. No workarounds exist; Cisco has released fixed software. Cisco PSIRT is not aware of any public exploitation.

NETWORK · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000218CISCO · CISCO FINESSEHIGHACTION REQUIRED3D AGO

Cisco Finesse SSRF flaw (CVE-2026-20362) allows unauthenticated remote attacks

Cisco disclosed a server-side request forgery (SSRF) vulnerability in the web-based management interface of Cisco Finesse, caused by improper input validation of certain HTTP requests. An unauthenticated remote attacker can send a crafted HTTP request to obtain limited sensitive information about services associated with the affected device. CVSS base score is 7.2 (High). No workarounds exist; fixed releases are planned for early 2027.

SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000219CISCO · NX-OS SOFTWARE · MDS 9000 SERIES, NEXUS 3000 SERIES, NEXUS 7000 SERIES, NEXUS 9000 SERIES (STANDALONE NX-OS MODE)MEDIUMACTION REQUIRED3D AGO

Cisco NX-OS Python sandbox escape flaw (CVE-2026-20032) allows local privilege escalation

Cisco disclosed a medium-severity vulnerability (CVSS 4.4) in the Python interpreter of NX-OS Software affecting MDS 9000, Nexus 3000, Nexus 7000, and standalone-mode Nexus 9000 switches. An authenticated local attacker with low-privilege Python execution rights could escape the Python sandbox and run arbitrary commands on the underlying OS with their own privilege level. No workarounds exist; Cisco has released fixed software and a temporary 'Live Protect' shield mitigation for new CLI sessions. No public exploitation has been observed.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000220CISCO · CISCO APPLICATION POLICY INFRASTRUCTURE CONTROLLER (APIC)MEDIUMACTION REQUIRED3D AGO

Cisco APIC vulnerability allows authenticated admin to access sensitive files (CVE-2026-76488)

Cisco disclosed a medium-severity vulnerability (CVSS 6.5) in the export policies functionality of Cisco Application Policy Infrastructure Controller (APIC) caused by insufficient access control to file system resources. An authenticated remote attacker with valid administrative credentials could submit crafted values in specific UI fields to access sensitive files, including key materials, potentially enabling privilege escalation to root on the affected APIC and on managed switches. Cisco has released fixed software; no workarounds exist.

SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000201CLOUDFLARE · CLOUDFLARE DASHBOARD · DNSINFORMATIONAL4D AGO

Cloudflare dashboard now warns at 85% of DNS records quota usage

Cloudflare has added a warning to the DNS records page in its dashboard that appears once a zone or account has used 85% of its DNS records quota. The warning reflects either zone-level or account-level quota depending on which applies to the customer.

EFFECTIVE OCT 6, 2026NETWORK · FEATURE RELEASESOURCE CLOUDFLAREVIEW SHIFT

SW-000184ANTHROPIC · PLATFORM.CLAUDE.COM · CLAUDE CONSOLELOW5D AGO

Claude Console reports elevated errors in usage data display and Admin API usage report

Anthropic's status page reported an ongoing incident where the platform.claude.com Usage and Rate limits pages, along with the Admin API usage report, are experiencing elevated errors. Core Claude functionality remains unaffected.

EFFECTIVE OCT 7, 2026AI · BILLING · SERVICE INCIDENTSOURCE CLAUDE (ANTHROPIC STATUS PAGE)VIEW SHIFT

SW-000185MICROSOFT · MICROSOFT 365 · EXCHANGE ONLINEMEDIUMACTION REQUIRED5D AGO

Exchange Online incident quarantined DocuSign-link emails due to false-positive URL reputation

A Microsoft URL evaluation/ML model incorrectly flagged emails containing DocuSign URLs as potentially malicious, causing some messages to be delayed, not delivered, or quarantined. Microsoft added affected URLs to an allow list, reprocessed messages, manually mitigated remaining cases, and adjusted the ML model. The issue is marked resolved as of October 1, 2026 23:59 UTC, with final validation completed by October 5, 2026.

EFFECTIVE SEP 28, 2026EMAIL · SECURITY · SERVICE INCIDENTSOURCE MICROSOFTVIEW SHIFT

SW-000183CLOUDFLARE · CLOUDFLARE ONE · CLOUDFLARE WAN, MAGIC TRANSITINFORMATIONAL5D AGO

Cloudflare makes BGP over IPsec and GRE tunnels generally available for WAN, Magic Transit

Cloudflare announced general availability of BGP peering over IPsec and GRE tunnels for Cloudflare WAN and Magic Transit, enabling dynamic route exchange instead of manual static route updates. The feature is available to all accounts using Unified Routing with no enablement required; BGP over CNI remains in closed beta.

EFFECTIVE OCT 5, 2026NETWORK · FEATURE RELEASE · SERVICE CHANGESOURCE CLOUDFLAREVIEW SHIFT

SW-000182CLOUDFLARE · CLOUDFLARE WAF · CLOUDFLARE MANAGED RULESETHIGHACTION REQUIRED5D AGO

Cloudflare WAF adds detection for F5 BIG-IP CVE-2026-94127 and updates injection rule

Cloudflare's October 6, 2026 Managed Ruleset release adds a new rule detecting CVE-2026-94127, a heap-based buffer overflow in F5 BIG-IP that can allow arbitrary code execution, with action set to Block. It also merges tested beta logic into the existing 'Command Injection - Generic 8 - uri' rule, changing its action from Log to Block. A separate rule for Next.js cache poisoning (CVE-2026-94543) had only its metadata description refined, with detection and action (Block) unchanged.

EFFECTIVE OCT 6, 2026SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITY · BEHAVIOR CHANGESOURCE CLOUDFLAREVIEW SHIFT

SW-000181AMAZON WEB SERVICES · AMAZON BEDROCK AGENTCORE · BEDROCK-AGENTCORE-STARTER-TOOLKITHIGHACTION REQUIRED5D AGO

AWS fixes code injection and SSRF flaws in Bedrock AgentCore Starter Toolkit

AWS disclosed two vulnerabilities, CVE-2026-105812 (code injection) and CVE-2026-106032 (external reference handling causing SSRF or local file access), in the open-source bedrock-agentcore-starter-toolkit Python package used to import Amazon Bedrock Agents into local environments. Versions 0.1.4 through 0.3.13 are affected; version 0.3.14 contains the fix.

AI · SECURITY · DEVOPS · VULNERABILITY · SECURITY ADVISORY · DEPRECATIONSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000161MICROSOFT · EXCHANGE ONLINE · OUTLOOK ON THE WEB; NEW OUTLOOK DESKTOP CLIENTMEDIUMACTION REQUIRED7D AGO

Outlook web and new Outlook desktop intermittently fail to load calendar events

Microsoft reports an ongoing Exchange Online service incident (EX1483540) in which users intermittently cannot access their calendars in Outlook on the web and the new Outlook desktop client, receiving the error 'Can't retrieve calendar events right now. Refresh the browser and try again.' Microsoft has identified the root cause as a calendar cache issue following a refresh, where the event-loading process continues referencing outdated data after folder information updates. A fix has been implemented and merged, with rollout to affected users expected by October 9, 2026.

DEADLINE OCT 9, 2026EMAIL · COLLABORATION · SERVICE INCIDENTSOURCE MICROSOFTVIEW SHIFT

SW-000160KASEYA · DATTO RMM · DATTO RMM MACOS AGENTHIGHACTION REQUIRED7D AGO

Datto RMM macOS agent connectivity issue identified; fix deployed across all platforms

Kaseya reported a connectivity issue affecting Datto RMM macOS agents across all supported regions (EU1, EU2, US West, US East, APAC). Newly installed macOS agents could not connect, and existing agents could go offline if the host device was restarted. After investigating with Apple, Kaseya developed and deployed a fix to all platforms, and is now monitoring to confirm recovery; some macOS agents may still require manual remediation.

EFFECTIVE OCT 2, 2026ENDPOINT · NETWORK · SERVICE INCIDENT · BEHAVIOR CHANGESOURCE KASEYA INCVIEW SHIFT

SW-000126LWIP · LWIP TCP/IP STACK MQTT CLIENT APPLICATIONCRITICALACTION REQUIRED11D AGO

CISA advisory: critical out-of-bounds write in lwIP MQTT Client Application (CVE-2026-87121)

CISA published an ICS advisory for a critical out-of-bounds write vulnerability (CVE-2026-87121) affecting lwIP MQTT Client Application versions >=2.0.1 and <=2.2.1. Successful exploitation could allow an attacker to achieve full code execution on the affected device. CVSS v3.1 base score is 9.8 (Critical) and CVSS v4.0 score is 9.3 (Critical).

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)VIEW SHIFT

SW-000133GOOGLE CLOUD · GOOGLE CLOUD BACKUP AND DR · BACKUP AND DRMEDIUMACTION REQUIRED11D AGO

Google Cloud deprecates legacy appliance-based Backup and DR management console

Google Cloud has deprecated support for backing up and restoring workloads through the legacy Backup and DR appliance management console. Two milestones apply: new backups via the legacy stack stop after September 30, 2027, and standard restores, exports, and migrations via the legacy console stop after March 31, 2028.

DEADLINE SEP 30, 2027BACKUP · DEPRECATION · DEADLINE CHANGESOURCE GOOGLE CLOUDVIEW SHIFT

SW-000097CISCO · CISCO IDENTITY SERVICES ENGINE (ISE) / ISE-PIC · CISCO IDENTITY SERVICES ENGINECRITICALACTION REQUIRED11D AGO

Cisco ISE API authentication bypass flaw (CVE-2026-76460) actively exploited, CVSS 10.0

Cisco disclosed a critical authentication bypass vulnerability (CVE-2026-76460) in an API of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), affecting all device configurations. Cisco PSIRT confirmed active exploitation in the wild. No workarounds exist, though an iACL-based mitigation is available. Fixed patch releases are available for ISE/ISE-PIC 3.1 through 3.5.

IDENTITY · SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000131AWS · AWS TRANSFORM · AMAZON MSK (MANAGED STREAMING FOR APACHE KAFKA)INFORMATIONAL12D AGO

AWS Transform adds agentic migration assessments for Kafka-to-Amazon MSK moves

AWS Transform now offers agentic AI-driven migration assessments specifically for evaluating on-premises Apache Kafka clusters moving to Amazon MSK. The tool analyzes cluster inventories or chat-based descriptions to check compatibility, recommend right-sized MSK Express brokers, and generate a TCO business case with cost projections.

EFFECTIVE SEP 29, 2026CLOUD · AI · DEVOPS · FEATURE RELEASESOURCE AMAZON WEB SERVICESVIEW SHIFT

SW-000130CLOUDFLARE · WINDOWS · CLOUDFLARE ONE CLIENT (WARP)LOW12D AGO

Cloudflare releases Windows WARP client beta 2026.8.2028.1 with fixes

Cloudflare published a new beta release of the Cloudflare One Client for Windows, available on the beta releases downloads page. The release bundles numerous reliability and bug fixes affecting tunnel connectivity, reauthentication, DNS, device posture checks, and client UI stability, along with one new routing capability for non-RFC 1918 local networks under MDM/policy control.

EFFECTIVE SEP 29, 2026ENDPOINT · NETWORK · SECURITY · FEATURE RELEASE · BEHAVIOR CHANGESOURCE CLOUDFLAREVIEW SHIFT

SW-000128APPLEINFORMATIONAL13D AGO

Apple's security releases page lists ongoing OS and app patch history with CVE links

This is Apple's continuously updated support page that indexes security-relevant software releases across iOS/iPadOS, macOS, tvOS, watchOS, visionOS, Safari, Xcode and various apps/firmware. Each entry links to an advisory with CVE-ID details where applicable; Apple states it does not disclose or discuss vulnerabilities until a fix is generally available. The page is a rolling historical log rather than a single announcement.

SECURITY · ENDPOINT · DOCUMENTATION CHANGE · SECURITY ADVISORYSOURCE APPLEVIEW SHIFT

SW-000127CLOUDFLARE · CLOUDFLARE CDN · CACHEINFORMATIONAL13D AGO

Cloudflare adds cache invalidation as alternative to full purge

Cloudflare introduced a new cache invalidation feature that marks cached content as stale instead of purging it outright. On the next request, Cloudflare revalidates with the origin and reuses the cached asset if the origin returns a 304 Not Modified response, reducing unnecessary re-downloads for unchanged assets sharing selectors like cache tags, URLs, hostnames, or prefixes.

EFFECTIVE SEP 28, 2026NETWORK · CLOUD · FEATURE RELEASE · BEHAVIOR CHANGESOURCE CLOUDFLAREVIEW SHIFT

SW-000125MICROSOFT · MICROSOFT 365 · COPILOT IN POWERPOINTINFORMATIONAL14D AGO

Brand Kit and Skills now available in Copilot in PowerPoint

Microsoft has released Brand Kit and Skills features for Copilot in PowerPoint, allowing organizations to embed approved branding and reusable workflow templates directly into AI-generated presentations.

COLLABORATION · AI · FEATURE RELEASESOURCE MICROSOFTVIEW SHIFT

SW-000124APPLE · VISIONOS 2.6 · APPLE VISION PROHIGHACTION REQUIRED14D AGO

visionOS 2.6 patches multiple memory-corruption and info-disclosure vulnerabilities

Apple released visionOS 2.6 on July 29, 2025, addressing numerous security vulnerabilities across components including afclip, CFNetwork, CoreAudio, CoreMedia, ICU, ImageIO, Kernel, libxml2, libxslt, Metal, Model I/O, SQLite, and WebKit. Fixes address memory corruption, unexpected app termination, denial-of-service, and information disclosure issues, several of which are tied to publicly assigned CVEs including some in open-source components shared across other Apple platforms. Some entries were added or updated as late as October 15, 2025.

EFFECTIVE JUL 29, 2025SECURITY · ENDPOINT · SECURITY ADVISORY · VULNERABILITYSOURCE APPLEVIEW SHIFT

SW-000122ATLASSIAN · ATLASSIAN ROVO MCP · JIRA AND CONFLUENCE (CLOUD)MEDIUMACTION REQUIRED14D AGO

Atlassian adds Rovo MCP server control to Data Security Policy for Jira and Confluence

Atlassian has introduced a new Data Security Policy (DSP) control that lets organization admins govern how external AI tools access Jira and Confluence data through the Model Context Protocol (MCP). The control supports org-wide defaults with overrides by app, space, and classification level, and behaves like existing DSP controls such as data export and public links.

EFFECTIVE SEP 29, 2026SECURITY · GOVERNANCE · AI · CLOUD · FEATURE RELEASE · POLICY CHANGESOURCE ATLASSIANVIEW SHIFT

SW-000079CISCO · CISCO IDENTITY SERVICES ENGINE (ISE) AND ISE PASSIVE IDENTITY CONNECTOR (ISE-PIC) · CISCO IDENTITY SERVICES ENGINEMEDIUMACTION REQUIRED14D AGO

Cisco patches four ISE/ISE-PIC flaws allowing posture spoofing, data leaks, cert reload

Cisco disclosed four independent vulnerabilities (CVE-2026-76439, -76444, -76446, -76447) in Cisco ISE and ISE-PIC affecting the guest portal, an internal PRRT service, the OCSP responder, and an API vulnerable to XML external entity injection. Cisco has released fixed software for all four issues; no workarounds exist. The advisory carries a Medium severity rating with CVSS base scores between 4.9 and 5.3.

SECURITY · IDENTITY · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000119CITRIX · NETSCALERCRITICALACTION REQUIRED14D AGO

CISA adds two actively exploited Citrix NetScaler CVEs to KEV Catalog

CISA added CVE-2026-88771 and CVE-2026-88772, both affecting Citrix NetScaler, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation. The alert reiterates that under Binding Operational Directive (BOD) 26-04, FCEB agencies must prioritize remediation of KEV-listed vulnerabilities on internet-exposed assets, especially those enabling full post-exploitation control.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)VIEW SHIFT

SW-000118CITRIX · CITRIX NETSCALER ADC AND CITRIX NETSCALER GATEWAYCRITICALACTION REQUIRED14D AGO

CISA flags active exploitation of critical zero-days in Citrix NetScaler ADC and Gateway

CISA is amplifying Citrix's disclosure of eight new vulnerabilities (CVE-2026-88771 through CVE-2026-88778) affecting Citrix NetScaler ADC and NetScaler Gateway. Two of these, CVE-2026-88771 and CVE-2026-88772, are critical zero-days that independently allow remote code execution and have been added to CISA's Known Exploited Vulnerabilities catalog based on confirmed active exploitation.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)VIEW SHIFT

SW-000107GOOGLE CLOUD · APIGEE HYBRID · APIGEE HYBRID V1.15MEDIUMACTION REQUIRED17D AGO

Apigee hybrid 1.15.8 upgrade requires Helm, kubectl, cert-manager updates and may need downtime

Google Cloud's Apigee hybrid documentation describes the procedure for upgrading from version 1.14.x or earlier 1.15.x releases to version 1.15.8. The upgrade introduces stricter JavaCallout class instantiation checks, new large message payload support, monetization fee support, and wildcard basepath support. It requires Helm v3.14.2+, a supported cert-manager version, and may require Kubernetes platform upgrades and cluster downtime.

CLOUD · DEVOPS · REQUIREMENT CHANGE · BEHAVIOR CHANGE · SERVICE CHANGESOURCE GOOGLE CLOUDVIEW SHIFT

SW-000106AWS · S2N-QUIC · S2N-QUICHIGHACTION REQUIRED17D AGO

s2n-quic CVE-2026-94450: DoS via crafted Retry packet UDP datagram

AWS published a security bulletin for CVE-2026-94450 affecting the open-source s2n-quic Rust QUIC implementation. Servers configured to issue QUIC Retry packets fail to properly validate the Destination Connection ID length, letting an unauthenticated attacker crash the server endpoint with a single crafted UDP datagram. The issue is fixed in s2n-quic 1.89.0. AWS states no AWS services are affected and AWS service customers need not act; impact is limited to server deployments that explicitly enable Retry packet issuance.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000105AWS · PGCOLLECTIONHIGHACTION REQUIRED17D AGO

CVE-2026-96883: Type confusion bug in AWS pgcollection extension enables RCE

AWS disclosed CVE-2026-96883, a type confusion vulnerability in the open-source pgcollection PostgreSQL extension affecting versions 2.0.0 through 2.1.1. An authenticated database user can trigger the flaw by requesting a stored icollection value as an incompatible type, causing the extension to misinterpret the datum representation, which can crash the PostgreSQL backend or lead to arbitrary code execution.

SECURITY · DATA · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000101AMAZON WEB SERVICES · AWS · AMAZON DYNAMODB GLOBAL TABLES (MULTI-REGION STRONG CONSISTENCY)LOW18D AGO

DynamoDB MRSC global tables add 5 Regions, now support cross-continent configs

AWS expanded multi-Region strong consistency (MRSC) support for DynamoDB global tables to five additional Regions (Canada Central, Stockholm, Spain, Mumbai, Singapore), bringing the total to 15 supported Regions. Customers can now create MRSC global tables in any three-Region configuration across these 15 Regions, including cross-continent setups spanning North America, Europe, and Asia Pacific, using either three replicas or two replicas plus a witness Region.

EFFECTIVE SEP 23, 2026CLOUD · DATA · FEATURE RELEASE · SERVICE CHANGESOURCE AMAZON WEB SERVICES (AWS)VIEW SHIFT

SW-000100AMAZON WEB SERVICES · AMAZON EKS · AMAZON EMR ON EKSLOW18D AGO

Amazon EMR on EKS adds support for IPv6 Amazon EKS clusters

AWS announced that Amazon EMR on EKS now supports running Apache Spark and Apache Flink workloads on IPv6-enabled Amazon EKS clusters, giving teams access to a larger address space for scaling analytics jobs.

EFFECTIVE SEP 23, 2026CLOUD · NETWORK · DATA · FEATURE RELEASESOURCE AWSVIEW SHIFT

SW-000099LWIP · LWIP (LIGHTWEIGHT IP) APIHIGHACTION REQUIRED18D AGO

CISA advisory: lwIP double free vulnerability CVE-2026-91018 rated CVSS 8.8

CISA published an ICS advisory for a double free vulnerability (CVE-2026-91018) in the lwIP (Lightweight IP) API, versions >=2.0.1 and <=2.2.1. Successful exploitation could cause a system crash, denial of service, memory corruption, or potentially code execution. The vulnerability is not exploitable remotely and no known public exploitation has been reported.

NETWORK · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISAVIEW SHIFT

SW-000096OPENAI · CHATGPTMEDIUM19D AGO

ChatGPT Plus and Pro users experienced elevated error rates, now resolved

OpenAI reported a service incident affecting ChatGPT for users on Plus and Pro subscription plans, causing elevated error rates in the Conversations component. The issue was identified, mitigated, and fully resolved within about 41 minutes.

EFFECTIVE SEP 23, 2026AI · SERVICE INCIDENTSOURCE OPENAIVIEW SHIFT

SW-000095MICROSOFT · AZUREINFORMATIONAL19D AGO

Azure updates page for this ID shows no matching update content

The retrieved Azure Updates page displays only the generic filter/sort interface and states '0 Updates found'. No specific product, feature, change description, or date information is present in the source content for this update ID.

CLOUD · FEATURE RELEASESOURCE MICROSOFT AZUREVIEW SHIFT

SW-000083CISCO · BROADWORKS · CISCO BROADWORKS COMMPILOT APPLICATION SOFTWAREMEDIUMACTION REQUIRED19D AGO

Cisco BroadWorks CommPilot authorization bypass allows config changes (CVE-2026-76438)

Cisco disclosed a medium-severity (CVSS 6.5) vulnerability in the web-based management interface of BroadWorks CommPilot Application Software caused by missing authorization checks. An authenticated, low-privileged remote attacker could send a crafted HTTP request to alter configurations on select pages. Fixed software is available; no workarounds exist. Cisco PSIRT is not aware of any public exploitation.

SECURITY · COLLABORATION · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000091CISCO · CISCO SECURE FIREWALL ADAPTIVE SECURITY APPLIANCE (ASA) SOFTWARE AND SECURE FIREWALL THREAT DEFENSE (FTD) SOFTWAREHIGHACTION REQUIRED19D AGO

Cisco ASA/FTD IKEv2 certificate authentication flaw allows unauthenticated DoS reload

Cisco disclosed a high-severity vulnerability (CVE-2026-20249) in the IKEv2 certificate authentication logic of Secure Firewall ASA and FTD Software. An unauthenticated remote attacker can send a crafted certificate during IKEv2 VPN connection setup to crash the IKEv2 process and force an unexpected device reload. No workarounds exist; Cisco has released fixed software releases across multiple ASA and FTD/FMC version trains.

SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000068SCHNEIDER ELECTRIC · POWERCHUTE SERIAL SHUTDOWNMEDIUMACTION REQUIRED19D AGO

Schneider Electric PowerChute Serial Shutdown fixes auth-attempt limit flaw in v1.6

Schneider Electric disclosed CVE-2026-13348, an Improper Restriction of Excessive Authentication Attempts vulnerability (CWE-307, CVSS 3.1 base score 5.3/MEDIUM) affecting PowerChute Serial Shutdown versions 1.5 and prior. The flaw allows an attacker to make unlimited authentication attempts to gain unauthorized access to a user account when redirect handling is disabled. Version 1.6 for Windows and Linux contains the fix and is available for download from Schneider Electric.

SECURITY · ENDPOINT · SECURITY ADVISORY · VULNERABILITYSOURCE CISAVIEW SHIFT

SW-000094AUTONOMY LOGIC · OPENPLC RUNTIME V3MEDIUMACTION REQUIRED19D AGO

XSS flaw in OpenPLC Runtime v3 allows session hijack and unauthorized PLC control

CISA published ICSA-26-265-09 describing CVE-2026-88020, a reflected cross-site scripting vulnerability (CWE-79) in OpenPLC Runtime v3 from Autonomy Logic. The web interface routes requests based on an unencoded query string parameter, allowing an attacker to hijack operator session cookies and issue state-changing requests, potentially gaining control of the PLC and the physical processes it drives. CVSS 3.1 base score is 6.1 (Medium); CVSS 4.0 score is 5.3 (Medium). OpenPLC v3 is end-of-life and no longer receives patches, bug fixes, or security updates.

SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISAVIEW SHIFT

SW-000088AMAZON WEB SERVICES · DEEP JAVA LIBRARY (DJL)HIGHACTION REQUIRED20D AGO

CVE-2026-85228: DJL tensor buffer integer overflow allows OOB read/DoS

AWS disclosed CVE-2026-85228, an integer overflow in the tensor buffer validation logic of the Deep Java Library (DJL), affecting versions 0.13.0 through 0.36.0 on all platforms. A crafted tensor shape can cause the computed byte size to wrap past the 32-bit signed integer range, letting an undersized buffer pass validation and leading to an out-of-bounds read during a later tensor operation.

AI · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000089PALO ALTO NETWORKS · LINUX · PRISMA ACCESS AGENTLOWACTION REQUIRED20D AGO

CVE-2026-0291: Prisma Access Agent on Linux allows local file deletion via symlink flaw

An improper link resolution (CWE-59, symlink attack) vulnerability in Prisma Access Agent versions prior to 26.2.2 on Linux allows a local low-privileged user to delete system files in a limited scope and disable the agent. Only the Linux version of the agent is affected; macOS, Windows, iOS, Android, and Chrome OS versions are not impacted. No malicious exploitation has been observed, and no configuration is required for exposure.

ENDPOINT · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE PALO ALTO NETWORKSVIEW SHIFT

SW-000090MITSUBISHI ELECTRIC · GX WORKS3 AND MOTION CONTROL SETTINGSHIGHACTION REQUIRED20D AGO

CVE-2026-15688 lets local attacker bypass block password in GX Works3, Motion Control Settings

CISA republished a Mitsubishi Electric advisory (2026-007) describing CVE-2026-15688, a CWE-303 Incorrect Implementation of Authentication Algorithm flaw affecting all versions of GX Works3 and its packaged Motion Control Settings component. A local attacker can authenticate despite an invalid block password by running the affected product and modifying part of the executable module in memory, enabling viewing, tampering with, destruction, or deletion of control programs.

SECURITY · ENDPOINT · VULNERABILITY · SECURITY ADVISORYSOURCE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)VIEW SHIFT

SW-000087CISCO · CISCO IDENTITY SERVICES ENGINE (ISE) · CISCO ISECRITICALACTION REQUIRED20D AGO

Cisco ISE fixes three authenticated vulnerabilities including critical SQL injection flaw

Cisco disclosed three vulnerabilities in Cisco Identity Services Engine (ISE) affecting the SXP REST API, IPsec Open API, and general write access to the underlying OS. CVE-2026-20284 (SXP REST API SQL injection, CVSS 9.1) is rated Critical; CVE-2026-20283 (IPsec Open API command injection, CVSS 6.5) and CVE-2026-20282 (authenticated write vulnerability, CVSS 4.9) are both rated High Security Impact despite lower CVSS scores because privilege escalation to root is easy. All require authenticated administrative access to exploit. Fixed software releases are available; a workaround exists only for CVE-2026-20283. ISE Passive Identity Connector (ISE-PIC) is confirmed not affected. Cisco PSIRT is aware of a public announcement but no known malicious exploitation.

IDENTITY · SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000073ABB · ABB ABILITY EDGENIUS GATEWAY - BE100 · ABB ABILITY EDGENIUSHIGHACTION REQUIRED21D AGO

ABB Ability Edgenius affected by Linux kernel privilege escalation flaw CVE-2026-31431

ABB Ability Edgenius versions >=3.2.0.0 and <3.2.4.1 contain a Linux kernel vulnerability (CVE-2026-31431, 'Copy Fail') in the algif_aead cryptographic interface that can allow a locally authenticated user or compromised container workload to escalate to root privileges. ABB has released version 3.2.4.1 to fix the issue and recommends applying the update as soon as possible.

SECURITY · ENDPOINT · VULNERABILITY · SECURITY ADVISORYSOURCE CISA (REPUBLISHING ABB PSIRT ADVISORY 7PAA024620)VIEW SHIFT

SW-000086HITACHI ENERGY · FACTS CONTROL PLATFORM (FCP)CRITICALACTION REQUIRED21D AGO

Hitachi Energy FCP with GWS component affected by five vulnerabilities, one CVSS 9.9

CISA republished a Hitachi Energy PSIRT advisory describing five vulnerabilities in FACTS Control Platform (FCP) versions deployed with the GWS component since 2020, including SVC Light, Series Capacitor, Static Var Compensator, and Hybrid Synchronous Condenser systems. Vulnerabilities include improper data query neutralization, path traversal, authentication bypass via session capture-replay, missing authentication for a network-exposed service, and open redirect. Deployments without GWS are not affected.

SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE CISAVIEW SHIFT

SW-000084AMAZON WEB SERVICES · AWS SYSTEMS MANAGER · AWS SYSTEMS MANAGER AGENT (SSM AGENT)HIGHACTION REQUIRED21D AGO

CVE-2026-89049: SSRF in SSM Agent port forwarding exposes IAM role credentials

AWS disclosed a server-side request forgery vulnerability in SSM Agent's Session Manager remote-host port forwarding feature. An authenticated user with port-forwarding permission could bypass the remote destination denylist to reach link-local endpoints and potentially retrieve the managed instance's temporary IAM role credentials, allowing actions with that role's permissions from outside the instance.

SECURITY · CLOUD · IDENTITY · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICESVIEW SHIFT

SW-000080AMAZON WEB SERVICES · AMAZON EKS · AWS-NETWORK-POLICY-AGENT (AMAZON EKS NETWORK POLICY AGENT)HIGHACTION REQUIRED22D AGO

CVE-2026-86831: NetworkPolicy bypass in EKS Network Policy Agent before v1.4.0

AWS disclosed CVE-2026-86831, a vulnerability in the Amazon EKS Network Policy Agent (aws-network-policy-agent) affecting versions before v1.4.0 and Amazon VPC CNI Managed Add-on versions 1.14.0 up to but not including 1.22.3, that can allow cross-namespace NetworkPolicy enforcement to be bypassed.

SECURITY · NETWORK · CLOUD · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000082MITSUBISHI ELECTRIC · CC-LINK IE TSN COMMUNICATION PROTOCOLHIGHACTION REQUIRED22D AGO

Mitsubishi Electric CC-Link IE TSN protocol flaw enables network DoS via data tampering

CISA advisory ICSA-26-211-07 (Update A) describes CVE-2026-13584, a CWE-924 message-integrity flaw in Mitsubishi Electric's CC-Link IE TSN communication protocol. An attacker on the same network segment can send specially crafted packets under specific timing conditions to tamper with control input/output data, potentially causing a denial-of-service condition across a very large list of affected MELSEC controllers, motion modules, remote I/O modules, servos, inverters, robot controllers, GOT3000 HMIs, and related CC-Link IE TSN software/SDKs. Mitsubishi Electric has stated no fix is planned and instead recommends network and physical access mitigations.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)VIEW SHIFT

SW-000078MICROSOFT · MICROSOFT ENTRA · MICROSOFT ENTRA IDHIGHACTION REQUIRED23D AGO

Entra begins passkey-default migration and schedules native SMS/voice retirement

Microsoft has begun a passkey-default migration for eligible Entra ID users and has scheduled retirement of Microsoft-provided SMS and voice authentication. Most in-scope users reach the retirement milestone on February 1, 2027, while Global Administrators and external users have a later July 1, 2027 milestone.

DEADLINE FEB 1, 2027IDENTITY · AUTHENTICATION · DEPRECATION · AUTHENTICATION CHANGESOURCE MICROSOFTVIEW SHIFT

SW-000077GITHUB · GITHUB ADVANCED SECURITYINFORMATIONAL23D AGO

GitHub changelog page lists multiple Advanced Security and CodeQL updates

The page title references enforcing GitHub Advanced Security configurations, but the retrieved content only contains a list of adjacent changelog headings dated Sep.03 through Sep.16 covering AI Scan, CodeQL, Actions cache control, and secret scanning enforcement items. No detailed body text describing the specific 'enforce configurations' feature itself was present in the supplied document.

SECURITY · DEVOPS · FEATURE RELEASE · SERVICE CHANGESOURCE GITHUBVIEW SHIFT

SW-000076CLOUDFLARE · CLOUDFLARE DOCS · CLOUDFLARE DNSINFORMATIONAL23D AGO

Cloudflare rolls out shadowed DNS record warnings to all zones

Cloudflare has made shadowed record warnings generally available across all zones. A record is considered shadowed when a subdomain delegation gives authority for its name, or a name below it, to another set of nameservers, meaning the zone is no longer authoritative for that record and Cloudflare will not respond to matching DNS queries with it. Shadow metadata identifying the delegating NS records and glue status can also be retrieved via the DNS records API using the include_shadow_metadata=true parameter.

EFFECTIVE SEP 14, 2026NETWORK · FEATURE RELEASESOURCE CLOUDFLAREVIEW SHIFT

SW-000075APPLE · MACOS TAHOE · MACOS TAHOE 26.7CRITICALACTION REQUIRED23D AGO

Apple patches over 100 CVEs in macOS Tahoe 26.7 security update

Apple released macOS Tahoe 26.7 on September 14, 2026, fixing a large number of security vulnerabilities across kernel, file system, networking, graphics, and application frameworks. Many issues involve out-of-bounds reads/writes, use-after-free, race conditions, and privilege-escalation flaws that could allow attackers to execute arbitrary code, corrupt kernel memory, bypass Gatekeeper or sandbox protections, or access sensitive user data.

EFFECTIVE SEP 14, 2026SECURITY · ENDPOINT · NETWORK · DATA · IDENTITY · SECURITY ADVISORY · VULNERABILITYSOURCE APPLEVIEW SHIFT

SW-000074GITHUB · GITHUB ADVANCED SECURITYINFORMATIONAL23D AGO

GitHub changelog digest lists multiple Advanced Security, CodeQL, and Actions updates

The page, titled 'Enforce GitHub Advanced Security configurations,' actually surfaces a list of short, undated-detail changelog entries spanning Sep 3–16, 2026 covering AI Scan, CodeQL releases, Actions cache controls, and secret-scanning enforcement in pull requests. No expanded body text is provided for the titled 'enforce configurations' announcement itself; only headline-level entries and tags (application security, supply chain security, platform governance, actions) are visible.

SECURITY · GOVERNANCE · DEVOPS · FEATURE RELEASE · POLICY CHANGESOURCE GITHUBVIEW SHIFT

SW-000063AWS · AWS IAM IDENTITY CENTER · TEMPORARY ELEVATED ACCESS MANAGEMENT (TEAM)HIGHACTION REQUIRED23D AGO

CVE-2026-86830: TEAM for AWS IAM Identity Center allows unintended privilege escalation

AWS disclosed CVE-2026-86830 affecting Temporary Elevated Access Management (TEAM), an open-source sample solution for managing temporary elevated access via AWS IAM Identity Center. Versions before 1.5.1 contain an incorrect privilege assignment flaw that could let an authenticated application-level user obtain unintended temporary elevated access to AWS accounts managed by TEAM. The issue is fixed in version 1.5.1; no workaround exists.

IDENTITY · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000070PALO ALTO NETWORKS · PAN-OS · PAN-OS (FIREWALLS, PANORAMA, PRISMA ACCESS, CLOUD NGFW)HIGHACTION REQUIRED23D AGO

PAN-OS CVE-2026-0310: XML processing buffer overflow enables DoS or root RCE

Palo Alto Networks disclosed CVE-2026-0310, a buffer overflow (CWE-787) in PAN-OS XML processing. An unauthenticated network attacker reaching the management web interface or dataplane interface can trigger a denial-of-service condition on VM-Series firewalls or achieve arbitrary code execution with root privileges on PA-Series hardware firewalls. Panorama is also impacted. Prisma Access and Cloud NGFW are affected at a lower, authenticated-access severity. No known workarounds exist; fixed versions are available across multiple PAN-OS release trains.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE PALO ALTO NETWORKSVIEW SHIFT

SW-000066SIEMENS · MENDIX · MENDIX SAML MODULEHIGHACTION REQUIRED23D AGO

Siemens Mendix SAML module vulnerable to signature bypass enabling account hijack

CISA republished a Siemens ProductCERT advisory (SSA-887643) describing CVE-2026-80465, a vulnerability in the Mendix SAML module where affected versions fail to properly validate SAML response signatures. This could allow an unauthenticated remote attacker to hijack a user account/session in specific SSO configurations. CVSS 3.1 base score is 8.7 (HIGH). Siemens has released fixed versions and recommends updating.

IDENTITY · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISA (REPUBLISHING SIEMENS PRODUCTCERT ADVISORY SSA-887643)VIEW SHIFT

SW-000065CISCO · ROOMOS · CISCO ROOMOSMEDIUMACTION REQUIRED23D AGO

Cisco RoomOS logging vulnerability may expose credentials when extended logging is enabled

Cisco disclosed a medium-severity vulnerability (CVE-2026-20289) in the RoomOS logging subsystem that could allow an authenticated, low-privilege local attacker to view sensitive information, including user login credentials, by enabling a specific logging level and collecting system logs. Extended logging is not enabled by default. Cisco has released fixed software; no workarounds exist.

ENDPOINT · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000059CISCO · CISCO ASYNCOS SOFTWARE · CISCO SECURE EMAIL GATEWAYCRITICALACTION REQUIRED26D AGO

Cisco Secure Email Gateway SQL injection flaw enables root-level command execution

Cisco disclosed a critical vulnerability (CVE-2026-76461, CVSS 9.8) in the email parsing logic of AsyncOS for Cisco Secure Email Gateway (physical and virtual, any configuration). An unauthenticated remote attacker can send a crafted email containing malicious SQL statements to achieve arbitrary command execution with root privileges on the underlying OS. Cisco PSIRT confirmed active exploitation in the wild as of September 2026. No workarounds exist; fixed software releases are available.

EMAIL · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000062ST ENGINEERING IDIRECT · IQ-SERIES TERMINALS (EVOLUTION IQ-SERIES, 3315-SERIES, 9-SERIES)CRITICALACTION REQUIRED26D AGO

CISA Update A adds two new vulnerabilities to iDirect iQ-Series terminal advisory

CISA's Update A to ICSA-26-183-01 expands the advisory for ST Engineering iDirect iQ-Series satellite terminals (Evolution, 3315-Series, 9-Series, firmware <=4.5.2.1) from two to four vulnerabilities. The new CVE-2026-38056 (local privilege escalation, CVSS v4 9.4 critical) and CVE-2026-38058 (exposure of password hashes) were added alongside the existing unauthenticated API disclosure (CVE-2026-38059) and CSRF-based reboot flaw (CVE-2026-38057). Vendor has released fixed firmware 4.5.3.0.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CISAVIEW SHIFT

SW-000058GOOGLE · WINDOWS 10 AND 11 · GEMINI APPINFORMATIONAL27D AGO

Google launches Gemini desktop app for Windows 10 and 11

Google has released a native Gemini desktop application for Windows 10 and 11, letting users invoke Gemini via an Alt+Space shortcut, draft summaries using Gmail and Drive content, and generate images with Nano Banana. The feature is on by default for all Workspace organizations with Gemini enabled and is governed by existing Generative AI admin console settings.

EFFECTIVE SEP 11, 2026AI · COLLABORATION · FEATURE RELEASESOURCE GOOGLE WORKSPACEVIEW SHIFT

SW-000053AMAZON WEB SERVICES · AWS SDK FOR GO V2 · AWS SDK FOR GO V2HIGHACTION REQUIRED27D AGO

AWS SDK for Go v2 fixes DoS bug in EventStream header decoder (CVE-2026-89090)

AWS disclosed CVE-2026-89090, a denial-of-service vulnerability in the EventStream header decoder of AWS SDK for Go v2. Versions prior to 2026-03-23 can be crashed by a malformed EventStream response frame containing an invalid header value type byte. The issue is fixed in version 2026-03-23 and later; no workaround is available.

DEVOPS · SECURITY · CLOUD · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICESVIEW SHIFT

SW-000050SOPHOS · SOPHOS AP6 SERIES AND APX SERIES WIRELESS ACCESS POINTSMEDIUMACTION REQUIRED27D AGO

Sophos discloses AirSnitch client-isolation bypass affecting AP6 and APX access points

Sophos published an advisory on a class of Wi-Fi client isolation bypass techniques called AirSnitch, publicly described in NDSS'26 research, that can affect Sophos AP6 series and APX series access points depending on configuration and attack variant. No CVE has been assigned and no fix currently exists; Sophos states customer action is required and provides workarounds rather than a remediation.

NETWORK · SECURITY · SECURITY ADVISORY · VULNERABILITYSOURCE SOPHOSVIEW SHIFT

SW-000055VEEAM · VEEAM SERVICE PROVIDER CONSOLECRITICALACTION REQUIRED27D AGO

Veeam Service Provider Console 9.2.1 fixes critical RCE and account takeover flaws

Veeam disclosed two vulnerabilities in Veeam Service Provider Console: CVE-2026-32998, a critical remote code execution flaw (CVSS 9.4), and CVE-2026-64635, a medium-severity password reset link hijacking issue enabling account takeover (CVSS 5.3). Both are fixed in version 9.2.1.33875. All version 9 builds up to 9.2.0.33215 and all earlier builds (9.1, 9.0, 8) are affected.

SECURITY · BACKUP · SECURITY ADVISORY · VULNERABILITYSOURCE VEEAM SOFTWAREVIEW SHIFT

SW-000051CLOUDFLARE · CLOUDFLARE WAF · CLOUDFLARE MANAGED RULESETCRITICALACTION REQUIRED27D AGO

Cloudflare adds emergency WAF rule for Adobe Commerce/Magento zero-day RCE CVE-2026-75650

Cloudflare released an emergency Managed Ruleset update to block exploitation of an actively exploited, unauthenticated remote code execution vulnerability (CVE-2026-75650, nicknamed 'StyleSmuggler') affecting Adobe Commerce and Magento Open Source. The new rule sets action to Block for detected exploit patterns.

EFFECTIVE SEP 10, 2026SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITY · FEATURE RELEASESOURCE CLOUDFLAREVIEW SHIFT

SW-000048CISCO · CISCO IOS XE SOFTWARE · BEEP (BLOCKS EXTENSIBLE EXCHANGE PROTOCOL) FEATUREHIGHACTION REQUIRED28D AGO

Cisco IOS XE BEEP feature DoS vulnerability (CVE-2026-20263), CVSS 8.6, patched

Cisco disclosed a high-severity denial-of-service vulnerability (CVE-2026-20263, CVSS base 8.6) in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE Software. An unauthenticated remote attacker can send a crafted BEEP SOAP request to cause an affected device to reload unexpectedly. The issue is due to improper handling when parsing BEEP SOAP requests. Cisco has released fixed software; no workarounds exist. Only devices with BEEP configured (e.g., NETCONF over BEEP or a BEEP listener via bingd) are affected. IOS Software, IOS XR Software, and NX-OS Software are confirmed not vulnerable. Cisco PSIRT is not aware of any public exploitation.

NETWORK · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000047PALO ALTO NETWORKS · PAN-OS · PA-SERIES AND VM-SERIES FIREWALLS, PANORAMA (VIRTUAL AND M-SERIES)LOWACTION REQUIRED28D AGO

CVE-2026-0308: Stored XSS in PAN-OS Web Interface, fixes in 12.1.10, 11.2.13-h2, 11.1.16-h2

Palo Alto Networks disclosed a stored cross-site scripting (XSS) vulnerability (CVE-2026-0308) in the PAN-OS web interface that lets a malicious authenticated administrator with high privileges store and execute JavaScript. The issue affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected. Severity is rated LOW with a MODERATE suggested urgency; there is no known exploitation in the wild.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE PALO ALTO NETWORKSVIEW SHIFT

SW-000049AMAZON WEB SERVICES · KIRO IDE · KIRO IDEHIGHACTION REQUIRED28D AGO

CVE-2026-89332: Kiro IDE agent-edited config could exfiltrate workspace data via Powers URL

AWS disclosed CVE-2026-89332 affecting Kiro IDE versions before 0.8.135, where the Kiro agent could write to a workspace's settings file in an untrusted repository, redirecting the Powers registry URL to an attacker-controlled endpoint and causing sensitive workspace data to be sent when the Powers panel was opened.

SECURITY · DEVOPS · AI · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000044VEEAM SOFTWARE · VEEAM ONECRITICALACTION REQUIRED1MO AGO

Veeam ONE 13.x has critical SMB auth coercion flaw, patched CVE-2026-65641

Veeam disclosed CVE-2026-65641, a critical vulnerability in Veeam ONE that allows an unauthenticated network attacker to coerce SMB authentication from the service account. It affects Veeam ONE 13.1.0.7034 and all earlier version 13 builds; version 12.x is not affected. Fixes are available in Veeam ONE 13.1 Patch 0 (build 13.1.0.7233) and Veeam ONE 13.0.2 Patch 1 (build 13.0.2.7159).

SECURITY · ENDPOINT · SECURITY ADVISORY · VULNERABILITYSOURCE VEEAM SOFTWAREVIEW SHIFT

SW-000042PALO ALTO NETWORKS · LINUX · PRISMA ACCESS AGENTMEDIUMACTION REQUIRED1MO AGO

CVE-2026-0305: Prisma Access Agent on Linux exposes credentials to local users

Palo Alto Networks disclosed CVE-2026-0305, a medium-severity (CVSS 4.3) information disclosure vulnerability in the Prisma Access Agent on Linux, versions 24.0 through before 26.3. A local user with low privileges can access sensitive configuration data and credentials without user interaction. The macOS, Windows, iOS, Android, and Chrome OS versions of the agent are not affected. No exploitation has been observed and no configuration is required to be exposed.

SECURITY · ENDPOINT · VULNERABILITY · SECURITY ADVISORYSOURCE PALO ALTO NETWORKSVIEW SHIFT

SW-000043AWS LABS · AWSLABS POSTGRES-MCP-SERVER (PYTHON PACKAGE) · POSTGRES-MCP-SERVERHIGHACTION REQUIRED1MO AGO

CVE-2026-87911: OS command injection bypasses read-only mode in postgres-mcp-server

AWS disclosed CVE-2026-87911, an OS command injection flaw in the SQL validation logic of awslabs.postgres-mcp-server before version 1.1.7. A crafted COPY ... TO PROGRAM statement can bypass the server's default read-only enforcement and execute OS commands on a self-managed PostgreSQL host when the connected database role holds superuser or pg_execute_server_program privileges. The issue is fixed in version 1.1.7 on PyPI.

SECURITY · DATA · CLOUD · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICESVIEW SHIFT

SW-000045CISCO · IOS SOFTWARE AND IOS XE SOFTWARE · XMCP SERVER FEATUREHIGHACTION REQUIRED1MO AGO

Cisco IOS/IOS XE XMCP Server flaw allows unauthenticated remote DoS via malformed packet

Cisco disclosed CVE-2026-20301, a high-severity vulnerability (CVSS 8.6) in the Extensible Messaging Client Protocol (XMCP) Server feature of Cisco IOS and IOS XE Software. An unauthenticated remote attacker can send a malformed XMCP packet to cause an affected device to reload, resulting in a denial of service. Only devices with the XMCP Server feature enabled (service-routing xmcp listen configured) are affected. IOS XR and NX-OS are confirmed not vulnerable. Cisco has released fixed software; no workarounds exist, though an access-list based mitigation is described. Cisco PSIRT is not aware of any public exploitation.

NETWORK · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000046SOPHOS · LINUX KERNELINFORMATIONAL1MO AGO

Sophos advisory: Linux kernel 'Dirty Frag' LPE flaw does not affect any Sophos products

Sophos published an informational advisory about a publicly disclosed Linux kernel vulnerability class called 'Dirty Frag' that allows a local unprivileged user to escalate privileges to root by manipulating the kernel page cache via flaws in the xfrm-ESP and RxRPC subsystems. Sophos reviewed its full product line and determined none are affected, either because the vulnerable code paths are not present or not in the execution path.

SECURITY · ENDPOINT · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE SOPHOSVIEW SHIFT

SW-000041VEEAM SOFTWARE · VEEAM ONECRITICALACTION REQUIRED1MO AGO

Veeam ONE 13.1 patches seven vulnerabilities including a critical unauthenticated RCE

Veeam published KB4892 disclosing seven CVEs affecting Veeam ONE versions 12.x and 13.x, ranging from a critical unauthenticated remote code execution flaw (CVSS 10.0) to medium-severity data exposure via shared report links. Fixes are delivered in Veeam ONE 13.1 (build 13.1.0.7034), Veeam ONE 13.0.2 Patch 1 (build 13.0.2.7159), and Veeam ONE 12.3 Patch 1 (build 12.3.0.7165), depending on the CVE and installed version.

SECURITY · BACKUP · SECURITY ADVISORY · VULNERABILITYSOURCE VEEAM SOFTWAREVIEW SHIFT

SW-000040APPLE · MACOS TAHOE · MACOS TAHOE 26.5CRITICALACTION REQUIRED1MO AGO

macOS Tahoe 26.5 patches numerous kernel, WebKit, and system component vulnerabilities

Apple's security update for macOS Tahoe 26.5, released May 11, 2026, addresses a large number of vulnerabilities across kernel, WebKit, networking, storage, and many other system components. Several issues could allow sandbox escapes, kernel memory disclosure, privilege escalation to root, Gatekeeper bypass, and denial-of-service conditions. Some entries were added or updated after initial publication (noted August 25, 2026).

EFFECTIVE MAY 11, 2026SECURITY · ENDPOINT · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE APPLEVIEW SHIFT

SW-000031AMAZON WEB SERVICES · EC2 F2 INSTANCES · AWS FPGA DEVELOPMENT KIT (AWS-FPGA)HIGHACTION REQUIRED1MO AGO

CVE-2026-85028: Insecure temp file permissions in AWS FPGA Dev Kit allow root code execution

AWS disclosed CVE-2026-85028 affecting AWS FPGA Development Kit (aws-fpga) versions before 2.3.4. The FPGA management tool installation component creates a temporary file at a predictable path in a world-writable directory, which is read after the installer elevates its own privileges, allowing local users to execute arbitrary code as root. The issue is fixed in version 2.3.4.

SECURITY · DEVOPS · VULNERABILITY · SECURITY ADVISORYSOURCE AWSVIEW SHIFT

SW-000032AMAZON WEB SERVICES · AMAZON ATHENA · ATHENA FEDERATED QUERYHIGHACTION REQUIRED1MO AGO

AWS fixes CVE-2026-77810 in Athena Federated Query Neptune Connector

AWS disclosed CVE-2026-77810, a vulnerability in the Neptune connector used by Athena Federated Query. A user with Neptune access through Athena could gain access to properties of the Lambda function that provides compute for the connector. The issue affects connector versions <=v2026.28.1 and >=v2024.15.1 and is fixed in v2026.30.1.

SECURITY · CLOUD · DATA · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICESVIEW SHIFT

SW-000033AWS · AWSLABS.MYSQL-MCP-SERVERMEDIUMACTION REQUIRED1MO AGO

AWS discloses read-only bypass flaw in awslabs mysql-mcp-server (CVE-2026-85788)

AWS published a security bulletin describing a vulnerability in the open-source, self-hosted awslabs.mysql-mcp-server package where the read-only enforcement mechanism could be bypassed using SQL inline comments, allowing statements the read-only check was meant to block to execute. The issue affects versions up to 1.0.21 and is fixed in 1.0.23. No AWS-hosted service confidentiality or integrity is affected, as the package is client-side and self-managed.

SECURITY · DATA · AI · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000034AWS · AMAZON LINUX 2 · LOG4J-CVE-2021-44228-HOTPATCHHIGHACTION REQUIRED1MO AGO

AWS discloses OS command injection flaw in log4j-cve-2021-44228-hotpatch (CVE-2026-85656)

AWS published a security bulletin describing CVE-2026-85656, an OS command injection vulnerability in the log4j-cve-2021-44228-hotpatch package used on Amazon Linux 2 to patch the Log4j CVE-2021-44228 JNDI lookup issue without restarting Java processes. Versions up to 1.3-8.amzn2 are affected; the fix is included in 1.3-9.amzn2.

SECURITY · ENDPOINT · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000035PALO ALTO NETWORKS · CHECKOV BY PRISMA CLOUDLOWACTION REQUIRED1MO AGO

CVE-2026-0302: OS command injection in Checkov by Prisma Cloud versions 3.2.0-3.2.501

Palo Alto Networks disclosed a low-severity OS command injection vulnerability (CVE-2026-0302) affecting Checkov by Prisma Cloud versions 3.2.0 up to but not including 3.2.502. A local user able to influence input consumed by a Checkov scan could execute arbitrary commands in the Checkov process. No known workarounds exist; the vendor recommends upgrading to 3.2.502 or later.

SECURITY · DEVOPS · VULNERABILITY · SECURITY ADVISORYSOURCE PALO ALTO NETWORKSVIEW SHIFT

SW-000036MICROSOFT · WINDOWS / MICROSOFT OFFICE · WINDOWS, WINDOWS SERVER, MICROSOFT OFFICE, MICROSOFT DEFENDERCRITICALACTION REQUIRED1MO AGO

Microsoft September 2026 Patch Tuesday fixes 972 CVEs, 2 exploited zero-days, 113 Critical bugs

Microsoft's September 2026 security release addresses 972 vulnerabilities, more than double August's count and a new Patch Tuesday record. It includes two zero-day vulnerabilities confirmed as actively exploited in the wild (Windows Update Stack and Windows ALPC elevation-of-privilege flaws), 113 Critical vulnerabilities, and 857 additional lower-severity CVEs. Critical RCE flaws affect core infrastructure services including Netlogon, DNS Server, DHCP Server, MSMQ, Services for NFS, SSTP VPN, Kerberos, Hyper-V, Remote Desktop, and numerous Office products (Outlook, Word, Excel, PowerPoint, Graphics Components). A separate proof-of-concept zero-day dubbed 'ShieldCrash' was publicly disclosed against Microsoft Defender, discussed separately from the Microsoft patch set.

EFFECTIVE SEP 8, 2026SECURITY · ENDPOINT · NETWORK · IDENTITY · SECURITY ADVISORY · VULNERABILITYSOURCE CROWDSTRIKEVIEW SHIFT

SW-000037CISCO · CISCO TERMINAL SERVICES (TS) AGENTMEDIUMACTION REQUIRED1MO AGO

Cisco TS Agent firewall rule mapping flaw lets user inherit another account's rules

Cisco disclosed CVE-2026-20028, a medium-severity vulnerability (CVSS 5.0) in the network driver of Cisco Terminal Services (TS) Agent. Due to incorrect mapping of network connections to user accounts, an authenticated remote attacker with at least user-level credentials can send crafted traffic to bypass firewall rules tied to their own account and inherit those of a different user. No workarounds exist; Cisco has released fixed software in TS Agent 1.4.3. There is no known public exploitation.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000038CONNECTWISE · CONNECTWISE AUTOMATEHIGHACTION REQUIRED1MO AGO

ConnectWise Automate 2026.5 patches CVE-2026-9089 agent integrity-check flaw

ConnectWise released Automate 2026.5 to fix CVE-2026-9089, a CWE-494 'Download of Code Without Integrity Check' vulnerability affecting the agent's plugin loading and self-update processes. The flaw has a CVSS base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is rated Important severity with Priority 2 (Moderate), meaning ConnectWise recommends remediation within normal change management timelines but no later than 30 days.

SECURITY · ENDPOINT · SECURITY ADVISORY · VULNERABILITYSOURCE CONNECTWISEVIEW SHIFT

SW-000039NEXTGEN HEALTHCARE · MIRTH CONNECTHIGHACTION REQUIRED1MO AGO

CISA advisory: three vulnerabilities in NextGen Mirth Connect <=v4.7.1 allow data exfiltration, DoS

CISA published an ICS Medical Advisory describing three vulnerabilities (CVE-2026-82583, CVE-2026-78224, CVE-2026-82578) affecting NextGen Healthcare Mirth Connect versions 4.7.1 and earlier. The flaws include an authenticated SQL injection via the Database Connector API and two XXE injection issues in XSLT transformation and XML batch processing, which could allow credential disclosure, arbitrary file write, data exfiltration, or denial-of-service. NextGen recommends updating to v4.7.2 or later, available via the customer portal. No known public exploitation has been reported.

SECURITY · DATA · VULNERABILITY · SECURITY ADVISORYSOURCE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)VIEW SHIFT

SW-000027GOOGLE CLOUD · CLUSTER DIRECTOR · CLUSTER DIRECTORHIGHACTION REQUIRED1MO AGO

Cluster Director patches high-severity Slurm sbcast flaw CVE-2026-65107

Google published a security bulletin (GCP-2026-060) for Cluster Director describing a high-severity flaw in the Slurm sbcast tool that lets shared library files bypass security checks and can crash cluster nodes. Google fixed the issue in the default OS image family (NVIDIA driver 580) as of August 27, 2026; the non-default image family (NVIDIA driver 570) will not receive the patch.

EFFECTIVE AUG 27, 2026SECURITY · CLOUD · SECURITY ADVISORY · VULNERABILITYSOURCE GOOGLE CLOUDVIEW SHIFT

SW-000028SOPHOS · MACOS · SOPHOS ENDPOINT (INTERCEPT X ENDPOINT FOR MACOS; SOPHOS HOME FOR MACOS)CRITICAL1MO AGO

Sophos patches critical macOS Endpoint LPE flaw CVE-2026-18367

Sophos disclosed and fixed a local privilege escalation vulnerability affecting Sophos Endpoint products for macOS, reported via its bug bounty program by an external researcher. The flaw allowed local users to execute arbitrary commands with root privileges and interfere with Sophos protection components. No evidence of exploitation or customer impact was found. Fixes are already released and applied automatically.

EFFECTIVE AUG 5, 2026ENDPOINT · SECURITY · SECURITY ADVISORY · VULNERABILITYSOURCE SOPHOSVIEW SHIFT

SW-000029CARECAM · CARECAM PRO IP CAMERAS (ANJIA AJL33PC0801)HIGHACTION REQUIRED1MO AGO

CareCam Pro IP camera bootloader uses hard-coded credential, risking full device takeover

CISA advisory ICSA-26-251-01 discloses CVE-2026-85083, a hard-coded credential vulnerability (CWE-798) in the bootloader of the CareCam Pro ANJIA AJL33PC0801 IP camera running a specific 2020 U-Boot firmware build. An attacker with physical access could exploit the hard-coded credential to gain privileged bootloader access and fully compromise the device. CareCam has not responded to CISA's coordination attempts.

SECURITY · ENDPOINT · VULNERABILITY · SECURITY ADVISORYSOURCE CISAVIEW SHIFT

SW-000030AWS · OPENSEARCH DASHBOARDS · TSVB PLUGIN (TIME SERIES VISUAL BUILDER)HIGHACTION REQUIRED1MO AGO

CVE-2026-18420: RCE via Prototype Pollution in OpenSearch Dashboards TSVB Plugin

AWS published a security bulletin describing a remote code execution vulnerability in the TSVB plugin of OpenSearch Dashboards, affecting versions 3.0.0 up to but not including 3.8.0, in both self-managed and AWS Managed OpenSearch Service deployments.

SECURITY · DATA · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000026CLOUDFLARE · ZERO TRUST NETWORKS API / CLOUDFLARE TUNNEL API · CLOUDFLARE TUNNEL, CLOUDFLARE MESHHIGHACTION REQUIRED1MO AGO

Cloudflare retires CIDR-based route endpoints and tunnel connections field on Oct 5, 2026

Cloudflare will remove two API surfaces on October 5, 2026: the CIDR-encoded route creation/update/delete endpoints in the Zero Trust Networks API, and the connections array returned in list and get responses for Cloudflare Tunnel (cfd_tunnel) and Cloudflare Mesh (warp_connector) resources. Both changes require administrators to update any direct API calls, scripts, or automation that rely on the old shapes before the removal date.

DEADLINE OCT 5, 2026NETWORK · DEVOPS · CLOUD · BREAKING CHANGE · DEPRECATION · RETIREMENTSOURCE CLOUDFLAREVIEW SHIFT

SW-000025CISCO · THOUSANDEYES VIRTUAL APPLIANCE · CISCO THOUSANDEYES VIRTUAL APPLIANCEMEDIUMACTION REQUIRED1MO AGO

Cisco patches authenticated RCE flaw in ThousandEyes Virtual Appliance (CVE-2026-20199)

Cisco disclosed a medium-severity vulnerability (CVE-2026-20199) in the SSL certificate handling of the ThousandEyes Virtual Appliance that could let an authenticated administrator upload a crafted certificate to execute arbitrary code as root on the underlying OS. Cisco has released fixed software; no workarounds exist. Cisco PSIRT is not aware of public exploitation.

NETWORK · SECURITY · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000024GOOGLE CLOUD · CLUSTER TOOLKIT · SLURM SBCAST TOOLHIGHACTION REQUIRED1MO AGO

Google patches Slurm sbcast flaw CVE-2026-65107 in Cluster Toolkit OS images

Google Cloud issued security bulletin GCP-2026-060 for Cluster Toolkit, addressing CVE-2026-65107, a high-severity flaw in the Slurm sbcast tool that lets shared library files bypass security checks and can crash cluster nodes. Google has updated the OS images that Cluster Toolkit supports with the necessary patch.

SECURITY · CLOUD · VULNERABILITY · SECURITY ADVISORYSOURCE GOOGLE CLOUDVIEW SHIFT

SW-000022CISCO · CISCO CATALYST SD-WAN CONTROLLER, MANAGER, AND VALIDATOR · CISCO CATALYST SD-WAN CONTROLLER / SD-WAN MANAGER / SD-WAN VALIDATOR (FORMERLY VSMART/VMANAGE/VBOND)HIGHACTION REQUIRED1MO AGO

Cisco Catalyst SD-WAN privilege escalation flaw (CVE-2026-20245) actively exploited, fixes released

Cisco disclosed CVE-2026-20245, a CLI input-validation flaw (CWE-116) in Catalyst SD-WAN Controller, Manager, and Validator (formerly vSmart/vManage/vBond) that lets an authenticated netadmin-level local attacker upload a crafted file to execute arbitrary commands as root, affecting all deployment types (on-prem, Cloud-Pro, Cisco-managed cloud, and FedRAMP). CVSS base score is 7.8. Cisco PSIRT confirmed exploitation in the wild as of June 2026, with some cases resulting in unauthorized configuration changes pushed to edge devices. No workarounds exist; Cisco has released fixed software across multiple release trains and also offers a temporary 'Live Protect' shield that disables SD-WAN Disaster Recovery and Manager cluster creation/expansion while deployed.

NETWORK · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000023CLOUDFLARE · CLOUDFLARE APIHIGHACTION REQUIRED1MO AGO

Cloudflare deprecates API Service Key auth, removal set for Sept 30 2026

Cloudflare is deprecating Service Key authentication for its API, effective March 19 2026, with full removal on September 30 2026. API Tokens are the designated replacement, offering the same functionality plus fine-grained scoping, expiration, and IP restrictions.

DEADLINE SEP 30, 2026IDENTITY · SECURITY · DEPRECATION · RETIREMENTSOURCE CLOUDFLAREVIEW SHIFT

SW-000020IXON · IXON VPN CLIENTCRITICALACTION REQUIRED1MO AGO

CISA advisory: CRLF injection in IXON VPN Client <1.4.7 allows root/SYSTEM code execution

CISA republished an advisory (originally issued by IXON on 2026-08-05) describing CVE-2026-75925, a CRLF injection vulnerability (CWE-93) in IXON VPN Client versions before 1.4.7. The flaw allows an attacker to inject directives into a configuration file consumed by a privileged subprocess, enabling command execution as root or SYSTEM. The configuration interface also lacks authentication of the requester (CWE-306, contributing).

EFFECTIVE AUG 5, 2026SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CISAVIEW SHIFT

SW-000021SCHNEIDER ELECTRIC · EASERGY, ECOSTRUXURE, POWERLOGIC, AND SAITEL PRODUCTSHIGHACTION REQUIRED1MO AGO

Schneider Electric Easergy, EcoStruxure, PowerLogic, Saitel devices hit by insufficient entropy flaw

CISA republished a Schneider Electric CPCERT advisory (Update A) describing CVE-2026-4827, a CWE-331 Insufficient Entropy vulnerability affecting numerous Easergy, EcoStruxure, PowerLogic, and Saitel product lines used in electrical distribution and substation automation. An attacker on the network could exploit weak session-management entropy to hijack sessions and perform unauthorized operations. CVSS v3.1 base score is 8.3 (High).

SECURITY · ENDPOINT · VULNERABILITY · SECURITY ADVISORYSOURCE CISAVIEW SHIFT

SW-000019AMAZON WEB SERVICES · AMAZON OPENSEARCH SERVICE · OPENSEARCH SQL PLUGINHIGHACTION REQUIRED1MO AGO

CVE-2026-83497: Authenticated RCE via Cursor Deserialization in OpenSearch SQL Plugin

AWS published a security bulletin for CVE-2026-83497, a Java deserialization vulnerability in the OpenSearch SQL Plugin's cursor pagination feature. A remote authenticated user with only basic read/search permissions can send a crafted cursor parameter to the plugins/sql endpoint to execute arbitrary code on the server.

SECURITY · DATA · CLOUD · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000017CISCO · SECURE ENDPOINT CONNECTOR (WINDOWS, LINUX, MAC); SECURE ENDPOINT PRIVATE CLOUD · CLAMAV (BUNDLED IN CISCO SECURE ENDPOINT)HIGHACTION REQUIRED1MO AGO

Cisco patches multiple ClamAV DoS vulnerabilities in Secure Endpoint Connector

Cisco disclosed seven ClamAV vulnerabilities (CVE-2026-20337, -20338, -20339, -20345, -20346, -20347, -20348) affecting the ClamAV scanning engine used in Cisco Secure Endpoint Connector for Windows, Linux, and Mac. The flaws stem from improper boundary checks and memory handling in parsers for zip, PESpin, GPT, PDF, Mach-O, and XAR file formats, and could allow an unauthenticated remote attacker to crash the ClamAV scanning process, causing a denial-of-service condition. Cisco has released fixed software for the affected connectors; no workarounds exist. Secure Endpoint Private Cloud itself is not vulnerable, but the connector software it distributes is affected and requires a pushed update.

SECURITY · ENDPOINT · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000018OPENAI · OPENAI API · GPT-5-NANO-2025-08-07HIGHACTION REQUIRED1MO AGO

OpenAI to retire gpt-5-nano-2025-08-07 from API on Dec 11, 2026

OpenAI notified developers on June 11, 2026 that the gpt-5-nano-2025-08-07 model snapshot is deprecated and will be removed from the API on December 11, 2026. The recommended replacement is gpt-5.6-luna.

DEADLINE DEC 11, 2026AI · DEPRECATION · RETIREMENTSOURCE OPENAI DEVELOPERSVIEW SHIFT

SW-000016CISCO · ROOMOS · CISCO ROOMOSMEDIUMACTION REQUIRED1MO AGO

Cisco RoomOS USB driver flaw allows local root code execution (CVE-2026-20302)

Cisco disclosed a stack overflow vulnerability (CVE-2026-20302) in the USB driver of Cisco RoomOS. An unauthenticated attacker with physical access to a device's USB port could connect a malicious USB device to trigger a buffer overflow and execute arbitrary code with root privileges. Cisco has released fixed software; no workarounds exist. CVSS base score is 6.1 (Medium).

ENDPOINT · SECURITY · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000013CISCO · INDUSTRIAL ETHERNET 1000 SERIES SWITCHES · CISCO IE 1000 SERIES SWITCHESMEDIUMACTION REQUIRED1MO AGO

Cisco IE 1000 Switches DoS Flaw Lets Attackers Flood Management Plane (CVE-2026-20177)

Cisco disclosed a medium-severity denial-of-service vulnerability (CVE-2026-20177, CVSS 5.3) affecting Cisco Industrial Ethernet 1000 Series Switches, caused by insufficient protection against management plane flooding. An unauthenticated remote attacker can send high rates of ICMP, SSH, or HTTP traffic to spike CPU usage and make the device manager web GUI, SSH, or API inaccessible, though data traffic through the device is unaffected. No workarounds exist; Cisco has released fixed software.

NETWORK · SECURITY · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000014CISCO · CISCO UNIFIED INTELLIGENCE CENTERMEDIUMACTION REQUIRED1MO AGO

Cisco Unified Intelligence Center SQL injection flaw allows authenticated DB read access

Cisco disclosed a medium-severity (CVSS 6.5) blind SQL injection vulnerability (CVE-2026-20327) in the web-based management interface of Cisco Unified Intelligence Center. An authenticated, local attacker with valid credentials could exploit insufficient input validation to read the contents of the affected device's internal database. Cisco has released fixed software; no workarounds exist. No public exploitation has been observed.

SECURITY · DATA · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000015CISCO · INDUSTRIAL ETHERNET 1000 SERIES SWITCHES · CISCO IE 1000 SERIES SWITCHESMEDIUMACTION REQUIRED1MO AGO

Cisco IE 1000 Switches Have Stored XSS Flaw in Web Management Interface

Cisco disclosed a medium-severity stored cross-site scripting vulnerability (CVE-2026-20232) in the web-based mgmt. interface of Cisco Industrial Ethernet 1000 Series Switches. An authenticated remote attacker could inject malicious script into interface pages, executing arbitrary code in the context of another user. Cisco has released fixed software; no workarounds exist.

SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000012AMAZON WEB SERVICES · AWS IOT CORE · AWS IOT COREINFORMATIONAL2MO AGO

AWS IoT Core adds native InfluxDB rule action for time-series data routing

AWS IoT Core now offers a new rule action that routes time-series data from IoT devices directly to InfluxDB databases, either Amazon Timestream managed or self-hosted InfluxDB clusters, without requiring custom device code or intermediate services.

EFFECTIVE AUG 25, 2026DATA · CLOUD · FEATURE RELEASESOURCE AMAZON WEB SERVICESVIEW SHIFT

SW-000011AMAZON WEB SERVICES · AMAZON BEDROCK · AWS COST ANOMALY DETECTIONINFORMATIONAL2MO AGO

AWS Cost Anomaly Detection now covers third-party Bedrock model spend

AWS Cost Anomaly Detection has been extended to automatically monitor spend on third-party foundation models hosted on Amazon Bedrock, such as Anthropic Claude, alongside existing AWS cost monitoring. The feature requires no setup and is enabled through the AWS managed service monitor.

EFFECTIVE AUG 19, 2026BILLING · AI · CLOUD · FEATURE RELEASE · SERVICE CHANGESOURCE AMAZON WEB SERVICES (AWS)VIEW SHIFT

SW-000007AWS · AWS · AWS IDENTITY AND ACCESS MANAGEMENTMEDIUM2MO AGO

AWS IAM adds Role Manager for automatic service role setup

AWS IAM Role Manager can automatically create or reuse IAM roles required by supported AWS service workflows.

IDENTITY · SECURITY · CLOUD · FEATURE RELEASESOURCE AMAZON WEB SERVICESVIEW SHIFT

SW-000008AWS · AWS · AWS SDK FOR C++HIGHACTION REQUIRED2MO AGO

AWS discloses two memory-safety flaws in AWS SDK for C++

AWS disclosed out-of-bounds write and read vulnerabilities affecting the Base64 decoder in the AWS SDK for C++.

SECURITY · DEVELOPMENT · SECURITY ADVISORYSOURCE AMAZON WEB SERVICESVIEW SHIFT

SW-000009GOOGLE · GOOGLE WORKSPACE · WORKSPACE STUDIOMEDIUM2MO AGO

Google adds enterprise security controls to Workspace Studio

Google is adding identity, data protection, observability, governance and runtime security controls to Workspace Studio.

EFFECTIVE AUG 20, 2026SECURITY · IDENTITY · GOVERNANCE · AI · FEATURE RELEASESOURCE GOOGLEVIEW SHIFT

SW-000010GOOGLE · GOOGLE CLOUD · GOOGLE SECURITY OPERATIONSINFORMATIONAL2MO AGO

Google SecOps previews AI Detection Engineering Agent

Google Security Operations introduced a public-preview Detection Engineering Agent for evaluating threat coverage and drafting detection rules.

SECURITY · AI · PUBLIC PREVIEW · FEATURE RELEASESOURCE GOOGLEVIEW SHIFT

SW-000006MICROSOFT · MICROSOFT AZURE · AZURE VPN GATEWAYHIGHACTION REQUIRED2MO AGO

Microsoft retires Azure VPN Client for Linux Preview August 31

Microsoft is retiring the Azure VPN Client for Linux Preview on August 31, 2026.

DEADLINE AUG 31, 2026NETWORKING · CLOUD · RETIREMENTSOURCE MICROSOFTVIEW SHIFT

SW-000005MICROSOFT · MICROSOFT AZURE · AZURE VPN GATEWAYHIGHACTION REQUIRED2MO AGO

Microsoft retires Azure VPN Client for Linux Preview August 31

Microsoft is retiring the Azure VPN Client for Linux Preview on August 31, 2026.

DEADLINE AUG 31, 2026NETWORKING · CLOUD · RETIREMENTSOURCE MICROSOFTVIEW SHIFT

SW-000004MICROSOFT · MICROSOFT AZURE · AZURE VPN GATEWAYHIGHACTION REQUIRED2MO AGO

Microsoft retires Azure VPN Client for Linux Preview August 31

Microsoft is retiring the Azure VPN Client for Linux Preview on August 31, 2026.

DEADLINE AUG 31, 2026NETWORKING · CLOUD · RETIREMENTSOURCE MICROSOFTVIEW SHIFT

SW-000003MICROSOFT · MICROSOFT ENTRA · MICROSOFT ENTRA IDHIGHACTION REQUIRED2MO AGO

Microsoft Entra begins shift from SMS and voice MFA to passkeys

Microsoft is making passkeys the default authentication experience in Entra ID and plans to retire Microsoft-provided SMS and voice authentication delivery.

DEADLINE FEB 1, 2027IDENTITY · SECURITY · RETIREMENT · BEHAVIOR CHANGESOURCE MICROSOFTVIEW SHIFT

SW-000002AWS · AWS · AWS LAMBDAINFORMATIONAL2MO AGO

AWS Lambda adds full IAM resource-based policies

AWS Lambda now supports the full capabilities of IAM resource-based policies, providing more granular access controls and simpler policy management for multi-account and multi-resource environments.

IDENTITY · SECURITY · CLOUD · FEATURE RELEASESOURCE AMAZON WEB SERVICESVIEW SHIFT

SW-000001MICROSOFT · MICROSOFT INTUNE · INTUNEHIGHACTION REQUIRED2MO AGO

Microsoft retiring two Intune agent experiences August 31

Microsoft is now retiring the Policy Configuration Agent and Change Review Agent experiences in Intune, requiring organizations that rely on them to complete active work and prepare replacement workflows.

DEADLINE AUG 31, 2026ENDPOINT · SECURITY · AI · RETIREMENT · BREAKING CHANGESOURCE MICROSOFTVIEW SHIFT