Topic: vulnerabilities
-
Linux kernel KEV remediation: verify each CVE against the distribution package and running kernel
Track five exploited kernel flaws separately. Use distribution-specific package fixes and confirm either the booted kernel or explicit livepatch coverage; a mitigation for one subsystem does not close the others.
-
Cisco Secure Email Gateway and SD-WAN Manager: verify fixes and preserve compromise evidence
Use separate remediation records for the email scanner and SD-WAN Manager. Verify actual installed fixes, preserve evidence before disruptive recovery, and follow the product-specific investigation path.
-
FortiMail and FortiSIEM: match the October fixes to the exposed service
FortiMail CVE-2026-104286 and FortiSIEM CVE-2026-106173 require different fixes and network restrictions. Fortinet confirms exploitation of the mail flaw; its FortiSIEM advisory does not report known exploitation.
-
Ivanti Connect Secure: patching CVE-2026-104935 and investigating earlier compromise
Separate the authentication-bypass fix from compromise recovery: choose a compatible fixed release, preserve forensic evidence, and use integrity checks alongside network and memory analysis.
-
PAN-OS CVE-2026-0322: verify maintenance-line fixes and recover the management plane
An authenticated management-interface flaw affects PAN-OS firewalls and Panorama. Match the full maintenance release, restrict management access, and use the vendor's hardware or virtual-appliance recovery procedure when compromise is suspected.
-
Windows Shell CVE-2026-96951: verify the Windows 11 fix and preserve attachment protection
Verify the cumulative update for the exact Windows 11 release, complete the restart, and retain attachment-origin and SmartScreen controls. A missing warning is not evidence that a downloaded file is safe.
-
Chrome CVE-2026-87491: close the gap between an installed update and a relaunched browser
Google confirms exploitation of CVE-2026-87491. Managed fleets must verify both update delivery and browser relaunch, using the platform-specific release numbers and effective enterprise policies.
-
NetScaler ADC and Gateway: distinguish the September and October fixes before recovery
CVE-2026-88771 and CVE-2026-88772 have different minimum fixed builds from the SAML denial-of-service flaw CVE-2026-88779. Match each bulletin, investigate compromise and handle session termination deliberately.
-
Plex Media Server October 2026 KEV response: update, review exposure and recover compromised hosts
Four exploited Plex Media Server flaws require a verified server update and a separate compromise assessment. Review remote-access mappings, published indicators and account sessions; rebuild when server integrity cannot be established.
-
Zammad and Atlassian October 2026 KEV response: select fixes by release and installation method
Zammad has a supported upgrade and an emergency old-series fix with a repository migration requirement. Its package-specific privilege flaw needs separate verification. Atlassian supplies a product-by-product fixed-version matrix.
Machine-readable: JSON