VulnerabilitySANS NewsBites
CISA Adds Vulnerabilities in Cisco SD-WAN and Microsoft Exchange Server to Known Exploited Vulnerabilities Catalog
NEOSEC enrichment — no mirror of the original source
Last week, the US Cybersecurity and Infrastructure Security Agency (CISA) added two CVEs to the Known Exploited Vulnerabilities (KEV) catalog: a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller and a critical
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at SANS NewsBitesLinked advisories
- CVE-2026-44118OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can pr…
- CVE-2026-44118OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
- CVE-2026-42897Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform …
- CVE-2026-44115OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass …
- CVE-2026-44113OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside …
- CVE-2026-20182May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in Febru…
- CVE-2026-42897Microsoft Microsoft — Microsoft Exchange Server Cross-Site Scripting Vulnerability
- CVE-2026-44112OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes…
- CVE-2026-42897Microsoft Exchange Server Spoofing Vulnerability
- CVE-2026-44112OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root
- CVE-2026-44113OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes
- CVE-2026-20182Cisco Catalyst SD-WAN — Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Affected vendors and products
- Cisco Cisco Catalyst SD-WAN Manager
- Cisco Cisco Catalyst Sd-wan Controller
- Cisco Cisco Catalyst Sd-wan Manager
- Cisco Cisco SD-WAN vBond Orchestrator
- Cisco Cisco SD-WAN vSmart Controller
- Microsoft Microsoft Exchange Server
- Microsoft Microsoft Exchange Server Subscription Edition
- Microsoft Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Microsoft Exchange Server 2019 Cumulative Update 14
- Microsoft Microsoft Exchange Server 2019 Cumulative Update 15
- Microsoft Microsoft Exchange Server Subscription Edition Rtm
- OpenClaw OpenClaw
More on Microsoft
Other advisories
- CriticalCVE-2026-70274Microsoft Windows und Windows Server: Mehrere Schwachstellen
- CriticalCVE-2026-109469Microsoft Entra Device Registration: Schwachstelle ermöglicht Privilegieneskalation
- CriticalCVE-2026-119268Google Chrome / Microsoft Edge: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
- HighCVE-2026-112997Google Chrome / Microsoft Edge: Mehrere Schwachstellen
- CriticalCVE-2026-106418Google Chrome / Microsoft Edge: Mehrere Schwachstellen
- HighCVE-2026-103624Google Chrome / Microsoft Edge: Mehrere Schwachstellen
- HighCVE-2026-93385Google Chrome / Microsoft Edge: Mehrere Schwachstellen
- HighCVE-2026-91726Google Chrome / Microsoft Edge: Mehrere Schwachstellen
Other news entries
- BluePhishing: Initial Access via Third-Party Agent Blueprint ConsentNewsProofpoint Threat Insight
- Microsoft's Azure Linux gets 470-plus security fixes in one almighty patching sessionNewsThe Register — Security
- Outlook.com bounces legit emails as Microsoft's authentication crackdown goes sidewaysNewsThe Register — Security
- Microsoft Entra Device Registration: Schwachstelle ermöglicht PrivilegieneskalationVulnerabilityBSI CERT-Bund
- ARTEX abuse expands as cybercriminals target financial sectorNewsMicrosoft Threat Intelligence
- Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver ItNewsThe Hacker News
- Google Chrome / Microsoft Edge: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- NCSC-2026-0470 [1.00] [M/H] Kwetsbaarheid verholpen in Windows Paint van MicrosoftNewsNCSC-NL
Source: https://therecord.media/
ID