Vulnerability Intelligence Report — July 1, 2026
Vulnerability Intelligence Report — July 1, 2026 Coverage: July 1, 2026 | CISA KEV additions: 0 (period: SimpleHelp CVE-2026-48558, due July 2) | KEV deadline … Read More
NTLM Reflection Bypass Proof-of-Concept Enables SYSTEM Access on Windows Server
CVE: CVE-2026-XXXXX (reservation expected) | Vendor: Microsoft | Product: Windows Server (all supported versions), Windows 11 What Is the Vulnerability A proof-of-concept has been released … Read More
Microsoft 365 Apps Remote Code Execution Vulnerability Exploited via Malicious Excel Files
CVE: N/A (Microsoft disclosure pending) | Vendor: Microsoft | Product: Microsoft 365 Apps (formerly Office 365) What Is the Vulnerability Microsoft has disclosed a critical … Read More
WolfSSL Security Advisory: Multiple Vulnerabilities Including Certificate Forgery and Remote Code Execution — Billions of Servers and IoT Devices Affected
CVE: Multiple CVEs (see References) | CVSS: Up to 9.8 (CRITICAL) | Vendor: wolfSSL Inc. | Product: wolfSSL Embedded TLS Library What Is the Vulnerability … Read More
CVE-2026-33825 ‘BlueHammer’: Microsoft Defender Privilege Escalation to SYSTEM Confirmed in Ransomware Attacks
CVE: CVE-2026-33825 | CVSS: 7.8 (HIGH) | Vendor: Microsoft | Product: Microsoft Defender What Is the Vulnerability CVE-2026-33825, dubbed “BlueHammer” by security researchers, is a … Read More
CVE-2026-46817: Oracle E-Business Suite Unauthenticated Remote Takeover — Oracle Payments Component Actively Exploited
What Is the Vulnerability CVE-2026-46817 is a critical unauthenticated remote takeover vulnerability in Oracle E-Business Suite (EBS), specifically in the Oracle Payments component. Oracle has … Read More
CVE-2026-48558: SimpleHelp RMM Authentication Bypass — Unsigned OIDC Tokens Enable Unauthenticated Technician Access, MSP Supply Chain Attack (CISA KEV, CVSS 10.0)
CISA Known Exploited Vulnerability (KEV): Added to the CISA KEV Catalog on June 29, 2026. Action due July 2, 2026. BOD 26-04 3-day mandate applies. … Read More
Vulnerability Intelligence Report — June 30, 2026
Vulnerability Intelligence Report — June 30, 2026 Coverage: June 1–30, 2026 | Total CISA KEV additions (period): 23 | New KEVs: 1 (SimpleHelp RMM, CVSS … Read More
CVE-2026-13500: ANTLR4 Code Injection in Grammar Action Block Handler — Developer Toolchain Supply Chain Vulnerability (CVSS 7.3)
CVE: CVE-2026-13500 | CVSS 3.1: 7.3 (HIGH) | CWE: Code Injection | Vendor: ANTLR / Terence Parr | Product: ANTLR4 through version 4.13.2 | Component: … Read More
Vulnerability Intelligence Report — June 29, 2026
Vulnerability Intelligence Report — June 29, 2026 Coverage: June 1–29, 2026 | Total CISA KEV additions (period): 22 | New KEVs: 0 | KEV deadline … Read More