CIS Security Advisories
CIS Security News
CISA News
ISACA SmartBrief
Cyber Security Advisories – MS-ISAC
- Multiple Vulnerabilities in Cisco Catalyst SD-WAN Products Could Allow for Authentication Bypass 2026-02-26Multiple vulnerabilities have been discovered in Cisco Catalyst SD-WAN products, the most severe of which could allow for authentication bypass. Cisco Catalyst SD-WAN (formerly Viptela) is a secure, cloud-delivered software-defined WAN architecture that optimizes application performance by intelligently routing traffic over any combination of transport links (MPLS, broadband, LTE). Successful exploitation of the most severe […]
- A Vulnerability in Dell RecoverPoint for Virtual Machines Could Allow for Arbitrary Code Execution 2026-02-18A vulnerability has been discovered in Dell RecoverPoint for Virtual Machines which could allow for arbitrary code execution. Dell RecoverPoint for Virtual Machines is an enterprise-grade solution for VMware Virtual Machines (VMs) enabling local, remote, and concurrent local and remote replication with continuous cyber resilience for on premises recovery to any point-in time (PiT).Successful exploitation […]
- A Vulnerability in Google Chrome Could Allow for Arbitrary Code Execution 2026-02-18A vulnerability has been discovered in Google Chrome which could allow for arbitrary code execution. Successful exploitation of the vulnerability could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create […]
- Multiple Vulnerabilities in Ivanti Endpoint Manager Could Allow for Authentication Bypass 2026-02-10Multiple vulnerabilities have been discovered in Ivanti Endpoint Manager, the most severe of which could allow for authentication bypass. Ivanti Endpoint Manager is a client-based unified endpoint management software. Successful exploitation of the most severe of these vulnerabilities could a remote unauthenticated attacker to leak specific stored credential data.
- Multiple Vulnerabilities in Fortinet Products Could Allow for Arbitrary Code Execution 2026-02-10Multiple vulnerabilities have been discovered in Fortinet products, the most severe of which could allow for arbitrary code execution.FortiAuthenticator is a centralized identity and access management (IAM) solution that secures network access by managing user identities, Multi-Factor Authentication (MFA), and certificate management.FortiClientEMS is a centralized management platform for deploying, configuring, monitoring, and enforcing security policies […]
- Critical Patches Issued for Microsoft Products, February 10, 2026 2026-02-10Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; […]
- Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution 2026-02-10Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution.Adobe After Effects is a digital effects, motion graphics, and compositing application.Adobe Audition is a comprehensive toolset that includes multitrack, waveform, and spectral display for creating, mixing, editing, and restoring audio content.Adobe Bridge is a creative asset […]
- Multiple Vulnerabilities in Ivanti Endpoint Manager Mobile Could Allow for Remote Code Execution 2026-01-30Multiple vulnerabilities have been discovered in Ivanti Endpoint Manager Mobile which could allow for remote code execution. Ivanti Endpoint Manager Mobile is a mobile management software engine that enables IT to set policies for mobile devices, applications and content. Successful exploitation of these vulnerabilities could allow for remote code execution in the context of the […]
- Multiple Vulnerabilities in SolarWinds Web Help Desk Could Allow for Arbitrary Code Execution 2026-01-28Multiple vulnerabilities have been discovered in SolarWinds Web Help Desk, the most severe of which could allow for arbitrary code execution. SolarWinds Web Help Desk (WHD) is a web-based software that provides IT help desk and asset management functionality, allowing IT teams to manage service requests, track IT assets, and offer self-service options to end-users. […]
- A Vulnerability in Microsoft Office Could Allow for Security Feature Bypass 2026-01-27A vulnerability has been discovered in Microsoft Office which could allow for a security feature bypass. Microsoft Office is a suite of applications designed to help with productivity and completing common tasks on a computer. You can create and edit documents containing text and images, work with data in spreadsheets and databases, and create presentations […]
Blog Feed – Center for Internet Security
- Multiply Endpoint Security's Force at Your Public Utility 2026-02-20A public utility can multiply the force of endpoint security with a 24x7x365 protection and monitoring strategy. Read our blog to learn more.
- Upholding U.S. SLTT Resilience with Affordable Services 2026-02-12The MS-ISAC bridges the U.S. SLTT resilience gap by offering under-resourced organizations access to affordable services. Read to learn more.
- CIS Benchmarks February 2026 Update 2026-02-09Here is an overview of the CIS Benchmarks that the Center for Internet Security (CIS) updated or released for February 2026.
- Top 10 Malware Q4 2025 2026-01-29Total malware notifications from MS-ISAC monitoring services increased 7% from Q3 to Q4 2025. Learn more by reading our Top 10 Malware list.
- CIS Hardened Images Now in the AWS European Sovereign Cloud 2026-01-14CIS Hardened Images are now in the AWS European Sovereign Cloud. Learn how this can help you to reduce risk, improve consistency, and more.
- CIS Benchmarks January 2026 Update 2026-01-12Here is an overview of the CIS Benchmarks that the Center for Internet Security (CIS) updated or released for January 2026.
- Security in the Cloud with More Automation 2026-01-07CIS is making security in the cloud even easier for you by releasing a CIS hardening component in EC2 Image Builder on Amazon Web Services (AWS).
- Cybersecurity Collaboration for the U.S. SLTT Community 2025-12-26The MS-ISAC provides the only nationwide network dedicated to cybersecurity collaboration in the U.S. SLTT community. Read on to learn more.
- Malicious Crystal PDF Converter Detected on SLTT Networks 2025-12-24In October 2025, CIS CTI observed a rise in CIS MDR alerts associated with Crystal PDF on U.S. SLTT endpoints. Here's how to defend yourself.
- CIS Benchmarks December 2025 Update 2025-12-18Here is an overview of the CIS Benchmarks that the Center for Internet Security (CIS) updated or released for December 2025.
All CISA Advisories
- Johnson Controls, Inc. Frick Controls Quantum HD 2026-02-26View CSAF Summary Successful exploitation of these vulnerabilities can lead to pre-authentication remote code execution, information leak or denial of service. The following versions of Johnson Controls, Inc. Frick Controls Quantum HD are affected: Frick Controls Quantum HDCISA
- EV2GO ev2go.io 2026-02-26View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to impersonate charging stations, hijack sessions, suppress or misroute legitimate traffic to cause large-scale denial of service, and manipulate data sent to the backend. The following versions of EV2GO ev2go.io are affected: ev2go.io vers:all/* (CVE-2026-24731, CVE-2026-25945, CVE-2026-20895, CVE-2026-22890) CVSS Vendor Equipment Vulnerabilities v3 9.4 […]CISA
- SWITCH EV swtchenergy.com 2026-02-26View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to impersonate charging stations, hijack sessions, suppress or misroute legitimate traffic to cause large-scale denial of service, and manipulate data sent to the backend. The following versions of SWITCH EV swtchenergy.com are affected: swtchenergy.com vers:all/* (CVE-2026-27767, CVE-2026-25113, CVE-2026-25778, CVE-2026-27773) CVSS Vendor Equipment Vulnerabilities v3 […]CISA
- Mobility46 mobility46.se 2026-02-26View CSAF Summary Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks. The following versions of Mobility46 mobility46.se are affected: mobility46.se vers:all/* (CVE-2026-27028, CVE-2026-26305, CVE-2026-27647, CVE-2026-22878) CVSS Vendor Equipment Vulnerabilities v3 9.4 Mobility46 Mobility46 mobility46.se Missing Authentication for Critical Function, […]CISA
- CloudCharge cloudcharge.se 2026-02-26View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to impersonate charging stations, hijack sessions, suppress or misroute legitimate traffic to cause large-scale denial of service, and manipulate data sent to the backend. The following versions of CloudCharge cloudcharge.se are affected: cloudcharge.se vers:all/* (CVE-2026-20781, CVE-2026-25114, CVE-2026-27652, CVE-2026-20733) CVSS Vendor Equipment Vulnerabilities v3 9.4 […]CISA
- EV Energy ev.energy 2026-02-26View CSAF Summary Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks. The following versions of EV Energy ev.energy are affected: ev.energy vers:all/* (CVE-2026-27772, CVE-2026-24445, CVE-2026-26290, CVE-2026-25774) CVSS Vendor Equipment Vulnerabilities v3 9.4 EV Energy EV Energy ev.energy Missing Authentication […]CISA
- Copeland XWEB and XWEB Pro 2026-02-26View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication, cause a denial-of-service condition, cause memory corruption, and execute arbitrary code. The following versions of Copeland XWEB and XWEB Pro are affected: XWEB 300D PROCISA
- Pelco, Inc. Sarix Pro 3 Series IP Cameras 2026-02-26View CSAF Summary Successful exploitation of this vulnerability could allow attackers to gain unauthorized access to sensitive device data, bypass surveillance controls, and expose facilities to privacy breaches, operational risks, and regulatory compliance issues. The following versions of Pelco, Inc. Sarix Pro 3 Series IP Cameras are affected: Sarix Professional IMP 3 SeriesCISA
- Yokogawa CENTUM VP R6, R7 2026-02-26View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to terminate the software stack process, cause a denial-of-service condition, or execute arbitrary code. The following versions of Yokogawa CENTUM VP R6, R7 are affected: Vnet/IP Interface Package for CENTUM VP R6 (VP6C3300)CISA
- Chargemap chargemap.com 2026-02-26View CSAF Summary Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks. The following versions of Chargemap chargemap.com are affected: chargemap.com vers:all/* (CVE-2026-25851, CVE-2026-20792, CVE-2026-25711, CVE-2026-20791) CVSS Vendor Equipment Vulnerabilities v3 9.4 Chargemap Chargemap chargemap.com Missing Authentication for Critical Function, […]CISA
ISACA SmartBrief on Cybersecurity
- ManoMano data breach affects 38M 2026-02-27French online marketplace ManoMano has informed 38 million customers of a breach resulting from a cyberattack on a subcontrac -More-
- Who Said It? Find something that excites you. Find your path, your purpose, your dream. Then go for it. Really go for it. 2026-02-27Eric Dane or Shonda Rhimes Check your answer here.
- Report: CISOs see potential, risks in AI integration 2026-02-27Chief information security officers are being tasked with AI governance, but they remain concerned about data leaks and the l -More-
- Security debt from open-source components rises 2026-02-27Open-source security debt is rising as nearly all commercial applications incorporate open-source components, according to Bl -More-
- Wi-Fi flaw called AirSnitch intercepts data 2026-02-27Researchers have discovered a Wi-Fi vulnerability called AirSnitch that allows attackers on the same network to intercept dat -More-
- Trend Micro patches Apex One vulnerabilities 2026-02-27Trend Micro has patched a pair of critical vulnerabilities in Apex One that could allow remote code execution on Windows syst -More-
- NuGet package mimics Stripe library in .NET 2026-02-27Cybersecurity researchers have discovered a NuGet package, StripeApi.Net, that mimics Stripe's official .NET library to targe -More-
