This week’s list is a little Windows-heavy thanks to June Patch Tuesday. Four of the five are already on CISA’s KEV list, the DHCP flaw can be triggered from the local network, and Oracle had to release an out-of-band fix for a PeopleSoft zero-day that was already being used in attacks.

1. CVE-2026-44815: Windows DHCP Client

A malicious DHCP server on the same network can send a crafted response and get code execution on Windows clients. That makes this more important than a normal workstation patch, especially on guest Wi-Fi, branch networks, or anywhere you don’t fully trust the local segment.

Scope: Windows systems using DHCP Why now: Critical, KEV-listed, CISA deadline June 23 Next step: Deploy the June 2026 Windows updates

2. CVE-2026-35273: Oracle PeopleSoft PeopleTools

Unauthenticated RCE that attackers were already using for data theft before Oracle released the fix. Any exposed or affected PeopleSoft server deserves both a patch and a closer look at what happened before it was patched.

Scope: PeopleTools 8.61 and 8.62 Why now: CVSS 9.8, KEV-listed, CISA deadline July 3 Next step: Apply Oracle’s out-of-band update and check for signs of post-exploitation activity

3. CVE-2026-0257: Palo Alto PAN-OS GlobalProtect

An authentication bypass that allows attackers to establish GlobalProtect VPN sessions without valid credentials. Since this sits at the front door of the networks running a Palo fw, log review matters almost as much as installing the fix.

Scope: Exposed GlobalProtect portals and gateways Why now: Active exploitation confirmed by Unit 42 on June 9 Next step: Apply the appropriate PAN-OS hotfix and investigate any VPN sessions you can’t explain

4. CVE-2026-10520 / CVE-2026-10523: Ivanti Sentry

This is a rough pair: one flaw allows unauthenticated root RCE, while the other can be used to create a rogue administrator account. Either one would justify urgent work on its own.

Scope: Ivanti Sentry gateway deployments Why now: CVSS 10.0 and 9.9; both KEV-listed Next step: Upgrade to the fixed release in Ivanti’s advisory

5. CVE-2026-47288: Windows Kerberos KDC

Critical RCE in the Windows Kerberos Key Distribution Center, putting domain controllers in the blast radius. There is no confirmed exploitation listed here yet, but the affected role makes delaying it a hard sell.

Scope: Windows Server domain controllers Why now: Critical, released with June 2026 Patch Tuesday Next step: Roll out the June updates, with domain controllers handled early

I try to limit these posts to 5 CVE's so it doesn't get too long, but feel free to discuss anything that missed the cut down in the comments!

Hello all! Since the post last week seemed to be helpful to some folks, I figured I'd make another post this week.

The big, bad, scary one is the Netlogon RCE because it targets domain controllers and is now confirmed exploited. After that, I’d be looking at Palo Alto GlobalProtect, SolarWinds Serv-U, Cisco SD-WAN Manager, and any Linux container hosts that might still be exposed to the old cgroups v1 escape.

Here's the order I’d work them:

1. CVE-2026-41089: Microsoft Windows Netlogon

Stack-based buffer overflow in Netlogon. An unauthenticated attacker can hit a domain controller over the network and get code execution.

Affected: Windows Server 2012 R2 through 2025.

Why it matters: CVSS 9.8. Active exploitation has been confirmed by Belgium’s CCB.

Action: If your DCs got May’s cumulative update, you should be covered. If you deferred May updates on domain controllers, I’d move this to the top of the queue. Find your rollup patches here for your Server version.

2. CVE-2026-0257: Palo Alto Networks PAN-OS GlobalProtect

Authentication bypass in the GlobalProtect portal and gateway. The short version is that forged cookies can give an attacker an unauthorized VPN session.

Affected: PAN-OS firewalls with a GlobalProtect portal or gateway where authentication override cookies are enabled.

Why it matters: CVSS 9.1. Exploited in the wild and on CISA KEV.

Action: Patch to a fixed PAN-OS release. If you can’t patch immediately, disable authentication override or use a dedicated certificate only for that feature.

3. CVE-2026-28318: SolarWinds Serv-U

Unauthenticated denial of service. A crafted POST request with a Content-Encoding: deflate header can crash the Serv-U service.

Affected: Serv-U file transfer versions before 15.5.4, and 15.5.4 without Hotfix 1.

Why it matters: CVSS 7.5. Exploited in the wild. Added to CISA KEV on June 5 with a federal deadline of June 19.

Action: Update to Serv-U 15.5.4 Hotfix 1. If you need an interim move, restrict access to known IPs and block POST requests carrying a Content-Encoding header.

4. CVE-2026-20245: Cisco Catalyst SD-WAN Manager

Command injection in Cisco Catalyst SD-WAN Manager. A crafted file upload can run arbitrary commands as root.

Affected: Cisco Catalyst SD-WAN Manager, formerly vManage.

Why it matters: CVSS 7.8. Exploited as a zero-day. No patch available yet.

Action: This one does require netadmin privileges, so it is not the same kind of emergency as an unauthenticated internet-facing RCE. But with no fix available, I’d still lock down who can reach SD-WAN Manager, audit netadmin accounts, make sure MFA is solid, and watch Cisco’s advisory for the patch. You can see Cisco's additional recommendations here.

5. CVE-2022-0492: Linux kernel cgroups v1 container escape

Old bug, but newly relevant again because CISA added it to KEV last week. The cgroups v1 releaseagent issue can let a low-privileged local user escape a container and escalate to root.

Affected: Linux hosts running containers on unpatched kernels or with overly permissive container configs.

Why it matters: CVSS 7.8. Added to CISA KEV on June 2 based on evidence of active exploitation.

Action: Check your container hosts. Make sure kernels are patched, containers are not running with CAPSYSADMIN, and AppArmor/SELinux/Seccomp profiles are actually enforced.

Three of these are on CISA KEV: Palo Alto, Serv-U, and the Linux cgroups bug.

If I only had time to clear one, I’d start with Netlogon. Unauthenticated RCE against domain controllers is not something I’d want sitting around, especially now that exploitation has been confirmed.

Serv-U would be next if it is internet-facing, then Palo Alto GlobalProtect if authentication override is enabled.

Also worth noting: Check Point Remote Access VPN CVE-2026-50751 and LiteLLM CVE-2026-42271 both landed on KEV after this window, so they’ll probably be in next week’s batch.

If you like the format, please consider checking out my newsletter! Link is on my profile page.