Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.

External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.

An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.

CVE-2026-40958 is a input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client.

Path traversal in Ivanti  Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.

An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.

This week’s list is a little Windows-heavy thanks to June Patch Tuesday. Four of the five are already on CISA’s KEV list, the DHCP flaw can be triggered from the local network, and Oracle had to release an out-of-band fix for a PeopleSoft zero-day that was already being used in attacks.

1. CVE-2026-44815: Windows DHCP Client

A malicious DHCP server on the same network can send a crafted response and get code execution on Windows clients. That makes this more important than a normal workstation patch, especially on guest Wi-Fi, branch networks, or anywhere you don’t fully trust the local segment.

Scope: Windows systems using DHCP Why now: Critical, KEV-listed, CISA deadline June 23 Next step: Deploy the June 2026 Windows updates

2. CVE-2026-35273: Oracle PeopleSoft PeopleTools

Unauthenticated RCE that attackers were already using for data theft before Oracle released the fix. Any exposed or affected PeopleSoft server deserves both a patch and a closer look at what happened before it was patched.

Scope: PeopleTools 8.61 and 8.62 Why now: CVSS 9.8, KEV-listed, CISA deadline July 3 Next step: Apply Oracle’s out-of-band update and check for signs of post-exploitation activity

3. CVE-2026-0257: Palo Alto PAN-OS GlobalProtect

An authentication bypass that allows attackers to establish GlobalProtect VPN sessions without valid credentials. Since this sits at the front door of the networks running a Palo fw, log review matters almost as much as installing the fix.

Scope: Exposed GlobalProtect portals and gateways Why now: Active exploitation confirmed by Unit 42 on June 9 Next step: Apply the appropriate PAN-OS hotfix and investigate any VPN sessions you can’t explain

4. CVE-2026-10520 / CVE-2026-10523: Ivanti Sentry

This is a rough pair: one flaw allows unauthenticated root RCE, while the other can be used to create a rogue administrator account. Either one would justify urgent work on its own.

Scope: Ivanti Sentry gateway deployments Why now: CVSS 10.0 and 9.9; both KEV-listed Next step: Upgrade to the fixed release in Ivanti’s advisory

5. CVE-2026-47288: Windows Kerberos KDC

Critical RCE in the Windows Kerberos Key Distribution Center, putting domain controllers in the blast radius. There is no confirmed exploitation listed here yet, but the affected role makes delaying it a hard sell.

Scope: Windows Server domain controllers Why now: Critical, released with June 2026 Patch Tuesday Next step: Roll out the June updates, with domain controllers handled early

I try to limit these posts to 5 CVE's so it doesn't get too long, but feel free to discuss anything that missed the cut down in the comments!

An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root

An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access.

An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code.

SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.

Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.

An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials.

OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM

An incorrect permission assignment for critical resource of Ivanti Secure Access Client   before 22.8R6 allows a local authenticated user to read or modify sensitive log data via write access to a shared memory section.

External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ivanti Endpoint Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 4.9. The following CVEs are assigned: CVE-2026-8109.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ivanti Endpoint Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 4.9. The following CVEs are assigned: CVE-2026-8109.