Another week, another parade of vendors acting surprised that internet-facing software should maybe require authentication. Somewhere, a blue teamer just sighed so hard it registered on seismographs.
This Week's Hall of Shame: Top CVEs
CVE-2026-0257 — Your VPN Just Became Community Property
The Gist: Palo Alto Networks PAN-OS GlobalProtect portal and gateway suffer an authentication bypass flaw rated CVSS 7.8 that lets attackers establish unauthorized VPN connections over the network. It is being exploited in the wild, and public proof-of-concept details are available.
Why It Should Keep You Up at Night: This is the sort of bug that turns your secure remote access stack into a guest Wi-Fi sign-in sheet for adversaries. If GlobalProtect is your front door, this flaw is basically the lock politely stepping aside and saying, “after you.” Panorama and Cloud NGFW aren’t affected, which is great news for exactly the systems that are not the problem.
Your Playbook:
- Identify any internet-exposed PAN-OS GlobalProtect portal and gateway instances and apply Palo Alto’s latest fixes or hotfix guidance immediately.
- Hunt for suspicious VPN sessions, unexpected account usage, and anomalous GlobalProtect authentication logs that may indicate unauthorized access already occurred.
Sources: Rapid Risk Radar | CVE Organization | CVEShield | VulnCheck KEV
CVE-2026-41089 — Netlogon, Now With Extra Remote Code Execution
The Gist: Microsoft Windows Netlogon contains a stack-based buffer overflow rated CVSS 9.8 that allows unauthenticated remote code execution over the network. Exploitation has been observed in the wild, a patch is available, and proof-of-concept material is out there for the internet to lovingly misuse.
Why It Should Keep You Up at Night: Netlogon is not some obscure corner of Windows nobody uses; it is foundational plumbing, which means this is the kind of issue that can go from “interesting advisory” to “why is the entire domain on fire” with impressive speed. Unauthenticated network RCE in Windows is the cybersecurity equivalent of hearing ominous music start and realizing you’re not the main character.
Your Playbook:
- Deploy Microsoft’s available security update for CVE-2026-41089 across domain-connected Windows systems as a priority emergency patch.
- Monitor for anomalous Netlogon traffic, crashes, or signs of lateral movement, especially on domain controllers and other high-value Windows infrastructure.
Sources: Rapid Risk Radar | MSRC Security Updates | CVE Organization | Bleeping Computer
CVE-2025-48595 — Android Priv-Esc, Because Of Course
The Gist: Google patched CVE-2025-48595, a high-severity integer overflow flaw with CVSS 8.4 that can lead to local code execution and privilege escalation on Android without user interaction. It has been exploited in the wild, and proof-of-concept details are publicly available.
Why It Should Keep You Up at Night: “No user interaction required” is one of those phrases security teams love in the same way people love dental surgery. Once an attacker gets a foothold, this bug can help them climb privileges on-device, which is especially fun when your fleet includes executives, admins, or anyone who still thinks sideloading random apps is a personality trait.
Your Playbook:
- Roll out the latest Android security updates to all supported devices and verify patch compliance through your mobile device management platform.
- Review mobile threat telemetry for suspicious local privilege escalation behavior and prioritize unsupported or delayed-patch devices for containment or replacement.
Sources: Rapid Risk Radar | CVE Organization | Bleeping Computer | HelpNetSecurity
Industry Intel: What Else is On Fire This Week
- Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes — Because apparently credential leakage via a URI handler is still on the menu, and Windows just keeps serving. Read more
- New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare — The internet’s favorite web stack collective has discovered that “standards compliance” and “not falling over” remain separate product features. Read more
- Weedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated Content — Nothing says “I wanted free stuff” like accidentally downloading malware, crypto miners, and disappointment in one convenient bundle. Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.