Assess CAPWAP exposure

Fortinet published FG-IR-26-123 for CVE-2025-53844, an out-of-bounds vulnerability in CAPWAP processing across affected products.

Validate policies

Google Cloud disclosed CVE-2026-2264 in Apigee, where an unvalidated IntegrationRegion value could support server-side request forgery and service-account token exfiltration.

Patch container hosts

Google Cloud warned that CVE-2026-46300, known as Fragnesia, can let an unprivileged local attacker escalate to root on a Linux container host.

Confirm platform mitigation

Google Cloud reported infrastructure mitigations for CVE-2025-54518, an AMD Zen 2 micro-operation cache issue that could affect security boundaries or data access under specific conditions.

Review host firmware

Google Cloud described AMD firmware flaws that could allow a malicious hypervisor to execute code on the AMD Secure Processor and undermine SEV-SNP guest confidentiality and integrity.

Validate certificate updates

Google Cloud reminded customers that 2011 Secure Boot certificates begin expiring in June 2026 and systems without the 2023 certificates may miss future early-boot protections.

Patch and investigate

Cisco confirmed active exploitation of CVE-2026-20133 in Catalyst SD-WAN and recommends fixed releases plus network restrictions around control components.

Patch immediately

Fortinet rated CVE-2026-39813 critical after a path-traversal flaw in the FortiSandbox JRPC API could let an unauthenticated attacker bypass authentication and escalate privileges.

Update service version

Fortinet updated FG-IR-26-096 for CVE-2026-25836, an authenticated command injection in the vmimages update feature of FortiSandbox Cloud and PaaS.

Investigate and patch

Fortinet documented active exploitation of CVE-2026-24858, including configuration theft and creation of persistent administrator accounts through FortiOS SSO abuse.