Advisories
Cisco Webex App Open‑Redirect Flaw (CVE‑2026‑20178) – Patch Already Out
A flaw in Cisco Webex’s browser interface let attackers redirect users to malicious sites via crafted URLs. The issue stemmed from inadequate validation of URL parameters in HTTP requests. Cisco has issued a patch, and no customer action is required.
A recent advisory from Cisco highlights an open‑redirect vulnerability in the Webex web app (CVE‑2026‑20178). The flaw allows an unauthenticated attacker to craft a URL that, when clicked by a user, forces the browser to navigate to an attacker‑controlled site.
How the Exploit Works
The weakness arises from improper input validation of URL parameters in an HTTP request. An attacker can embed a malicious target in the URL, trick users into clicking it, and then be redirected to phishing or malware sites.
Mitigation
Cisco has released software updates that fix the validation issue. The patch is already deployed to the Webex web app, so customers do not need to take any additional steps. No workarounds are available.
Security Impact Rating: Medium
Related vulnerabilities
Microsoft Office Word CVE-2026-108439 RCE – Omitted from October 2026 Patch
Microsoft identified that the October 2026 security update for Office Word did not list CVE‑2026‑108439, a remote code execution flaw. The patch already contains the fix, so systems that applied the October 2026 updates are protected. Defenders should verify that the October 2026 update is installed and monitor for any unpatched environments.
Read briefing
Microsoft Outlook CVE-2026-100208: Remote Code Execution Patch Included in August 2026 Updates
A remote code execution flaw (CVE-2026-100208) in Microsoft Office Outlook was fixed in the August 2026 security updates. The update was mistakenly omitted from the public CVE list, but the patch is already applied to all affected Outlook versions. If you have applied the August 2026 updates, no additional action is required; otherwise, install the update immediately.
Read briefing
SAP Exposes Critical Kernel & Message Server Flaws: CVE-2026-44756 & CVE-2026-58240
SAP’s September Security Patch Day revealed two critical vulnerabilities that can be exploited remotely without authentication. The memory‑corruption flaw in SAP Extended Passport (OVERPASS, CVE‑2026‑44756) and the missing‑auth bug in NetWeaver Message Server (S4GET, CVE‑2026‑58240) both allow attackers to run arbitrary OS commands as the SAP installation user, risking full system takeover. Immediate application of SAP Security Notes 3747649 and 3759472 is mandatory.
Read briefing
Microsoft Office Excel Remote Code Execution Vulnerability (CVE-2026-108446) Omitted from Oct 2026 Update
Microsoft Office Excel CVE-2026-108446, a remote code execution flaw, was fixed in the October 2026 security patch but omitted from the public update list. Systems with the October 2026 updates are already protected; no further action is required.
Read briefing