Advisories
CVE‑2026‑108455: PowerPoint Information Disclosure – Update Omission Clarified
Microsoft Office PowerPoint’s information disclosure vulnerability (CVE‑2026‑108455) was fixed in the October 2026 security update, but the CVE was omitted from the advisory list. Defenders should verify the update is installed; no further action is required if already updated.
What Happened
A Microsoft Office PowerPoint information disclosure vulnerability (CVE‑2026‑108455) was fixed in the October 2026 security update. The CVE was mistakenly omitted from the update’s advisory list, leading to confusion about coverage.
Impact
The flaw could allow an attacker to read sensitive data from a PowerPoint presentation when the file is opened or processed. The fix is included in the October 2026 update, so systems that have applied that update are no longer vulnerable.
What to Do
- Verify that the October 2026 update is installed on all Office deployments.
- If the update is missing, install it immediately from Windows Update or the Microsoft Update Catalog.
- Confirm that the update includes the fix for CVE‑2026‑108455 by checking the update metadata or the Security Update Guide.
- Continue monitoring Microsoft’s Security Update Guide for any further clarifications.
Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October 2026 updates do not need to take any further action.
Related vulnerabilities
MISP Hit by Cluster of Critical Vulnerabilities – Remote DoS, Data Breach, Integrity Flaws
French CERT has identified a wave of CVEs affecting all MISP releases older than 2.5.45. The flaws allow attackers to trigger remote denial‑of‑service, exfiltrate sensitive data, corrupt stored information, and exploit SSRF, XSS, and CSRF vectors. Patches are already available; operators must update immediately.
Read briefing
CPython Vulnerability CVE-2026-87910: Unspecified Security Risk Exploitable Until Latest Patch
The French CERT (CERT-FR) has identified a critical flaw in CPython that allows attackers to trigger an unspecified security issue in any Python interpreter lacking the newest security update. The vulnerability, catalogued as CVE‑2026‑87910, is not tied to a particular exploit vector but can potentially lead to arbitrary code execution or privilege escalation. Python developers and users must immediately apply the latest patch released on 11 September 2026 to mitigate the risk. Failure to update could expose systems running unpatched CPython to unknown but potentially severe attacks.
Read briefing
Cisco Catalyst SD‑WAN Hardening Update: Critical Vulnerabilities Resolved (CVE‑2026‑20303‑20313)
Cisco’s SD‑WAN software team released a hardening patch in August 2026 after an internal audit uncovered several critical weaknesses. Five CVEs—CVE‑2026‑20303, ‑20304, ‑20310, ‑20312, ‑20313—were addressed through a single update per CWE class. No workarounds exist, so all Catalyst SD‑WAN customers should apply the new releases immediately to close the gaps.
Read briefing
SAP Exposes Critical Kernel & Message Server Flaws: CVE-2026-44756 & CVE-2026-58240
SAP’s September Security Patch Day revealed two critical vulnerabilities that can be exploited remotely without authentication. The memory‑corruption flaw in SAP Extended Passport (OVERPASS, CVE‑2026‑44756) and the missing‑auth bug in NetWeaver Message Server (S4GET, CVE‑2026‑58240) both allow attackers to run arbitrary OS commands as the SAP installation user, risking full system takeover. Immediate application of SAP Security Notes 3747649 and 3759472 is mandatory.
Read briefing