Overview
Microsoft has released an update addressing a critical severity vulnerability in the Windows kernel which could enable a malicious actor to execute code over a network on affected systems without needing to sign in or interact with a user.
Please also note, as part of Microsoft’s latest “Patch Tuesday” (June 2026), well over 200 vulnerabilities (including several possessing critical severity ratings) have been patched.
- CVE-2026-45657: Windows Kernel Remote Code Execution Vulnerability (CVSSv3.1 9.8)
Affected versions:
- Windows 11 Versions 26H1, 24H2, 23H2, 25H2
- Windows Server 2025 (Server Core Installation)
- Windows Server 2022 (incl. Server Core Installation)
Ubiquiti has released a security update for their UniFi OS line of products addressing a critical vulnerability. UniFi may be used within an organisation to manage a range of business operations and equipment. A malicious actor with access to the network and low privileges could exploit certain affected devices running UniFi OS to execute command injection, resulting in privilege escalation when chained with other vulnerabilities.
- CVE-2026-47370: UniFi OS Improper Input Validation Vulnerability (CVSSv3.1 9.9).
Affected versions:
- UniFi OS Server (Version 5.0.8 and earlier)
- UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UCK, UCKP, UCK-Enterprise, UNVR, UNVR-Pro, UNVR-Instant, ENVR, ENVR-Core, UNVR-G2, UNVR-G2-Pro, UCG-Ultra, UCG-Max, UCG-Industrial and UCG-Fiber (Version 5.1.12 and earlier)
- UDM-Beast (Version 5.1.11 and earlier)
- UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4 and UNAS-Pro-8 (Version 5.1.10 and earlier)
- Express (Version 4.0.14 and earlier)
MariaDB has identified a critical vulnerability which has now been patched. MariaDB is one of the largest community-maintained database systems used in organisations all round the world. When a particular setting is enabled, an attacker can embed shell commands leading to arbitrary command execution on the vulnerable server. The vulnerability has been given the highest severity rating implying that exploitation likely requires no authentication or minimal interaction.
- CVE-2026-49261: MariaDB Remote Code Execution Vulnerability (CVSSv3.1 10.0)
Affected versions:
- 10.6.1 <= 10.6.26
- 10.11.1 <= 10.11.17
- 11.4.1 <= 11.4.11
- 11.8.1 <=11.8.7
- 12.3.1
Recommended Action
Organisations and individuals are encouraged to review the appropriate security pages and apply the necessary updates:
Microsoft - Security Update Guide - Windows Kernel Remote Code Execution Vulnerability
Ubiquiti - UniFi | Security Advisory Bulletin
MariaDB - MariaDB Server | MDEV-39721