Patch/Configuration Management

The critical vulnerability CVE-2025-32975 in Quest KACE Systems Management Appliance (SMA) was actively exploited by attackers who had not patched the system for 10 months after a fix was released in May 2025.

The issue, acknowledged on April 14, impacts Windows 10, Windows 11, and Windows Server devices configured with an "unrecommended" BitLocker Group Policy.

The bug affected a limited number of Windows 11 devices (versions 25H2, 24H2, and 23H2) within the EU region.

The May 2026 Microsoft security update included no zero days for the first time since June 2024.

The actively exploited flaw enables remote admin users to execute arbitrary code.

Dirty Frag Linux zero-day exposes most distributions to root privilege escalation.

The vulnerability, identified as CVE-2026-23918 with a CVSS score of 8.8, is a double-free error within the HTTP/2 implementation.