New BSI Advisories and Ivanti EPMM Active Watchpoint

New BSI Advisories and Ivanti EPMM Active Watchpoint

Finding: Ivanti EPMM CVE-2026-6973 remains the active-exploitation watchpoint

Confidence: Medium

CISA continues to list Ivanti EPMM CVE-2026-6973 in the Known Exploited Vulnerabilities catalogue. There is no new technical detail in the current source set, so this is not a fresh vulnerability story. It is still the item most likely to matter first for teams that operate mobile-device management or edge-facing EPMM infrastructure.

The practical message is simple: do not let the broader patch queue distract from a known exploited entry. Asset owners should confirm whether Ivanti EPMM is present, verify patch or mitigation status, and keep remediation evidence visible until the risk is closed.

Finding: Cisco Unity Connection WID-SEC-2026-1388 needs collaboration-owner triage

Confidence: Low

BSI CERT-Bund lists WID-SEC-2026-1388 as a high-severity advisory for Cisco Unity Connection. The available source set does not include CVE identifiers, affected versions, fixed releases, exploitation reporting or named victims.

That keeps confidence low, but the asset class is important. Unity Connection can sit close to collaboration and voice infrastructure. Teams should confirm whether the product is deployed, identify the owning team, and watch Cisco channels for version-specific patch guidance.

Finding: Microsoft Azure WID-SEC-2026-1419 is an exposure-mapping prompt

Confidence: Low

BSI CERT-Bund lists WID-SEC-2026-1419 as a high-severity Microsoft Azure advisory. No CVE list, exploit detail or tenant-specific mitigation detail was present in the available material.

Cloud teams should treat this as an ownership and exposure question, not as proof of active compromise. The useful first step is to route the WID item to tenant owners, then check whether Microsoft publishes affected-service or configuration detail that changes the priority.

Finding: Microsoft Teams WID-SEC-2026-1413 raises information-disclosure review

Confidence: Low

BSI CERT-Bund lists WID-SEC-2026-1413 as a high-severity Microsoft Teams information-disclosure advisory. The source set does not provide a CVE, a Microsoft advisory reference, affected client versions, or exploit evidence.

Teams is widely deployed, so even thin signals deserve routing. Security and tenant administrators should check for official Microsoft follow-up and be ready to assess data-exposure implications if affected versions or service conditions become clearer.

Finding: Red Hat OpenShift Tempo WID-SEC-2026-1415 reaches observability and middleware dependencies

Confidence: Low

BSI CERT-Bund lists WID-SEC-2026-1415 as a high-severity advisory for Red Hat OpenShift Tempo and Apache Thrift. The available evidence does not include affected component versions, fixed builds, CVE identifiers or exploit status.

This belongs with platform and observability owners. Confirm whether OpenShift Tempo is in use, identify Apache Thrift exposure through SBOM or package inventory, and wait for vendor-specific detail before assigning emergency severity.

Finding: Golang Go WID-SEC-2026-1437 affects runtime and build-environment tracking

Confidence: Low

BSI CERT-Bund lists WID-SEC-2026-1437 as a medium-severity advisory for Golang Go. The current source set lacks CVE detail, fixed Go versions and exploitation evidence.

Go advisories can matter beyond servers because the runtime and toolchain may be embedded in build processes. Package owners should record which Go versions are used for builds and deployed services, then prepare update planning once official fixed-version detail is available.

Finding: IBM MQ WID-SEC-2026-1431 adds a messaging-middleware disclosure item

Confidence: Low

BSI CERT-Bund lists WID-SEC-2026-1431 as a medium-severity IBM MQ information-disclosure advisory. No affected-version table, vendor fix reference, CVE identifier or exploitation signal was present in the available material.

IBM MQ often supports sensitive application flows. Owners should map deployed versions, identify external or cross-zone broker exposure, and follow IBM channels for precise update guidance.

Finding: MISP WID-SEC-2026-1424 touches threat-intelligence platform hygiene

Confidence: Low

BSI CERT-Bund lists WID-SEC-2026-1424 as a medium-severity cross-site scripting advisory for MISP. The current source set does not provide a CVE, affected-version range, proof of exploitation or vendor patch note.

MISP instances may hold sensitive indicators, community feeds and internal enrichment data. Administrators should confirm version ownership, review user and sharing boundaries, and prepare an update path once the vendor detail is available.

Finding: Microsoft 365 Copilot Business Chat WID-SEC-2026-1411 needs tenant-owner review

Confidence: Low

BSI CERT-Bund lists WID-SEC-2026-1411 as a medium-severity information-disclosure advisory for Microsoft 365 Copilot Business Chat. The available evidence does not include affected tenant configurations, a CVE identifier or confirmed exploitation.

Because Copilot Business Chat can sit near enterprise content, the review should go to the people who own Microsoft 365 data boundaries. Confirm enablement status, sensitivity labels and administrator ownership, then watch for Microsoft detail that clarifies actual exposure.

Finding: Mozilla Firefox and Firefox ESR WID-SEC-2026-1427 moves into endpoint update planning

Confidence: Low

BSI CERT-Bund lists WID-SEC-2026-1427 as a medium-severity advisory for Mozilla Firefox and Firefox ESR. The current source set does not include the underlying CVE set, fixed releases or exploitation evidence.

Browser updates are familiar work, but they still need discipline. Endpoint owners should check managed Firefox and ESR channels, confirm update cadence, and prioritise high-exposure user groups if Mozilla publishes corroborating detail.

Finding: etcd WID-SEC-2026-1400 is a cluster dependency to locate quickly

Confidence: Low

BSI CERT-Bund lists WID-SEC-2026-1400 as a medium-severity etcd security-bypass advisory. The source material does not include affected versions, exploit conditions, CVE identifiers or fixed builds.

etcd can be critical to Kubernetes and distributed systems. Platform teams should confirm where etcd is present, check cluster ownership, and be ready to patch once fixed-version guidance appears.

Why This Matters

Today’s change is not a single confirmed emergency. It is a split workload: one known exploited Ivanti EPMM item that should stay on the remediation board, plus ten new BSI CERT-Bund advisories that need owner routing and vendor follow-up.

The new WID items are broad enough to create coordination friction. They touch collaboration tools, cloud services, observability, middleware, development runtimes, threat-intelligence platforms, browsers and cluster dependencies. Thin evidence makes the work less dramatic, not less necessary.

• Recommended Actions
• Keep Ivanti EPMM CVE-2026-6973 visible until patch or mitigation evidence is confirmed.
• Assign owners for Cisco Unity Connection, Azure, Teams, OpenShift Tempo, Go, IBM MQ, MISP, Microsoft 365 Copilot Business Chat, Firefox ESR and etcd.
• Treat the ten new BSI CERT-Bund WID entries as low-confidence until vendor advisories, CVEs, affected versions or fixed releases appear.
• Prioritise exposure checks for externally reachable collaboration, messaging, tenant and cluster-control assets.
• Track vendor channels for affected-version detail before escalating the new WID items beyond the available evidence.
• Because cross-publication dedup verification could not be completed, run a manual overlap check before publication.

All findings grounded in a13e intelligence sweeps through 05:30 UTC 09 May 2026.