Agility Retail Step 4: ticket instructions, client email (paste share links after export), Sales quote ticket, remaining remediations, and Manage PSA notes.
Scan: 2026-09-28 | Presenter: Chris Knospe | Export set: 90 in export (Top 10 per location) | Client type: RMIT+
The following vulnerabilities/remediations are NOT considered standard maintenance and therefore need to be quoted. Remediation(s): -------------------------------------------------------------------------------------------- Vulnerability: Microsoft .NET (all versions) Remediation Options: Update to version 5.0.17 or later; uninstall if not in use Target Machines: AgilityRetailHZ, AgilityRetailHZ, AgilityRetailHZ, AgilityRetailHZ, AgilityRetailHZ, FrontOfficeFl, FrontOfficeFl, AgilityRetailHZ, PRINTMASTERPC, Mona1, DESKTOP-A0L35K5, 28CFWM3, 192.168.10.84, ENGENEERING-4, HESNA-PC, Carlosg-Home, ENGINEERING-3, DESKTOP-97QU41M, DESKTOP-JC0LEGB, Mona1, DESKTOP-A0L35K5, 28CFWM3, 192.168.10.84, ENGENEERING-4, HESNA-PC, DESKTOP-97QU41M, DESKTOP-97QU41M, PRINTMASTERPC Estimated Time of Remediation: 4 hours Remediation Method: Deploy the matching runtime installer via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Adobe Creative Suite 6 Design Standard Remediation Options: Update to the current version; uninstall if not in use Target Machines: Moon-Fabrication Estimated Time of Remediation: 0.5 hours Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft .NET (all versions) Remediation Options: Update to version 6.0.36 or later; uninstall if not in use Target Machines: L-LEN-PF5V3QDM, L-Len-PF5AY1LH, L-Len-PF5AY1ES, L-LEN-PF5V3QDM, LAPTOP-E5A1CAJI, LAPTOP-E5A1CAJI Estimated Time of Remediation: 4 hours Remediation Method: Deploy the matching runtime installer via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Adobe Acrobat Reader DC MUI Remediation Options: Update to version 26.002.21931 or later; uninstall if not in use Target Machines: vinyl-PC.moonmfg Estimated Time of Remediation: 5 hours Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Adobe Acrobat X Standard - English, Français, Deutsch Remediation Options: Update to the current version; uninstall if not in use Target Machines: DESKTOP-PJRUCQG Estimated Time of Remediation: 5 hours Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Adobe Acrobat X Pro - English, Français, Deutsch Remediation Options: Update to the current version; uninstall if not in use Target Machines: Moon-Fabrication Estimated Time of Remediation: 0.5 hours Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft .NET (all versions) Remediation Options: Update to version 10.1.11 or later; uninstall if not in use Target Machines: RebeccaByron, DESKTOP-M8ICQCG, DESKTOP-ULFPN40, DELL-DGS43-MK.cormarkinc, DESKTOP-M8ICQCG, SherylMendoza, M-Bartczak, FarrahBradley, TiffanyBlack, win-eael5m09bfk, DESKTOP-ULFPN40, EwaMankowski, DELL-DGS43-MK.cormarkinc, DESKTOP-CENHO7S, DESKTOP-LTES1BM, EwaMankowski, EwaMankowski Estimated Time of Remediation: 4 hours Remediation Method: Deploy the matching runtime installer via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft .NET (all versions) Remediation Options: Update to version 3.1.32 or later; uninstall if not in use Target Machines: DESKTOP-RBJIB4E, DESKTOP-LJANK6I, DESKTOP-RBJIB4E, DESKTOP-RBJIB4E, DESKTOP-RBJIB4E Estimated Time of Remediation: 4 hours Remediation Method: Deploy the matching runtime installer via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Foxit PDF Editor Remediation Options: Update to version 13.1.6.23570 or later; uninstall if not in use Target Machines: AleshireEng, JordanEngineer Estimated Time of Remediation: 0.5 hours Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft Visual C++ (all versions) Remediation Options: Patch each installed version with the matching vc_redist package; remove a version only if no application uses it Target Machines: 2008: 10.10.100.110 2010: 10.10.100.110, LAPTOP-CT3OBSLV, Aaron-LPT 2012: 10.10.100.110, LAPTOP-CT3OBSLV 2013: LAPTOP-NQEJAOFU, LAPTOP-4BQ0Q6F7, 10.10.100.110, LAPTOP-N36HPSLT, OfficeLPT, LAPTOP-H189O8CF, Aaron-LPT, LAPTOP-A0MCMC9H, LAPTOP-4IAP1Q3R, LAPTOP-HG7ATGBA Other: 10.10.100.110 Estimated Time of Remediation: 6 hours Remediation Method: Deploy matching vc_redist packages (aka.ms/vcredist) or Windows Update via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft .NET (all versions) Remediation Options: Update to version 8.0.31 or later; uninstall if not in use Target Machines: LAPTOP-NQEJAOFU, LAPTOP-NQEJAOFU, OfficeLPT, Aaron-LPT Estimated Time of Remediation: 4 hours Remediation Method: Deploy the matching runtime installer via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft Visual C++ (all versions) Remediation Options: Patch each installed version with the matching vc_redist package; remove a version only if no application uses it Target Machines: 2008: Mona1, DESKTOP-A0L35K5, 28CFWM3, 192.168.10.84, ENGINEERING-3 2010: ENGINEERING-3 2012: ENGENEERING-4, ENGINEERING-3 2013: PRINTMASTERPC, Mona1, DESKTOP-ITMA3VO, DESKTOP-A0L35K5, DESKTOP-L07U07V, 28CFWM3, 192.168.10.84, ENGENEERING-4, HESNA-PC, Carlosg-Home, DESKTOP-N9IPL96, AgilityRetailHZ, DESKTOP-97QU41M Estimated Time of Remediation: 6 hours Remediation Method: Deploy matching vc_redist packages (aka.ms/vcredist) or Windows Update via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft Visual C++ (all versions) Remediation Options: Patch each installed version with the matching vc_redist package; remove a version only if no application uses it Target Machines: 2008: LAPTOP-0PI88JJK, ChicagoNorth-Fishbowl, LAPTOP-LI5TEO9Q 2010: LAPTOP-0PI88JJK, Pluto1, SATURN, SMS-WKS6, LAPTOP-LI5TEO9Q, BYT14 2012: LAPTOP-0PI88JJK, SATURN, SMS-WKS6 2013: LAPTOP-0PI88JJK, SATURN, 192.168.9.40, SMS-WKS6, ChicagoNorth-Fishbowl Other: LAPTOP-LI5TEO9Q Estimated Time of Remediation: 6 hours Remediation Method: Deploy matching vc_redist packages (aka.ms/vcredist) or Windows Update via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft Visual C++ (all versions) Remediation Options: Patch each installed version with the matching vc_redist package; remove a version only if no application uses it Target Machines: 2008: Agility-H7-3306, Agility-H7-3262, Agility-H7-3261, Agility-H7-3268, DESKTOP-GUKI3V9 2010: LAPTOP-D7HGG20H, Agility-R5-0253, LAPTOP-PI88L0PE, Agility-TC-000N, Agility-H7-3306, Agility-H7-3267, Agility-H7-3262, Agility-H7-3268, CUSTSERV2-DSPC, CUSTSERV3-SLPC, Agility-H7-3261 2012: Agility-R5-0253, CUSTSERV2-DSPC, CUSTSERV3-SLPC 2013: DESKTOP-GUKI3V9, LAPTOP-PI88L0PE, Agility-H7-3306, Agility-H7-3262, Agility-H7-3268, Agility-H7-3261 Other: Agility-H7-3306, Agility-H7-3262, Agility-H7-3268, Agility-H7-3261 Estimated Time of Remediation: 6 hours Remediation Method: Deploy matching vc_redist packages (aka.ms/vcredist) or Windows Update via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Foxit PDF Editor Remediation Options: Update to version 13.1.6.23570 or later; uninstall if not in use Target Machines: DESKTOP-JC0LEGB Estimated Time of Remediation: 0.5 hours Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Google Chrome Remediation Options: Update to version 154.0.8037.58 or later; uninstall if not in use Target Machines: 192.168.9.40, BYT14, LAPTOP-0PI88JJK, Pluto1 Estimated Time of Remediation: 0.5 hours Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft .NET (all versions) Remediation Options: Update to version 5.0.17 or later; uninstall if not in use Target Machines: LAPTOP-0VDGBMFV, JoshDesktop, JoshDesktop, JoshDesktop, LAPTOP-0VDGBMFV, JoshDesktop, JoshDesktop, JoshDesktop Estimated Time of Remediation: 4 hours Remediation Method: Deploy the matching runtime installer via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft .NET (all versions) Remediation Options: Update to version 10.1.11 or later; uninstall if not in use Target Machines: DESKTOP-E32TV1A, DESKTOP-E32TV1A, DESKTOP-E32TV1A, DESKTOP-E32TV1A, AGILITY-AM- Estimated Time of Remediation: 4 hours Remediation Method: Deploy the matching runtime installer via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft Visual C++ (all versions) Remediation Options: Patch each installed version with the matching vc_redist package; remove a version only if no application uses it Target Machines: 2008: Moon-Fabrication 2010: LAPTOP-NUV0PMBB, LAPTOP-9SFHJCD5, vinyl-PC.moonmfg, Moon-Fabrication, LAPTOP-NTB3SJ43, MOON-LT-01, LAPTOP-F5FORECH, moon-dt-acct, LAPTOP-UE1T1R2C, LAPTOP-R8OEN4P4, LAPTOP-RO56NKMM 2013: LAPTOP-9SFHJCD5, LAPTOP-NUV0PMBB, LAPTOP-NTB3SJ43, LAPTOP-F5FORECH, LAPTOP-UE1T1R2C Other: LAPTOP-9SFHJCD5, Moon-Fabrication, MOON-LT-01, LAPTOP-F5FORECH, LAPTOP-UE1T1R2C Estimated Time of Remediation: 6 hours Remediation Method: Deploy matching vc_redist packages (aka.ms/vcredist) or Windows Update via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Adobe Illustrator 2026 Remediation Options: Update to version 30.8 or later; uninstall if not in use Target Machines: ENGENEERING-4, DESKTOP-CPM25O2, L-LEN-PF5YMR5J, AgilityRetailHZ Estimated Time of Remediation: 1 hour Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Adobe Illustrator 2025 Remediation Options: Update to version 30.8 or later; uninstall if not in use Target Machines: Carlosg-Home, ENGENEERING-4 Estimated Time of Remediation: 0.5 hours Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft .NET (all versions) Remediation Options: Update to version 5.0.17 or later; uninstall if not in use Target Machines: MOON-DT-3, moon-dt-acct, MOON-LT-01, MOON-DT-3, moon-dt-acct, MOON-LT-01, JERRYREIS Estimated Time of Remediation: 4 hours Remediation Method: Deploy the matching runtime installer via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft Visual C++ (all versions) Remediation Options: Patch each installed version with the matching vc_redist package; remove a version only if no application uses it Target Machines: 2010: DESKTOP-CENHO7S 2012: DESKTOP-RREJ582, DESKTOP-LTES1BM, AnnaPisanskiDGS 2013: DESKTOP-RREJ582, DESKTOP-LTES1BM Estimated Time of Remediation: 6 hours Remediation Method: Deploy matching vc_redist packages (aka.ms/vcredist) or Windows Update via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Adobe InDesign 2024 Remediation Options: Update to version 21.3 or later; uninstall if not in use Target Machines: PRINTMASTERPC Estimated Time of Remediation: 0.5 hours Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Python 3.13.5 (64-bit) Remediation Options: Update to version 3.14.7 or later; uninstall if not in use after dependency check Target Machines: JoshDesktop Estimated Time of Remediation: 0.5 hours Remediation Method: Confirm which applications depend on Python, then update via RMM or ScreenConnect Backstage. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Python 3.13.5 Executables (64-bit) Remediation Options: Update to version 3.14.7 or later; uninstall if not in use after dependency check Target Machines: JoshDesktop Estimated Time of Remediation: 0.5 hours Remediation Method: Confirm which applications depend on Python, then update via RMM or ScreenConnect Backstage. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Adobe Illustrator 2024 Remediation Options: Update to version 30.8 or later; uninstall if not in use Target Machines: PRINTMASTERPC Estimated Time of Remediation: 0.5 hours Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Foxit PDF Editor Remediation Options: Update to version 2026.2.1.39815 or later; uninstall if not in use Target Machines: Desktop-PF5SCZB Estimated Time of Remediation: 0.5 hours Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Speculative Store Bypass Remediation Options: Correct the listed configuration, or leave it when the client accepts the risk Target Machines: AGILITY-AM-, Agility-H7-3261, Agility-H7-3262, Agility-H7-3266, Agility-H7-3267, Agility-H7-3268, Agility-H7-3304, Agility-H7-3306, Agility-R5-0253, Agility-TC-000N, Agility-TC-00CX, Agility-TC-00RZ, Agility-TC-00S3, Agility-TC-00SG, Agility-TC-00SJ, ARG-MSP-Admin, AR-MGMT-RR-04, CUSTSERV1-CBPC, CUSTSERV2-DSPC, CUSTSERV3-SLPC, DESKTOP-E32TV1A, DESKTOP-GUKI3V9, DESKTOP-HLD5C2T, LAPTOP-2TN7SKFJ, LAPTOP-4GNJ03P4, LAPTOP-768965L7, LAPTOP-8HSVAPMI, LAPTOP-D7HGG20H, LAPTOP-LU45RTS5, LAPTOP-PI88L0PE, LAPTOP-QAQ1LMU0, LAPTOP-SHJTQ6VH, Tom Estimated Time of Remediation: 10 hours Remediation Method: Apply the configuration change after confirming impact. Verify the setting after the change. -------------------------------------------------------------------------------------------- Vulnerability: Mozilla Firefox Remediation Options: Update to version 156.0.1 or later; uninstall if not in use Target Machines: AleshireEng, JordanEngineer Estimated Time of Remediation: 0.5 hours Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Speculative Store Bypass Remediation Options: Correct the listed configuration, or leave it when the client accepts the risk Target Machines: 10.10.12.13, AleshireEng, AndyZauftLenovo, AR-MGMT-RR-09, InfinityIT, JordanEngineer, Kiosk-01251, Kiosk-60946, KnufThinkBook, LAPTOP-191H8K8O, LAPTOP-594KP8JU, LAPTOP-77G99LOQ, LAPTOP-98P2V02G, LAPTOP-AEVF2R0P, LAPTOP-BP6PC05F, LAPTOP-E5A1CAJI, LAPTOP-MEC30P6A, L-Len-21FE00--, L-Len-21FV002--, L-Len-PF466A5E, L-Len-PF5AY1ES, L-Len-PF5AY1LH, L-Len-PF5RJVJT, L-Len-PF5RLK1E, L-LEN-PF5V3QDM, L-LEN-PF5Z83HP, RyanSaverine, Shared-49339, Shared-53052, Shared-57887, Shared-76323 Estimated Time of Remediation: 10 hours Remediation Method: Apply the configuration change after confirming impact. Verify the setting after the change. -------------------------------------------------------------------------------------------- Vulnerability: CVE-2023-38408 Remediation Options: Update to the current version; uninstall if not in use Target Machines: mosaic-al56-static-178 Estimated Time of Remediation: 1 hour Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: WinVerifyTrust Signature Validation Vulnerability Remediation Options: Correct the listed configuration, or leave it when the client accepts the risk Target Machines: AR-Cicero-01, AR-Cicero-02, AR-Cicero-03, AR-Cicero-04, AR-Cicero-05, AR-Cicero-06, AR-Cicero-07, AR-Cicero-08, AR-Cicero-09, ARG, AR-MGMT-RR-03, BrianP, DESKTOP-0G11K9F, DESKTOP-5M62Q7P, DESKTOP-A17DOU5, DESKTOP-DR40DIH, DESKTOP-IG37GOT, DESKTOP-JBKUHND, DESKTOP-LJANK6I, DESKTOP-OBI4EA8, DESKTOP-RBJIB4E, DGSRAFA, LAPTOP-1ON9DL5T, LAPTOP-67TGIKRE, LAPTOP-AMEDNSI7, LAPTOP-EPL7RODK, LAPTOP-JK3JBCVL, LAPTOP-UN4OVI86 Estimated Time of Remediation: 10 hours Remediation Method: Apply the configuration change after confirming impact. Verify the setting after the change. -------------------------------------------------------------------------------------------- Vulnerability: WinVerifyTrust Signature Validation Vulnerability Remediation Options: Correct the listed configuration, or leave it when the client accepts the risk Target Machines: 10.10.12.13, AleshireEng, AndyZauftLenovo, AR-MGMT-RR-09, InfinityIT, JordanEngineer, KnufThinkBook, LAPTOP-191H8K8O, LAPTOP-594KP8JU, LAPTOP-77G99LOQ, LAPTOP-98P2V02G, LAPTOP-AEVF2R0P, LAPTOP-BP6PC05F, LAPTOP-E5A1CAJI, LAPTOP-MEC30P6A, L-Len-21FE00--, L-Len-21FV002--, L-Len-PF466A5E, L-Len-PF5AY1ES, L-Len-PF5AY1LH, L-Len-PF5RJVJT, L-Len-PF5RLK1E, L-LEN-PF5V3QDM, L-LEN-PF5Z83HP, Shared-49339, Shared-53052, Shared-57887, Shared-76323 Estimated Time of Remediation: 10 hours Remediation Method: Apply the configuration change after confirming impact. Verify the setting after the change. -------------------------------------------------------------------------------------------- Vulnerability: Speculative Store Bypass Remediation Options: Correct the listed configuration, or leave it when the client accepts the risk Target Machines: AR-Cicero-01, AR-Cicero-02, AR-Cicero-03, AR-Cicero-04, AR-Cicero-05, AR-Cicero-06, AR-Cicero-07, AR-Cicero-08, AR-Cicero-09, AR-Cicero-10, ARG, AR-MGMT-RR-03, BrianP, DESKTOP-0G11K9F, DESKTOP-5M62Q7P, DESKTOP-A17DOU5, DESKTOP-DR40DIH, DESKTOP-IG37GOT, DESKTOP-JBKUHND, DESKTOP-JV036S2, DESKTOP-LJANK6I, DESKTOP-OBI4EA8, DESKTOP-RBJIB4E, DGSRAFA, LAPTOP-1ON9DL5T, LAPTOP-67TGIKRE, LAPTOP-AMEDNSI7, LAPTOP-EPL7RODK, LAPTOP-JK3JBCVL, LAPTOP-UN4OVI86 Estimated Time of Remediation: 10 hours Remediation Method: Apply the configuration change after confirming impact. Verify the setting after the change. -------------------------------------------------------------------------------------------- Vulnerability: Python 3.14.5 Executables (64-bit) Remediation Options: Update to version 3.14.7 or later; uninstall if not in use after dependency check Target Machines: LAPTOP-67TGIKRE, LAPTOP-EPL7RODK Estimated Time of Remediation: 0.5 hours Remediation Method: Confirm which applications depend on Python, then update via RMM or ScreenConnect Backstage. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft Visual C++ (all versions) Remediation Options: Patch each installed version with the matching vc_redist package; remove a version only if no application uses it Target Machines: 2008: L-LEN-PF5V3QDM, L-Len-PF466A5E 2010: L-Len-PF466A5E, AleshireEng, RyanSaverine 2012: L-Len-PF466A5E, AleshireEng 2013: L-Len-PF466A5E Estimated Time of Remediation: 6 hours Remediation Method: Deploy matching vc_redist packages (aka.ms/vcredist) or Windows Update via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: WinVerifyTrust Signature Validation Vulnerability Remediation Options: Correct the listed configuration, or leave it when the client accepts the risk Target Machines: alma, AnnaPisanskiDGS, AR-MGMT-RR-02, DELL-DGS43-MK.cormarkinc, DESKTOP-3N4U9QE, DESKTOP-CENHO7S, DESKTOP-LTES1BM, DESKTOP-M8ICQCG, DESKTOP-PJRUCQG, DESKTOP-RREJ582, DESKTOP-ULFPN40, ERIKALUSTER, FarrahBradley, GABRIELLAGARCIA, LAPTOP-PF5SCZGS, LAPTOP-PF5SGD86, M-Bartczak, MELISSAFIORITA, MICHAELKEATING, RebeccaByron, SherylMendoza, TiffanyBlack, win-eael5m09bfk Estimated Time of Remediation: 10 hours Remediation Method: Apply the configuration change after confirming impact. Verify the setting after the change. -------------------------------------------------------------------------------------------- Vulnerability: Mozilla Firefox Remediation Options: Update to version 156.0.1 or later; uninstall if not in use Target Machines: DESKTOP-RREJ582 Estimated Time of Remediation: 0.5 hours Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft .NET (all versions) Remediation Options: Update to version 8.0.31 or later; uninstall if not in use Target Machines: LAPTOP-MDIUJJTB, LAPTOP-MDIUJJTB, teri-sms Estimated Time of Remediation: 4 hours Remediation Method: Deploy the matching runtime installer via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: WinVerifyTrust Signature Validation Vulnerability Remediation Options: Correct the listed configuration, or leave it when the client accepts the risk Target Machines: AGILITY-AM-, Agility-H7-3261, Agility-H7-3262, Agility-H7-3266, Agility-H7-3267, Agility-H7-3268, Agility-H7-3304, Agility-H7-3306, Agility-R5-0253, Agility-TC-000N, Agility-TC-00CX, Agility-TC-00RZ, Agility-TC-00S3, Agility-TC-00SG, AR-MGMT-RR-04, CUSTSERV1-CBPC, DESKTOP-HLD5C2T, LAPTOP-SHJTQ6VH, Tom Estimated Time of Remediation: 10 hours Remediation Method: Apply the configuration change after confirming impact. Verify the setting after the change. -------------------------------------------------------------------------------------------- Vulnerability: Speculative Store Bypass Remediation Options: Correct the listed configuration, or leave it when the client accepts the risk Target Machines: AR-MGMT-RR-05, Desktop-PF5SCZB, JERRYREIS, LAPTOP-3DN6A1LP, LAPTOP-7OGM15M8, LAPTOP-9SFHJCD5, LAPTOP-F5FORECH, LAPTOP-NLVQBJIB, LAPTOP-NTB3SJ43, LAPTOP-NUV0PMBB, LAPTOP-R8OEN4P4, LAPTOP-RO56NKMM, LAPTOP-UE1T1R2C, moon-dt-2.moonmfg, MOON-DT-3, moon-dt-acct, Moon-Fabrication, MOON-LT-01, vinyl-PC.moonmfg Estimated Time of Remediation: 10 hours Remediation Method: Apply the configuration change after confirming impact. Verify the setting after the change. -------------------------------------------------------------------------------------------- Vulnerability: CVE-2023-48795 Remediation Options: Update to the current version; uninstall if not in use Target Machines: mosaic-al56-static-178 Estimated Time of Remediation: 1 hour Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Speculative Store Bypass Remediation Options: Correct the listed configuration, or leave it when the client accepts the risk Target Machines: 192.168.9.40, AR-CN-MH-01, AR-CN-PROD-01, AR-CN-PROD-02, AR-MGMT-RR-01, BYT14, ChicagoNorth-Fishbowl, DESKTOP-KHOUJ3K, LAPTOP-0PI88JJK, LAPTOP-ACQ4KP50, LAPTOP-LI5TEO9Q, LAPTOP-MDIUJJTB, MCSpare, Pluto1, SATURN, SMS-WKS16, SMS-WKS6, teri-sms Estimated Time of Remediation: 10 hours Remediation Method: Apply the configuration change after confirming impact. Verify the setting after the change. -------------------------------------------------------------------------------------------- Vulnerability: WinVerifyTrust Signature Validation Vulnerability Remediation Options: Correct the listed configuration, or leave it when the client accepts the risk Target Machines: 192.168.9.40, AR-CN-MH-01, AR-CN-PROD-01, AR-CN-PROD-02, AR-MGMT-RR-01, BYT14, DESKTOP-KHOUJ3K, LAPTOP-LI5TEO9Q, LAPTOP-MDIUJJTB, MCSpare, Pluto1, SATURN, SMS-WKS16, SMS-WKS6, teri-sms Estimated Time of Remediation: 10 hours Remediation Method: Apply the configuration change after confirming impact. Verify the setting after the change. -------------------------------------------------------------------------------------------- Vulnerability: WinVerifyTrust Signature Validation Vulnerability Remediation Options: Correct the listed configuration, or leave it when the client accepts the risk Target Machines: 10.10.100.110, 10.10.100.112, Aaron-LPT, AR-MGMT-RR-06, LAPTOP-4BQ0Q6F7, LAPTOP-4IAP1Q3R, LAPTOP-A0MCMC9H, LAPTOP-CT3OBSLV, LAPTOP-H189O8CF, LAPTOP-HG7ATGBA, LAPTOP-N36HPSLT, LAPTOP-NQEJAOFU, OfficeLPT Estimated Time of Remediation: 10 hours Remediation Method: Apply the configuration change after confirming impact. Verify the setting after the change. -------------------------------------------------------------------------------------------- Vulnerability: Python 3.14.5 (64-bit) Remediation Options: Update to version 3.14.7 or later; uninstall if not in use after dependency check Target Machines: LAPTOP-EPL7RODK Estimated Time of Remediation: 0.25 hours Remediation Method: Confirm which applications depend on Python, then update via RMM or ScreenConnect Backstage. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: CVE-2021-28041 Remediation Options: Update to the current version; uninstall if not in use Target Machines: mosaic-al56-static-178 Estimated Time of Remediation: 1 hour Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: CVE-2021-41617 Remediation Options: Update to the current version; uninstall if not in use Target Machines: mosaic-al56-static-178 Estimated Time of Remediation: 1 hour Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft Visual C++ (all versions) Remediation Options: Patch each installed version with the matching vc_redist package; remove a version only if no application uses it Target Machines: 2010: AR-Cicero-10, LAPTOP-UN4OVI86, LAPTOP-JK3JBCVL 2013: AR-Cicero-10 Estimated Time of Remediation: 6 hours Remediation Method: Deploy matching vc_redist packages (aka.ms/vcredist) or Windows Update via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft Visual C++ (all versions) Remediation Options: Patch each installed version with the matching vc_redist package; remove a version only if no application uses it Target Machines: 2012: JoshDesktop 2013: JoshDesktop Estimated Time of Remediation: 6 hours Remediation Method: Deploy matching vc_redist packages (aka.ms/vcredist) or Windows Update via RMM. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Speculative Store Bypass Remediation Options: Correct the listed configuration, or leave it when the client accepts the risk Target Machines: 10.10.100.110, 10.10.100.112, Aaron-LPT, AR-MGMT-RR-06, LAPTOP-4BQ0Q6F7, LAPTOP-4IAP1Q3R, LAPTOP-A0MCMC9H, LAPTOP-CT3OBSLV, LAPTOP-H189O8CF, LAPTOP-HG7ATGBA, LAPTOP-N36HPSLT, LAPTOP-NQEJAOFU, OfficeLPT Estimated Time of Remediation: 10 hours Remediation Method: Apply the configuration change after confirming impact. Verify the setting after the change. -------------------------------------------------------------------------------------------- Vulnerability: Git Remediation Options: Update to version 2.55.0.5 or later; uninstall if not in use Target Machines: Pluto1 Estimated Time of Remediation: 0.25 hours Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: WinVerifyTrust Signature Validation Vulnerability Remediation Options: Correct the listed configuration, or leave it when the client accepts the risk Target Machines: JoshDesktop, LAPTOP-0VDGBMFV, LAPTOP-AFI2HPRP, LAPTOP-QHV00HJC, Work-Laptop Estimated Time of Remediation: 10 hours Remediation Method: Apply the configuration change after confirming impact. Verify the setting after the change. -------------------------------------------------------------------------------------------- Vulnerability: Speculative Store Bypass Remediation Options: Correct the listed configuration, or leave it when the client accepts the risk Target Machines: JoshDesktop, LAPTOP-0VDGBMFV, LAPTOP-AFI2HPRP, LAPTOP-QHV00HJC, Work-Laptop Estimated Time of Remediation: 10 hours Remediation Method: Apply the configuration change after confirming impact. Verify the setting after the change. -------------------------------------------------------------------------------------------- Vulnerability: OpenVPN Connect Remediation Options: Update to version 3.4.4 or later; uninstall if not in use Target Machines: JoshDesktop Estimated Time of Remediation: 0.25 hours Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Adobe Illustrator 2026 Remediation Options: Update to version 30.8 or later; uninstall if not in use Target Machines: JoshDesktop Estimated Time of Remediation: 1 hour Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft SQL Server 2012 Native Client Remediation Options: Update to the current version; uninstall if not in use Target Machines: Agility-TC-00S3, Agility-TC-000N Estimated Time of Remediation: 1 hour Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft SQL Server 2012 Native Client Remediation Options: Update to the current version; uninstall if not in use Target Machines: LAPTOP-NQEJAOFU, 10.10.100.112 Estimated Time of Remediation: 1 hour Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Vulnerability: Microsoft SQL Server 2014 Express LocalDB Remediation Options: Update to the current version; uninstall if not in use Target Machines: LAPTOP-NQEJAOFU, 10.10.100.112 Estimated Time of Remediation: 1 hour Remediation Method: RMM software deployment, ScreenConnect Backstage silent install as fallback. Verify version after update. -------------------------------------------------------------------------------------------- Total Estimated Time: 256.75 hours
Steps performed - Examined lightweight agents - Verified probe setup - Checked agent/probe count compared to other systems - Examined credential mappings - Examined external assets - Checked nmap interface on probe - Verified deprecated item list - Created all reports - Assessed reports - Produced Top Ten vulnerabilities docx report - Ticket #1901480: Vulnerability Remediation - Windows 11 (all versions) (Agility Retail - Boston) - Updates Required - Ticket #1901482: Vulnerability Remediation - Windows 10 (all versions) (Agility Retail - E-Comm Cumberland) - Apply Missing OS Updates (Windows 10 EOL - plan upgrade) - Ticket #1901485: After Hours - Vulnerability Remediation - Windows Server 2012 (all versions) (Agility Retail - E-Comm Cumberland) - End of Support Migration Required - Ticket #1901491: Vulnerability Remediation - Microsoft 365 Apps for business - en-us (Agility Retail - San Diego) - Updates Required - Ticket #1901493: Vulnerability Remediation - Microsoft Teams (Agility Retail - San Diego) - Application Update Required - Ticket #1901494: Vulnerability Remediation - GPL Ghostscript (Agility Retail - Boston) - Update Required - Ticket created: Vulnerability Remediation - FortiClient VPN (Agility Retail - San Diego) - Update Required - Ticket #1901499: Vulnerability Remediation - Microsoft Edge (Agility Retail - Boston) - Updates Required - Ticket created: Vulnerability Remediation - unquoted service path (Agility Retail - San Diego) - Configuration Change Required - Ticket #1901502: Vulnerability Remediation - Microsoft.Microsoft3DViewer (Agility Retail - Chicago North) - Update Required - Ticket created: Vulnerability Remediation - powershellv2 (Agility Retail - E-Comm Cumberland) - Update Required - Sent secure email with reports to contact - Sent TimeZest meeting request Is the task resolved? Yes - completed Next step(s) TimeZest meeting request has been sent. Please select a time to meet if you would like to discuss this further.
Had meeting with Jennifer to discuss this quarter's vulnerability scan results Generated tickets as needed All tasks complete - closing this ticket
jenniferschroeder@dgsretail.com
jenniferschroeder@dgsretail.com
2026 Q4 Vulnerability Scan Follow Up
Good evening Jennifer, Your quarterly vulnerability scan covers these locations. Each location has its own report folder. Reports by location: Agility Retail - Boston Open Agility Retail - Boston report folder Open Agility Retail - Boston Top Ten report Agility Retail - Chicago - Cicero Open Agility Retail - Chicago - Cicero report folder Open Agility Retail - Chicago - Cicero Top Ten report Agility Retail - Chicago North Open Agility Retail - Chicago North report folder Open Agility Retail - Chicago North Top Ten report Agility Retail - Corporate Headquarters Open Agility Retail - Corporate Headquarters report folder Open Agility Retail - Corporate Headquarters Top Ten report Agility Retail - E-Comm Cumberland Open Agility Retail - E-Comm Cumberland report folder Open Agility Retail - E-Comm Cumberland Top Ten report Agility Retail - Los Angeles Open Agility Retail - Los Angeles report folder Agility Retail - Milwaukee Open Agility Retail - Milwaukee report folder Open Agility Retail - Milwaukee Top Ten report Agility Retail - Minneapolis Open Agility Retail - Minneapolis report folder Open Agility Retail - Minneapolis Top Ten report Agility Retail - San Diego Open Agility Retail - San Diego report folder Open Agility Retail - San Diego Top Ten report Each location folder contains: • Pending Remediation EPSS Score Report - classifies vulnerabilities by Exploit Prediction Scoring System (EPSS), which measures the likelihood of exploitation within 30 days (scale 0-1.0, with 1.0 being most critical). • All Vulnerabilities Report - agent-detected vulnerabilities on managed assets (applications, OS patches, and related findings), from critical to low severity. • Executive Summary Report - a high-level overview of your security posture and network information. • External Scan - detected vulnerabilities and services exposed to the internet. • Suppressed Vulnerabilities Report - vulnerabilities that have been suppressed (e.g., false positives or accepted risk) and will not appear on future remediation lists. Not all vulnerabilities may be feasible to remediate depending on business or technical constraints. Schedule Time With Me Note: Remediation tickets have been generated for items covered under your RMIT+ agreement. Third-party items not covered under the agreement will not be remediated unless we discuss them and a quote has been generated. To schedule a discussion, please use the scheduling link above. We appreciate your commitment to security. Addressing these vulnerabilities is essential for maintaining the protection of your systems. Sincerely, Chris Knospe
2026 Q4 Remaining remediations
Good evening Jennifer,
Following the quarterly vulnerability review for Agility Retail, the items below still need remediation. These are typically third-party products or other remaining work that was not included in ticketed first-party remediations.
1. Microsoft .NET (all versions)
Affected hosts: AgilityRetailHZ - 192.168.10.112 [9.0.10], AgilityRetailHZ - 192.168.10.112 [8.0.21], AgilityRetailHZ - 192.168.10.112, AgilityRetailHZ - 192.168.10.112 [3.1.15], AgilityRetailHZ - 192.168.10.112 [10.0.26200], FrontOfficeFl - 192.168.10.107 [6.0.25], FrontOfficeFl - 192.168.10.107 [6.0.33], AgilityRetailHZ - 192.168.10.112 [6.0.36], PRINTMASTERPC - 192.168.10.137 [6.0.36], Mona1 - 192.168.10.147 [6.0.36], DESKTOP-A0L35K5 - 192.168.10.56 [6.0.36], 28CFWM3 - 192.168.10.75 [6.0.36], 192.168.10.84 [6.0.36], ENGENEERING-4 - 192.168.10.95 [6.0.36], HESNA-PC - 192.168.1.59 [6.0.36], Carlosg-Home - 192.168.0.7 [6.0.36], ENGINEERING-3 - 192.168.10.111 [6.0.36], DESKTOP-97QU41M - 192.168.10.113 [6.0.36], DESKTOP-JC0LEGB - 192.168.10.117 [6.0.36], Mona1 - 192.168.10.147 [5.0.17], DESKTOP-A0L35K5 - 192.168.10.56 [5.0.17], 28CFWM3 - 192.168.10.75 [5.0.17], 192.168.10.84 [5.0.17], ENGENEERING-4 - 192.168.10.95 [7.0.20], HESNA-PC - 192.168.1.59 [7.0.20], DESKTOP-97QU41M - 192.168.10.113 [7.0.20], DESKTOP-97QU41M - 192.168.10.113, PRINTMASTERPC - 192.168.10.137 [10.0.9]
What to do: Update Microsoft .NET (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
2. Adobe Creative Suite 6 Design Standard
Affected hosts: Moon-Fabrication - 10.0.0.50
What to do: Update Adobe Creative Suite 6 Design Standard to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
3. Microsoft .NET (all versions)
Affected hosts: L-LEN-PF5V3QDM - 192.168.1.109 [6.0.3], L-Len-PF5AY1LH - 192.168.2.18 [6.0.29], L-Len-PF5AY1ES - 192.168.2.24 [6.0.29], L-LEN-PF5V3QDM - 192.168.1.109, LAPTOP-E5A1CAJI - 10.10.12.128 [6.0.29], LAPTOP-E5A1CAJI - 10.10.12.128 [6.0.36]
What to do: Update Microsoft .NET (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
4. Adobe Acrobat Reader DC MUI
Affected hosts: vinyl-PC.moonmfg - 10.0.0.30
What to do: Update Adobe Acrobat Reader DC MUI to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
5. Adobe Acrobat X Standard - English, Français, Deutsch
Affected hosts: DESKTOP-PJRUCQG - 10.0.0.82
What to do: Update Adobe Acrobat X Standard - English, Français, Deutsch to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
6. Adobe Acrobat X Pro - English, Français, Deutsch
Affected hosts: Moon-Fabrication - 10.0.0.50
What to do: Update Adobe Acrobat X Pro - English, Français, Deutsch to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
7. Microsoft .NET (all versions)
Affected hosts: RebeccaByron - 192.168.12.136 [6.0.9], DESKTOP-M8ICQCG - 10.0.0.127 [5.0.17], DESKTOP-ULFPN40 - 192.168.0.159 [5.0.17], DELL-DGS43-MK.cormarkinc - 192.168.4.81 [5.0.17], DESKTOP-M8ICQCG - 10.0.0.127 [6.0.36], SherylMendoza - 10.0.0.170 [6.0.36], M-Bartczak - 10.0.0.195 [6.0.36], FarrahBradley - 10.0.0.204 [6.0.36], TiffanyBlack - 10.0.0.61 [6.0.36], win-eael5m09bfk - 10.0.0.65 [6.0.36], DESKTOP-ULFPN40 - 192.168.0.159 [6.0.36], EwaMankowski - 192.168.1.66 [6.0.36], DELL-DGS43-MK.cormarkinc - 192.168.4.81 [6.0.36], DESKTOP-CENHO7S - 192.168.52.52 [6.0.36], DESKTOP-LTES1BM - 192.168.68.51 [6.0.36], EwaMankowski - 192.168.1.66 [7.0.20], EwaMankowski - 192.168.1.66
What to do: Update Microsoft .NET (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
8. Microsoft .NET (all versions)
Affected hosts: DESKTOP-RBJIB4E - 192.168.4.157 [8.0.24], DESKTOP-LJANK6I - 192.168.2.76 [3.1.10], DESKTOP-RBJIB4E - 192.168.4.157 [10.0.26200], DESKTOP-RBJIB4E - 192.168.4.157 [10.0.11], DESKTOP-RBJIB4E - 192.168.4.157 [6.0.36]
What to do: Update Microsoft .NET (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
9. Foxit PDF Editor
Affected hosts: AleshireEng - 192.168.1.101, JordanEngineer - 192.168.1.103
What to do: Update Foxit PDF Editor to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
10. Microsoft Visual C++ (all versions)
Affected hosts: 10.10.100.110 [11.0.61030], LAPTOP-CT3OBSLV - 10.10.100.107 [11.0.61030], LAPTOP-NQEJAOFU - 10.10.100.108 [12.0.21005], LAPTOP-4BQ0Q6F7 - 10.10.100.109 [12.0.21005], 10.10.100.110 [12.0.21005], LAPTOP-N36HPSLT - 10.10.100.119 [12.0.21005], OfficeLPT - 10.10.100.121 [12.0.21005], LAPTOP-H189O8CF - 10.10.100.123 [12.0.21005], Aaron-LPT - 192.168.0.227 [12.0.21005], LAPTOP-A0MCMC9H - 10.10.100.101 [12.0.21005], LAPTOP-4IAP1Q3R - 10.10.100.105 [12.0.21005], LAPTOP-HG7ATGBA - 10.10.100.106 [12.0.21005], LAPTOP-NQEJAOFU - 10.10.100.108 [12.0.30501], LAPTOP-4BQ0Q6F7 - 10.10.100.109 [12.0.30501], 10.10.100.110 [12.0.30501], LAPTOP-N36HPSLT - 10.10.100.119 [12.0.30501], OfficeLPT - 10.10.100.121 [12.0.30501], LAPTOP-H189O8CF - 10.10.100.123 [12.0.30501], Aaron-LPT - 192.168.0.227 [12.0.30501], LAPTOP-A0MCMC9H - 10.10.100.101 [12.0.30501], LAPTOP-4IAP1Q3R - 10.10.100.105 [12.0.30501], LAPTOP-HG7ATGBA - 10.10.100.106 [12.0.30501], 10.10.100.110 [9.0.30729.6161], 10.10.100.110 [10.0.40219], LAPTOP-CT3OBSLV - 10.10.100.107 [10.0.40219], Aaron-LPT - 192.168.0.227 [10.0.30319], 10.10.100.110
What to do: Update Microsoft Visual C++ (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
11. Microsoft .NET (all versions)
Affected hosts: LAPTOP-NQEJAOFU - 10.10.100.108 [8.0.29], LAPTOP-NQEJAOFU - 10.10.100.108, OfficeLPT - 10.10.100.121 [6.0.36], Aaron-LPT - 192.168.0.227 [6.0.36]
What to do: Update Microsoft .NET (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
12. Microsoft Visual C++ (all versions)
Affected hosts: PRINTMASTERPC - 192.168.10.137 [12.0.40664], Mona1 - 192.168.10.147 [12.0.40664], DESKTOP-ITMA3VO - 192.168.10.50 [12.0.40664], DESKTOP-A0L35K5 - 192.168.10.56 [12.0.40664], DESKTOP-L07U07V - 192.168.10.64 [12.0.40664], 28CFWM3 - 192.168.10.75 [12.0.40664], 192.168.10.84 [12.0.40664], ENGENEERING-4 - 192.168.10.95 [12.0.40664], HESNA-PC - 192.168.1.59 [12.0.40664], Carlosg-Home - 192.168.0.7 [12.0.40664], DESKTOP-N9IPL96 - 192.168.10.72 [12.0.40664], ENGENEERING-4 - 192.168.10.95 [11.0.61030], ENGINEERING-3 - 192.168.10.111 [11.0.61030], DESKTOP-A0L35K5 - 192.168.10.56 [12.0.30501], 28CFWM3 - 192.168.10.75 [12.0.30501], ENGINEERING-3 - 192.168.10.111 [10.0.40219], AgilityRetailHZ - 192.168.10.112 [12.0.21005], DESKTOP-97QU41M - 192.168.10.113 [12.0.21005], Mona1 - 192.168.10.147 [9.0.30729.6161], DESKTOP-A0L35K5 - 192.168.10.56 [9.0.30729.6161], 28CFWM3 - 192.168.10.75 [9.0.30729.6161], 192.168.10.84 [9.0.30729.6161], ENGINEERING-3 - 192.168.10.111 [9.0.30729.6161], DESKTOP-A0L35K5 - 192.168.10.56 [12.0.21005], AgilityRetailHZ - 192.168.10.112 [12.0.30501], DESKTOP-97QU41M - 192.168.10.113 [12.0.30501], ENGINEERING-3 - 192.168.10.111 [9.0.30729.17]
What to do: Update Microsoft Visual C++ (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
13. Microsoft Visual C++ (all versions)
Affected hosts: LAPTOP-0PI88JJK - 192.168.60.116 [11.0.61030], SATURN - 192.168.9.37 [11.0.61030], SMS-WKS6 - 192.168.99.158 [11.0.61030], LAPTOP-0PI88JJK - 192.168.60.116 [12.0.40664], SATURN - 192.168.9.37 [12.0.40664], 192.168.9.40 [12.0.40664], SMS-WKS6 - 192.168.99.158 [12.0.40664], ChicagoNorth-Fishbowl - 10.10.4.11 [12.0.21005], LAPTOP-0PI88JJK - 192.168.60.116 [9.0.30729.6161], LAPTOP-0PI88JJK - 192.168.60.116 [10.0.40219], Pluto1 - 192.168.9.36 [10.0.40219], SATURN - 192.168.9.37 [10.0.40219], SMS-WKS6 - 192.168.99.158 [10.0.40219], LAPTOP-0PI88JJK - 192.168.60.116 [12.0.30501], ChicagoNorth-Fishbowl - 10.10.4.11 [12.0.30501], LAPTOP-LI5TEO9Q - 192.168.9.52 [10.0.30319], BYT14 - 172.20.10.2 [10.0.30319], LAPTOP-0PI88JJK - 192.168.60.116 [9.0.30729.17], ChicagoNorth-Fishbowl - 10.10.4.11 [9.0.30729.17], LAPTOP-LI5TEO9Q - 192.168.9.52 [9.0.30729.6161], ChicagoNorth-Fishbowl - 10.10.4.11 [9.0.30729.6161], SATURN - 192.168.9.37 [12.0.30501], SATURN - 192.168.9.37 [11.0.60610], LAPTOP-LI5TEO9Q - 192.168.9.52, LAPTOP-LI5TEO9Q - 192.168.9.52 [9.0.21022]
What to do: Update Microsoft Visual C++ (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
14. Microsoft Visual C++ (all versions)
Affected hosts: DESKTOP-GUKI3V9 - 192.168.4.133 [12.0.40664], LAPTOP-PI88L0PE - 192.168.1.107 [12.0.21005], Agility-H7-3306 - 10.0.1.63 [12.0.40664], Agility-H7-3262 - 10.0.1.78 [12.0.40664], Agility-H7-3268 - 10.0.1.95 [12.0.40664], Agility-R5-0253 - 10.0.1.74 [11.0.61030], CUSTSERV2-DSPC - 10.0.1.82 [11.0.61030], CUSTSERV3-SLPC - 10.0.1.88 [11.0.61030], CUSTSERV2-DSPC - 10.0.1.82 [11.0.51106], CUSTSERV3-SLPC - 10.0.1.88 [11.0.51106], Agility-H7-3261 - 10.0.1.93 [12.0.40664], LAPTOP-D7HGG20H - 10.0.0.34 [10.0.40219], Agility-R5-0253 - 10.0.1.74 [10.0.40219], LAPTOP-PI88L0PE - 192.168.1.107 [10.0.40219], Agility-TC-000N - 10.0.1.81 [10.0.30319], Agility-H7-3306 - 10.0.1.63 [10.0.40219], Agility-H7-3267 - 10.0.1.65 [10.0.40219], Agility-H7-3262 - 10.0.1.78 [10.0.40219], Agility-H7-3268 - 10.0.1.95 [10.0.40219], CUSTSERV2-DSPC - 10.0.1.82 [10.0.40219], CUSTSERV3-SLPC - 10.0.1.88 [10.0.40219], Agility-H7-3261 - 10.0.1.93 [10.0.40219], Agility-H7-3306 - 10.0.1.63, Agility-H7-3262 - 10.0.1.78, Agility-H7-3268 - 10.0.1.95, Agility-H7-3306 - 10.0.1.63 [9.0.30729.17], Agility-H7-3262 - 10.0.1.78 [9.0.30729.17], Agility-H7-3261 - 10.0.1.93 [9.0.30729.17], Agility-H7-3268 - 10.0.1.95 [9.0.30729.17], Agility-H7-3306 - 10.0.1.63 [9.0.30729.6161], Agility-H7-3262 - 10.0.1.78 [9.0.30729.6161], Agility-H7-3261 - 10.0.1.93 [9.0.30729.6161], Agility-H7-3268 - 10.0.1.95 [9.0.30729.6161], Agility-H7-3261 - 10.0.1.93, DESKTOP-GUKI3V9 - 192.168.4.133 [9.0.30729.4148], DESKTOP-GUKI3V9 - 192.168.4.133 [9.0.30729.6161]
What to do: Update Microsoft Visual C++ (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
15. Foxit PDF Editor
Affected hosts: DESKTOP-JC0LEGB - 192.168.10.117
What to do: Update Foxit PDF Editor to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
16. Google Chrome
Affected hosts: 192.168.9.40, BYT14 - 172.20.10.2, LAPTOP-0PI88JJK - 192.168.60.116, Pluto1 - 192.168.9.36
What to do: Update Google Chrome to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
17. Microsoft .NET (all versions)
Affected hosts: LAPTOP-0VDGBMFV - 192.168.0.122 [8.0.30], JoshDesktop - 192.168.2.54 [8.0.30], JoshDesktop - 192.168.2.54 [10.0.11], JoshDesktop - 192.168.2.54 [9.0.19], LAPTOP-0VDGBMFV - 192.168.0.122 [10.0.26100], JoshDesktop - 192.168.2.54 [10.0.26100], JoshDesktop - 192.168.2.54 [5.0.17], JoshDesktop - 192.168.2.54 [6.0.36]
What to do: Update Microsoft .NET (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
18. Microsoft .NET (all versions)
Affected hosts: DESKTOP-E32TV1A - 192.168.52.27 [8.0.29], DESKTOP-E32TV1A - 192.168.52.27 [10.0.26100], DESKTOP-E32TV1A - 192.168.52.27 [5.0.17], DESKTOP-E32TV1A - 192.168.52.27 [6.0.36], AGILITY-AM- - 10.0.1.72 [6.0.36]
What to do: Update Microsoft .NET (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
19. Microsoft Visual C++ (all versions)
Affected hosts: LAPTOP-9SFHJCD5 - 10.0.0.25 [12.0.40664], LAPTOP-NUV0PMBB - 10.0.0.21 [12.0.21005], LAPTOP-NTB3SJ43 - 10.99.0.12 [12.0.21005], LAPTOP-F5FORECH - 10.0.0.15 [12.0.40664], LAPTOP-UE1T1R2C - 10.99.0.5 [12.0.40664], LAPTOP-9SFHJCD5 - 10.0.0.25, Moon-Fabrication - 10.0.0.50, MOON-LT-01 - 10.99.0.8, LAPTOP-NUV0PMBB - 10.0.0.21 [10.0.40219], LAPTOP-9SFHJCD5 - 10.0.0.25 [10.0.40219], vinyl-PC.moonmfg - 10.0.0.30 [10.0.40219], Moon-Fabrication - 10.0.0.50 [10.0.40219], LAPTOP-NTB3SJ43 - 10.99.0.12 [10.0.40219], MOON-LT-01 - 10.99.0.8 [10.0.30319], Moon-Fabrication - 10.0.0.50 [9.0.30729.4148], Moon-Fabrication - 10.0.0.50 [9.0.30729.6161], LAPTOP-F5FORECH - 10.0.0.15, LAPTOP-UE1T1R2C - 10.99.0.5, LAPTOP-F5FORECH - 10.0.0.15 [10.0.40219], moon-dt-acct - 10.0.0.22 [10.0.40219], LAPTOP-UE1T1R2C - 10.99.0.5 [10.0.40219], moon-dt-acct - 10.0.0.22 [10.0.30319], LAPTOP-R8OEN4P4 - 10.0.0.44 [10.0.30319], LAPTOP-RO56NKMM - 10.0.0.45 [10.0.30319]
What to do: Update Microsoft Visual C++ (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
20. Adobe Illustrator 2026
Affected hosts: ENGENEERING-4 - 192.168.10.95, DESKTOP-CPM25O2 - 10.0.0.26, L-LEN-PF5YMR5J - 10.229.214.25, AgilityRetailHZ - 192.168.10.112
What to do: Update Adobe Illustrator 2026 to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
21. Adobe Illustrator 2025
Affected hosts: Carlosg-Home - 192.168.0.7, ENGENEERING-4 - 192.168.10.95
What to do: Update Adobe Illustrator 2025 to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
22. Microsoft .NET (all versions)
Affected hosts: MOON-DT-3 - 10.0.0.20 [5.0.17], moon-dt-acct - 10.0.0.22 [5.0.17], MOON-LT-01 - 10.99.0.8 [5.0.17], MOON-DT-3 - 10.0.0.20 [6.0.36], moon-dt-acct - 10.0.0.22 [6.0.36], MOON-LT-01 - 10.99.0.8 [6.0.36], JERRYREIS - 10.0.0.29 [6.0.36]
What to do: Update Microsoft .NET (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
23. Microsoft Visual C++ (all versions)
Affected hosts: DESKTOP-RREJ582 - 192.168.0.15 [11.0.61030], DESKTOP-LTES1BM - 192.168.68.51 [11.0.61030], DESKTOP-RREJ582 - 192.168.0.15 [12.0.40664], DESKTOP-LTES1BM - 192.168.68.51 [12.0.40664], AnnaPisanskiDGS - 10.0.0.11 [11.0.61030], AnnaPisanskiDGS - 10.0.0.11 [11.0.50522], DESKTOP-CENHO7S - 192.168.52.52 [10.0.30319]
What to do: Update Microsoft Visual C++ (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
24. Adobe InDesign 2024
Affected hosts: PRINTMASTERPC - 192.168.10.137
What to do: Update Adobe InDesign 2024 to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
25. Python 3.13.5 (64-bit)
Affected hosts: JoshDesktop - 192.168.2.54
What to do: Update Python 3.13.5 (64-bit) to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
26. Python 3.13.5 Executables (64-bit)
Affected hosts: JoshDesktop - 192.168.2.54
What to do: Update Python 3.13.5 Executables (64-bit) to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
27. Adobe Illustrator 2024
Affected hosts: PRINTMASTERPC - 192.168.10.137
What to do: Update Adobe Illustrator 2024 to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
28. Foxit PDF Editor
Affected hosts: Desktop-PF5SCZB - 10.0.0.16
What to do: Update Foxit PDF Editor to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
29. Speculative Store Bypass
Affected hosts: AGILITY-AM- - 10.0.1.72, Agility-H7-3261 - 10.0.1.93, Agility-H7-3262 - 10.0.1.78, Agility-H7-3266 - 10.0.1.90, Agility-H7-3267 - 10.0.1.65, Agility-H7-3268 - 10.0.1.95, Agility-H7-3304 - 10.0.1.84, Agility-H7-3306 - 10.0.1.63, Agility-R5-0253 - 10.0.1.74, Agility-TC-000N - 10.0.1.81, Agility-TC-00CX - 10.0.1.60, Agility-TC-00RZ - 10.0.1.77, Agility-TC-00S3 - 10.0.1.75, Agility-TC-00SG - 10.0.1.87, Agility-TC-00SJ - 10.0.1.85, ARG-MSP-Admin - 10.10.4.10, AR-MGMT-RR-04 - 10.0.1.76, CUSTSERV1-CBPC - 10.0.1.62, CUSTSERV2-DSPC - 10.0.1.82, CUSTSERV3-SLPC - 10.0.1.88, DESKTOP-E32TV1A - 192.168.52.27, DESKTOP-GUKI3V9 - 192.168.4.133, DESKTOP-HLD5C2T - 10.0.5.4, LAPTOP-2TN7SKFJ - 192.168.2.10, LAPTOP-4GNJ03P4 - 192.168.1.175, LAPTOP-768965L7 - 192.168.1.71, LAPTOP-8HSVAPMI - 10.0.1.54, LAPTOP-D7HGG20H - 10.0.0.34, LAPTOP-LU45RTS5 - 10.99.0.9, LAPTOP-PI88L0PE - 192.168.1.107, LAPTOP-QAQ1LMU0 - 192.168.0.107, LAPTOP-SHJTQ6VH - 10.0.0.112, Tom - 192.168.1.121
What to do: Apply missing OS updates for Speculative Store Bypass to the minimum version to reach (or the latest available), decommission the host if it is not needed, or suppress / accept residual risk when patching is not possible (client must be notified or accept; risk remains until a real fix).
30. Mozilla Firefox
Affected hosts: AleshireEng - 192.168.1.101, JordanEngineer - 192.168.1.103
What to do: Update Mozilla Firefox to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
31. Speculative Store Bypass
Affected hosts: 10.10.12.13, AleshireEng - 192.168.1.101, AndyZauftLenovo - 10.10.12.5, AR-MGMT-RR-09 - 192.168.1.9, InfinityIT - 192.168.2.28, JordanEngineer - 192.168.1.103, Kiosk-01251 - 10.10.12.123, Kiosk-60946 - 10.10.12.136, KnufThinkBook - 10.10.12.23, LAPTOP-191H8K8O - 192.168.2.12, LAPTOP-594KP8JU - 10.10.12.6, LAPTOP-77G99LOQ - 10.10.12.130, LAPTOP-98P2V02G - 192.168.2.8, LAPTOP-AEVF2R0P - 192.168.2.29, LAPTOP-BP6PC05F - 10.10.12.31, LAPTOP-E5A1CAJI - 10.10.12.128, LAPTOP-MEC30P6A - 10.10.12.15, L-Len-21FE00-- - 192.168.2.19, L-Len-21FV002-- - 192.168.2.22, L-Len-PF466A5E - 192.168.2.23, L-Len-PF5AY1ES - 192.168.2.24, L-Len-PF5AY1LH - 192.168.2.18, L-Len-PF5RJVJT - 192.168.2.9, L-Len-PF5RLK1E - 192.168.2.3, L-LEN-PF5V3QDM - 192.168.1.109, L-LEN-PF5Z83HP - 192.168.2.25, RyanSaverine - 192.168.2.2, Shared-49339 - 192.168.1.19, Shared-53052 - 10.10.12.34, Shared-57887 - 192.168.2.6, Shared-76323 - 192.168.1.21
What to do: Apply missing OS updates for Speculative Store Bypass to the minimum version to reach (or the latest available), decommission the host if it is not needed, or suppress / accept residual risk when patching is not possible (client must be notified or accept; risk remains until a real fix).
32. CVE-2023-38408
Affected hosts: mosaic-al56-static-178 - 173.248.56.178
What to do: Identify the vulnerable component for CVE-2023-38408 on each listed host first, then update to the minimum version to reach ({VersionTargetSuffix}), uninstall if unused, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
33. WinVerifyTrust Signature Validation Vulnerability
Affected hosts: AR-Cicero-01 - 192.168.2.53, AR-Cicero-02 - 192.168.2.68, AR-Cicero-03 - 192.168.2.51, AR-Cicero-04 - 192.168.2.90, AR-Cicero-05 - 192.168.2.72, AR-Cicero-06 - 192.168.72.37, AR-Cicero-07 - 192.168.2.87, AR-Cicero-08 - 192.168.2.67, AR-Cicero-09 - 192.168.2.84, ARG - 192.168.1.113, AR-MGMT-RR-03 - 192.168.2.85, BrianP - 192.168.60.117, DESKTOP-0G11K9F - 192.168.2.55, DESKTOP-5M62Q7P - 192.168.2.88, DESKTOP-A17DOU5 - 192.168.2.80, DESKTOP-DR40DIH - 192.168.2.59, DESKTOP-IG37GOT - 192.168.2.81, DESKTOP-JBKUHND - 192.168.1.70, DESKTOP-LJANK6I - 192.168.2.76, DESKTOP-OBI4EA8 - 192.168.2.63, DESKTOP-RBJIB4E - 192.168.4.157, DGSRAFA - 192.168.72.27, LAPTOP-1ON9DL5T - 192.168.2.52, LAPTOP-67TGIKRE - 10.0.0.168, LAPTOP-AMEDNSI7 - 192.168.4.22, LAPTOP-EPL7RODK - 10.14.101.121, LAPTOP-JK3JBCVL - 192.168.72.19, LAPTOP-UN4OVI86 - 192.168.4.159
What to do: Correct the listed configuration for WinVerifyTrust Signature Validation Vulnerability, or suppress / accept residual risk when the client will not change it (client must be notified or accept; risk remains until a real fix).
34. WinVerifyTrust Signature Validation Vulnerability
Affected hosts: 10.10.12.13, AleshireEng - 192.168.1.101, AndyZauftLenovo - 10.10.12.5, AR-MGMT-RR-09 - 192.168.1.9, InfinityIT - 192.168.2.28, JordanEngineer - 192.168.1.103, KnufThinkBook - 10.10.12.23, LAPTOP-191H8K8O - 192.168.2.12, LAPTOP-594KP8JU - 10.10.12.6, LAPTOP-77G99LOQ - 10.10.12.130, LAPTOP-98P2V02G - 192.168.2.8, LAPTOP-AEVF2R0P - 192.168.2.29, LAPTOP-BP6PC05F - 10.10.12.31, LAPTOP-E5A1CAJI - 10.10.12.128, LAPTOP-MEC30P6A - 10.10.12.15, L-Len-21FE00-- - 192.168.2.19, L-Len-21FV002-- - 192.168.2.22, L-Len-PF466A5E - 192.168.2.23, L-Len-PF5AY1ES - 192.168.2.24, L-Len-PF5AY1LH - 192.168.2.18, L-Len-PF5RJVJT - 192.168.2.9, L-Len-PF5RLK1E - 192.168.2.3, L-LEN-PF5V3QDM - 192.168.1.109, L-LEN-PF5Z83HP - 192.168.2.25, Shared-49339 - 192.168.1.19, Shared-53052 - 10.10.12.34, Shared-57887 - 192.168.2.6, Shared-76323 - 192.168.1.21
What to do: Correct the listed configuration for WinVerifyTrust Signature Validation Vulnerability, or suppress / accept residual risk when the client will not change it (client must be notified or accept; risk remains until a real fix).
35. Speculative Store Bypass
Affected hosts: AR-Cicero-01 - 192.168.2.53, AR-Cicero-02 - 192.168.2.68, AR-Cicero-03 - 192.168.2.51, AR-Cicero-04 - 192.168.2.90, AR-Cicero-05 - 192.168.2.72, AR-Cicero-06 - 192.168.72.37, AR-Cicero-07 - 192.168.2.87, AR-Cicero-08 - 192.168.2.67, AR-Cicero-09 - 192.168.2.84, AR-Cicero-10 - 192.168.2.61, ARG - 192.168.1.113, AR-MGMT-RR-03 - 192.168.2.85, BrianP - 192.168.60.117, DESKTOP-0G11K9F - 192.168.2.55, DESKTOP-5M62Q7P - 192.168.2.88, DESKTOP-A17DOU5 - 192.168.2.80, DESKTOP-DR40DIH - 192.168.2.59, DESKTOP-IG37GOT - 192.168.2.81, DESKTOP-JBKUHND - 192.168.1.70, DESKTOP-JV036S2 - 192.168.4.151, DESKTOP-LJANK6I - 192.168.2.76, DESKTOP-OBI4EA8 - 192.168.2.63, DESKTOP-RBJIB4E - 192.168.4.157, DGSRAFA - 192.168.72.27, LAPTOP-1ON9DL5T - 192.168.2.52, LAPTOP-67TGIKRE - 10.0.0.168, LAPTOP-AMEDNSI7 - 192.168.4.22, LAPTOP-EPL7RODK - 10.14.101.121, LAPTOP-JK3JBCVL - 192.168.72.19, LAPTOP-UN4OVI86 - 192.168.4.159
What to do: Apply missing OS updates for Speculative Store Bypass to the minimum version to reach (or the latest available), decommission the host if it is not needed, or suppress / accept residual risk when patching is not possible (client must be notified or accept; risk remains until a real fix).
36. Python 3.14.5 Executables (64-bit)
Affected hosts: LAPTOP-67TGIKRE - 10.0.0.168, LAPTOP-EPL7RODK - 10.14.101.121
What to do: Update Python 3.14.5 Executables (64-bit) to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
37. Microsoft Visual C++ (all versions)
Affected hosts: L-Len-PF466A5E - 192.168.2.23 [11.0.61030], L-Len-PF466A5E - 192.168.2.23 [12.0.40664], AleshireEng - 192.168.1.101 [11.0.61030], L-Len-PF466A5E - 192.168.2.23 [10.0.40219], AleshireEng - 192.168.1.101 [10.0.40219], L-LEN-PF5V3QDM - 192.168.1.109 [9.0.30729.17], L-LEN-PF5V3QDM - 192.168.1.109 [9.0.30729.6161], RyanSaverine - 192.168.2.2 [10.0.40219], L-Len-PF466A5E - 192.168.2.23 [9.0.30729.17], L-Len-PF466A5E - 192.168.2.23 [9.0.30729.6161]
What to do: Update Microsoft Visual C++ (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
38. WinVerifyTrust Signature Validation Vulnerability
Affected hosts: alma - 192.168.1.169, AnnaPisanskiDGS - 10.0.0.11, AR-MGMT-RR-02 - 192.168.0.41, DELL-DGS43-MK.cormarkinc - 192.168.4.81, DESKTOP-3N4U9QE - 10.0.0.69, DESKTOP-CENHO7S - 192.168.52.52, DESKTOP-LTES1BM - 192.168.68.51, DESKTOP-M8ICQCG - 10.0.0.127, DESKTOP-PJRUCQG - 10.0.0.82, DESKTOP-RREJ582 - 192.168.0.15, DESKTOP-ULFPN40 - 192.168.0.159, ERIKALUSTER - 10.0.0.62, FarrahBradley - 10.0.0.204, GABRIELLAGARCIA - 10.0.0.98, LAPTOP-PF5SCZGS - 192.168.50.162, LAPTOP-PF5SGD86 - 192.168.82.2, M-Bartczak - 10.0.0.195, MELISSAFIORITA - 192.168.1.55, MICHAELKEATING - 192.168.0.39, RebeccaByron - 192.168.12.136, SherylMendoza - 10.0.0.170, TiffanyBlack - 10.0.0.61, win-eael5m09bfk - 10.0.0.65
What to do: Correct the listed configuration for WinVerifyTrust Signature Validation Vulnerability, or suppress / accept residual risk when the client will not change it (client must be notified or accept; risk remains until a real fix).
39. Mozilla Firefox
Affected hosts: DESKTOP-RREJ582 - 192.168.0.15
What to do: Update Mozilla Firefox to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
40. Microsoft .NET (all versions)
Affected hosts: LAPTOP-MDIUJJTB - 192.168.60.122 [8.0.30], LAPTOP-MDIUJJTB - 192.168.60.122 [10.0.26200], teri-sms - 192.168.68.69 [6.0.36]
What to do: Update Microsoft .NET (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
41. WinVerifyTrust Signature Validation Vulnerability
Affected hosts: AGILITY-AM- - 10.0.1.72, Agility-H7-3261 - 10.0.1.93, Agility-H7-3262 - 10.0.1.78, Agility-H7-3266 - 10.0.1.90, Agility-H7-3267 - 10.0.1.65, Agility-H7-3268 - 10.0.1.95, Agility-H7-3304 - 10.0.1.84, Agility-H7-3306 - 10.0.1.63, Agility-R5-0253 - 10.0.1.74, Agility-TC-000N - 10.0.1.81, Agility-TC-00CX - 10.0.1.60, Agility-TC-00RZ - 10.0.1.77, Agility-TC-00S3 - 10.0.1.75, Agility-TC-00SG - 10.0.1.87, AR-MGMT-RR-04 - 10.0.1.76, CUSTSERV1-CBPC - 10.0.1.62, DESKTOP-HLD5C2T - 10.0.5.4, LAPTOP-SHJTQ6VH - 10.0.0.112, Tom - 192.168.1.121
What to do: Correct the listed configuration for WinVerifyTrust Signature Validation Vulnerability, or suppress / accept residual risk when the client will not change it (client must be notified or accept; risk remains until a real fix).
42. Speculative Store Bypass
Affected hosts: AR-MGMT-RR-05 - 10.0.0.33, Desktop-PF5SCZB - 10.0.0.16, JERRYREIS - 10.0.0.29, LAPTOP-3DN6A1LP - 10.0.0.48, LAPTOP-7OGM15M8 - 10.0.0.19, LAPTOP-9SFHJCD5 - 10.0.0.25, LAPTOP-F5FORECH - 10.0.0.15, LAPTOP-NLVQBJIB - 192.168.1.228, LAPTOP-NTB3SJ43 - 10.99.0.12, LAPTOP-NUV0PMBB - 10.0.0.21, LAPTOP-R8OEN4P4 - 10.0.0.44, LAPTOP-RO56NKMM - 10.0.0.45, LAPTOP-UE1T1R2C - 10.99.0.5, moon-dt-2.moonmfg - 10.0.0.24, MOON-DT-3 - 10.0.0.20, moon-dt-acct - 10.0.0.22, Moon-Fabrication - 10.0.0.50, MOON-LT-01 - 10.99.0.8, vinyl-PC.moonmfg - 10.0.0.30
What to do: Apply missing OS updates for Speculative Store Bypass to the minimum version to reach (or the latest available), decommission the host if it is not needed, or suppress / accept residual risk when patching is not possible (client must be notified or accept; risk remains until a real fix).
43. CVE-2023-48795
Affected hosts: mosaic-al56-static-178 - 173.248.56.178
What to do: Identify the vulnerable component for CVE-2023-48795 on each listed host first, then update to the minimum version to reach ({VersionTargetSuffix}), uninstall if unused, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
44. Speculative Store Bypass
Affected hosts: 192.168.9.40, AR-CN-MH-01 - 192.168.60.105, AR-CN-PROD-01 - 192.168.60.113, AR-CN-PROD-02 - 192.168.60.103, AR-MGMT-RR-01 - 192.168.9.10, BYT14 - 172.20.10.2, ChicagoNorth-Fishbowl - 10.10.4.11, DESKTOP-KHOUJ3K - 172.20.1.181, LAPTOP-0PI88JJK - 192.168.60.116, LAPTOP-ACQ4KP50 - 10.0.0.14, LAPTOP-LI5TEO9Q - 192.168.9.52, LAPTOP-MDIUJJTB - 192.168.60.122, MCSpare - 10.0.0.227, Pluto1 - 192.168.9.36, SATURN - 192.168.9.37, SMS-WKS16 - 192.168.60.110, SMS-WKS6 - 192.168.99.158, teri-sms - 192.168.68.69
What to do: Apply missing OS updates for Speculative Store Bypass to the minimum version to reach (or the latest available), decommission the host if it is not needed, or suppress / accept residual risk when patching is not possible (client must be notified or accept; risk remains until a real fix).
45. WinVerifyTrust Signature Validation Vulnerability
Affected hosts: 192.168.9.40, AR-CN-MH-01 - 192.168.60.105, AR-CN-PROD-01 - 192.168.60.113, AR-CN-PROD-02 - 192.168.60.103, AR-MGMT-RR-01 - 192.168.9.10, BYT14 - 172.20.10.2, DESKTOP-KHOUJ3K - 172.20.1.181, LAPTOP-LI5TEO9Q - 192.168.9.52, LAPTOP-MDIUJJTB - 192.168.60.122, MCSpare - 10.0.0.227, Pluto1 - 192.168.9.36, SATURN - 192.168.9.37, SMS-WKS16 - 192.168.60.110, SMS-WKS6 - 192.168.99.158, teri-sms - 192.168.68.69
What to do: Correct the listed configuration for WinVerifyTrust Signature Validation Vulnerability, or suppress / accept residual risk when the client will not change it (client must be notified or accept; risk remains until a real fix).
46. WinVerifyTrust Signature Validation Vulnerability
Affected hosts: 10.10.100.110, 10.10.100.112, Aaron-LPT - 192.168.0.227, AR-MGMT-RR-06 - 10.10.100.136, LAPTOP-4BQ0Q6F7 - 10.10.100.109, LAPTOP-4IAP1Q3R - 10.10.100.105, LAPTOP-A0MCMC9H - 10.10.100.101, LAPTOP-CT3OBSLV - 10.10.100.107, LAPTOP-H189O8CF - 10.10.100.123, LAPTOP-HG7ATGBA - 10.10.100.106, LAPTOP-N36HPSLT - 10.10.100.119, LAPTOP-NQEJAOFU - 10.10.100.108, OfficeLPT - 10.10.100.121
What to do: Correct the listed configuration for WinVerifyTrust Signature Validation Vulnerability, or suppress / accept residual risk when the client will not change it (client must be notified or accept; risk remains until a real fix).
47. Python 3.14.5 (64-bit)
Affected hosts: LAPTOP-EPL7RODK - 10.14.101.121
What to do: Update Python 3.14.5 (64-bit) to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
48. CVE-2021-28041
Affected hosts: mosaic-al56-static-178 - 173.248.56.178
What to do: Identify the vulnerable component for CVE-2021-28041 on each listed host first, then update to the minimum version to reach ({VersionTargetSuffix}), uninstall if unused, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
49. CVE-2021-41617
Affected hosts: mosaic-al56-static-178 - 173.248.56.178
What to do: Identify the vulnerable component for CVE-2021-41617 on each listed host first, then update to the minimum version to reach ({VersionTargetSuffix}), uninstall if unused, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
50. Microsoft Visual C++ (all versions)
Affected hosts: AR-Cicero-10 - 192.168.2.61 [12.0.21005], AR-Cicero-10 - 192.168.2.61 [10.0.40219], LAPTOP-UN4OVI86 - 192.168.4.159 [10.0.30319], LAPTOP-JK3JBCVL - 192.168.72.19 [10.0.30319]
What to do: Update Microsoft Visual C++ (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
51. Microsoft Visual C++ (all versions)
Affected hosts: JoshDesktop - 192.168.2.54 [11.0.61030], JoshDesktop - 192.168.2.54 [12.0.40664]
What to do: Update Microsoft Visual C++ (all versions) within the same major version to the minimum version to reach (or the latest available), uninstall the major version only if dependency testing proves it is unused, or suppress / accept residual risk when it must stay vulnerable (client must be notified or accept; risk remains until a real fix).
52. Speculative Store Bypass
Affected hosts: 10.10.100.110, 10.10.100.112, Aaron-LPT - 192.168.0.227, AR-MGMT-RR-06 - 10.10.100.136, LAPTOP-4BQ0Q6F7 - 10.10.100.109, LAPTOP-4IAP1Q3R - 10.10.100.105, LAPTOP-A0MCMC9H - 10.10.100.101, LAPTOP-CT3OBSLV - 10.10.100.107, LAPTOP-H189O8CF - 10.10.100.123, LAPTOP-HG7ATGBA - 10.10.100.106, LAPTOP-N36HPSLT - 10.10.100.119, LAPTOP-NQEJAOFU - 10.10.100.108, OfficeLPT - 10.10.100.121
What to do: Apply missing OS updates for Speculative Store Bypass to the minimum version to reach (or the latest available), decommission the host if it is not needed, or suppress / accept residual risk when patching is not possible (client must be notified or accept; risk remains until a real fix).
53. Git
Affected hosts: Pluto1 - 192.168.9.36
What to do: Update Git to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
54. WinVerifyTrust Signature Validation Vulnerability
Affected hosts: JoshDesktop - 192.168.2.54, LAPTOP-0VDGBMFV - 192.168.0.122, LAPTOP-AFI2HPRP - 192.168.1.217, LAPTOP-QHV00HJC - 10.0.1.69, Work-Laptop - 10.0.0.99
What to do: Correct the listed configuration for WinVerifyTrust Signature Validation Vulnerability, or suppress / accept residual risk when the client will not change it (client must be notified or accept; risk remains until a real fix).
55. Speculative Store Bypass
Affected hosts: JoshDesktop - 192.168.2.54, LAPTOP-0VDGBMFV - 192.168.0.122, LAPTOP-AFI2HPRP - 192.168.1.217, LAPTOP-QHV00HJC - 10.0.1.69, Work-Laptop - 10.0.0.99
What to do: Apply missing OS updates for Speculative Store Bypass to the minimum version to reach (or the latest available), decommission the host if it is not needed, or suppress / accept residual risk when patching is not possible (client must be notified or accept; risk remains until a real fix).
56. OpenVPN Connect
Affected hosts: JoshDesktop - 192.168.2.54
What to do: Update OpenVPN Connect to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
57. Adobe Illustrator 2026
Affected hosts: JoshDesktop - 192.168.2.54
What to do: Update Adobe Illustrator 2026 to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
58. Microsoft SQL Server 2012 Native Client
Affected hosts: Agility-TC-00S3 - 10.0.1.75, Agility-TC-000N - 10.0.1.81
What to do: Update Microsoft SQL Server 2012 Native Client to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
59. Microsoft SQL Server 2012 Native Client
Affected hosts: LAPTOP-NQEJAOFU - 10.10.100.108, 10.10.100.112
What to do: Update Microsoft SQL Server 2012 Native Client to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
60. Microsoft SQL Server 2014 Express LocalDB
Affected hosts: LAPTOP-NQEJAOFU - 10.10.100.108, 10.10.100.112
What to do: Update Microsoft SQL Server 2014 Express LocalDB to the minimum version to reach (or the latest available), uninstall if not needed, or suppress / accept residual risk when update or uninstall is not possible (client must be notified or accept; risk remains until a real fix).
If you would like us to quote this work, or if you will handle it internally, reply to this email. If an item cannot be remediated for business reasons, let me know and I can suppress it from further scan reports.
Sincerely,
Chris KnospeVulnerability Remediation - Windows 11 (all versions) (Agility Retail - Boston) - Updates Required
Vulnerability Remediation - Windows 11 (all versions) (Agility Retail - Boston) - Updates Required
Product/System: Windows 11 (all versions)
Location: Agility Retail - Boston
Affected Systems Count: 3
Finding summary:
Windows 11 (all versions) is missing required updates on the listed hosts. Apply missing quality/security updates via RMM, Windows Update, or Intune. Stay on the current Windows version and coordinate a maintenance window before any reboots.
CVE references:
CVE-2025-21298
https://nvd.nist.gov/vuln/detail/CVE-2025-21298
Vendor advisory:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21298
Additional CVEs (2490 more) are listed in the Client Folder report.
Minimum version to reach:
- Apply Windows Update KB5129195 (or the latest available).
Affected Systems:
- LAPTOP-8HSVAPMI - 10.0.1.54 [10.0.26100] [2486 vulns]
- Tom - 192.168.1.121 [10.0.26100] [1539 vulns]
- LAPTOP-SHJTQ6VH - 10.0.0.112 [10.0.26100] [1351 vulns]
Before updating, quick-check each host:
Confirm the OS/build matches this finding. Stop and escalate to Security as a false positive or no further action if any of the following apply:
- the host is already at/above the minimum version to reach (build/KB)
- the host is already on the latest quality/security updates for its current Windows version
- the vendor documents this CVE as not applicable or already fixed
When escalating, include hostnames, current build, what you verified, and any vendor documentation link. Note that a fully updated host can still show a CVE until the vendor releases a fix - do not force a feature upgrade in that case.
If none of the above apply, proceed with one of the remediation options below and document the choice in the ticket.
Remediation (pick the most appropriate option):
A. Apply missing OS quality/security updates (default)
- Apply the build/KB listed under Minimum version to reach (or the latest available) via RMM, Windows Update, or Intune.
- Prefer current vendor quality/security updates for the host's existing Windows version.
B. Host not needed - decommission / rebuild
- Only if the host should not exist; do not uninstall the OS.
C. Cannot patch - escalate to Security for suppression
- Examples: OS update channel/RMM broken after troubleshooting, client defers patching after verification, or no approved path yet.
- Do not suppress solely because the host is on an older feature build - feature upgrades need explicit client approval.
- Suppression only stops tracking; it does not patch or remove the vulnerability. Residual risk remains until a real fix is applied.
- The client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains).
Client coordination - READ BEFORE UPDATING:
Agree a maintenance window before reboots, feature upgrades, or broad patch pushes. If a user may be interrupted, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression.
===== TECHNICAL GUIDANCE (do this) =====
- Apply missing Windows updates via RMM, Windows Update, or Intune.
- If this host is a VM, take a pre-update snapshot so you can revert if there are issues.
- Reboot if Windows Update requires it.
- After the update, confirm the host has the latest quality/security updates for its current Windows version.
- If it is already fully updated and still flagged, escalate to Security as no further action - do not force a feature upgrade.
===== END TECHNICAL GUIDANCE =====
Source material:
Full scan exports and Top N reports are in the Client Folder under the reports location below.
Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3
Ticket created by Chris Knospe.Vulnerability Remediation - Windows 11 (all versions) (Agility Retail - Chicago - Cicero) - Updates Required
Vulnerability Remediation - Windows 11 (all versions) (Agility Retail - Chicago - Cicero) - Updates Required Product/System: Windows 11 (all versions) Location: Agility Retail - Chicago - Cicero Affected Systems Count: 3 Finding summary: Windows 11 (all versions) is missing required updates on the listed hosts. Apply the missing quality/security updates via RMM, Windows Update, or Intune. Stay on the current Windows version and coordinate a maintenance window before any reboots. CVE references: CVE-2025-21298 https://nvd.nist.gov/vuln/detail/CVE-2025-21298 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21298 Additional CVEs (2339 more) are listed in the Client Folder report. Minimum version to reach: - Apply Windows Update KB5066793. Upgrade to supported Operating System is recommended. - Apply Windows Update KB5129195 (or the latest available). Affected Systems: - LAPTOP-EPL7RODK - 10.14.101.121 [10.0.26100] [1658 vulns] - LAPTOP-UN4OVI86 - 192.168.4.159 [10.0.26100] [1512 vulns] - DESKTOP-RBJIB4E - 192.168.4.157 [10.0.26200] [1511 vulns] Quick-check each host first. Confirm the OS/build on the host matches this finding. Stop and escalate to Security as a false positive or no further action if any of the following apply: - Already at or above the minimum version to reach (build/KB) - Already on the latest quality/security updates for the current Windows version - The vendor documents this CVE as not applicable or already fixed Include hostnames, current build, what you verified, and any vendor documentation link. Note that a fully updated host can still show a CVE until the vendor releases a fix; do not force a feature upgrade in that case. Otherwise, choose update, remove, or suppress below and document the choice in the ticket. Remediation (pick the most appropriate option): A. Apply missing OS quality/security updates (default) - Apply the build/KB listed under Minimum version to reach (or the latest available) via RMM, Windows Update, or Intune. - Prefer current vendor quality/security updates for the host's existing Windows version. B. Host not needed - decommission / rebuild - Only if the host should not exist; do not uninstall the OS. C. Cannot patch - escalate to Security for suppression - Examples: OS update channel or RMM broken after troubleshooting, client defers patching after verification, or no approved path yet. - Do not suppress solely because the host is on an older feature build - feature upgrades need explicit client approval. - Suppression only stops tracking; it does not patch or remove the vulnerability. Residual risk remains until a real fix is applied. - The client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - READ BEFORE UPDATING: Agree a maintenance window before reboots, feature upgrades, or broad patch pushes. If a user may be interrupted, schedule the work after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. ===== TECHNICAL GUIDANCE (do this) ===== - Apply missing Windows updates via RMM, Windows Update, or Intune. - If this host is a VM, take a pre-update snapshot so you can revert if there are issues. - Reboot if Windows Update requires it. - After updating, confirm the host has the latest quality/security updates for its current Windows version. - If it is already fully updated and still flagged, escalate to Security as no further action - do not force a feature upgrade. ===== END TECHNICAL GUIDANCE ===== Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Windows 10 (all versions) (Agility Retail - E-Comm Cumberland) - Apply Missing OS Updates (Windows 10 EOL - plan upgrade)
Subject: Vulnerability Remediation - Windows 10 (all versions) (Agility Retail - E-Comm Cumberland) - Apply Missing OS Updates (Windows 10 EOL - plan upgrade) Product/System: Windows 10 (all versions) Location: Agility Retail - E-Comm Cumberland Affected Systems Count: 5 Finding summary: Windows 10 (all versions) is missing required updates on the listed hosts. Apply the remaining quality/security updates for the current build via RMM or Windows Update. Windows 10 is EOL. Do not force a Windows 11 upgrade from this ticket. After the updates are applied, a Windows 11 / new workstation project is a Sales quote and vCIO conversation, followed by Security suppression of the current OS. CVE references: CVE-2025-60724 https://nvd.nist.gov/vuln/detail/CVE-2025-60724 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60724 Additional CVEs (1488 more) are listed in the Client Folder report. Minimum version to reach: - Apply Windows Update KB5122878. Apply the latest patch. - (1 end-of-life component notice omitted). Affected Systems: - DESKTOP-RREJ582 - 192.168.0.15 [10.0.19045] [1488 vulns] - DESKTOP-ULFPN40 - 192.168.0.159 [10.0.19045] [1488 vulns] - DESKTOP-PJRUCQG - 10.0.0.82 [10.0.19045] [1488 vulns] - DESKTOP-3N4U9QE - 10.0.0.69 [10.0.19045] [1488 vulns] - DESKTOP-M8ICQCG - 10.0.0.127 [10.0.19045] [1488 vulns] Before updating, quick-check each host. Confirm the OS/build matches this finding. Stop and escalate to Security as a false positive or no further action if any of the following apply: - the host is already at or above the minimum version to reach (build/KB) - the host is already on the latest quality/security updates for its current Windows version - the vendor documents this CVE as not applicable or already fixed When escalating, include hostnames, current build, what you verified, and any vendor documentation link. A fully updated host can still show a CVE until the vendor releases a fix - do not force a feature upgrade in that case. Otherwise, choose one of the remediation options below and document it in the ticket. Remediation (pick the most appropriate option): A. Apply missing OS quality/security updates (default) - Apply the build/KB listed under Minimum version to reach (or the latest available) via RMM, Windows Update, or Intune. - Prefer current vendor quality/security updates for the host's existing Windows version. B. Host not needed - decommission / rebuild - Only if the host should not exist; do not uninstall the OS. C. Cannot patch - escalate to Security for suppression - Examples: OS update channel or RMM broken after troubleshooting, client defers patching after verification, or no approved path yet. - Do not suppress only because the host is on an older feature build - feature upgrades need explicit client approval. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - The client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: Agree a maintenance window before reboots, feature upgrades, or broad patch pushes. If a user may be interrupted, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: - Apply the missing Windows updates via RMM, Windows Update, or Intune. - If the host is a VM, take a pre-update snapshot so you can revert if there are issues. - Reboot if Windows Update requires it. - After updating, confirm the host has the latest quality/security updates for its current Windows version. - If it is already fully updated and still flagged, escalate to Security as no further action - do not force a feature upgrade. - Windows 10 is EOL: still apply any remaining quality/security updates first. For a Windows 11 / new workstation project, generate a quote (inform the client that you are doing so), contact the vCIO so they can discuss it with the client, then escalate to Security for suppression of the current OS. Source material: Full scan exports and Top N reports are in the Client Folder under the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Windows 11 (all versions) (Agility Retail - Los Angeles) - Updates Required
Vulnerability Remediation - Windows 11 (all versions) (Agility Retail - Los Angeles) - Updates Required Product/System: Windows 11 (all versions) Location: Agility Retail - Los Angeles Affected Systems Count: 3 Finding summary: Windows 11 (all versions) is missing required updates on the listed hosts. Apply the missing quality/security updates via RMM, Windows Update, or Intune. Stay on the current Windows version and coordinate a maintenance window before any reboots. CVE references: CVE-2025-60724 https://nvd.nist.gov/vuln/detail/CVE-2025-60724 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60724 Additional CVEs (1710 more) are listed in the Client Folder report. Minimum version to reach: - Apply Windows Update KB5129195 - Apply Windows Update KB5129242. Upgrade to a supported Operating System is recommended (or the latest available). Affected Systems: - MOON-LT-01 - 10.99.0.8 [10.0.26100] [1692 vulns] - moon-dt-acct - 10.0.0.22 [10.0.26100] [1692 vulns] - MOON-DT-3 - 10.0.0.20 [10.0.22631] [1226 vulns] Before updating, quick-check each host: Confirm the OS/build on the host matches this finding. Stop and escalate to Security as a false positive/no further action if any of the following apply: - The host is already at or above the minimum version to reach (build/KB) - The host is already on the latest quality/security updates for its current Windows version - The vendor documents this CVE as not applicable or already fixed When escalating, include the hostname, current build, what you verified, and any vendor documentation link. Note that a fully updated host can still show a CVE until the vendor releases a fix - do not force a feature upgrade in that case. Otherwise, proceed with one of the remediation options below and document your choice in the ticket. Remediation (pick the most appropriate option): A. Apply missing OS quality/security updates (default) - Apply the build/KB listed under Minimum version to reach (or the latest available) via RMM, Windows Update, or Intune. - Prefer current vendor quality/security updates for the host's existing Windows version. B. Host not needed - decommission/rebuild - Only if the host should not exist. Do not uninstall the OS. C. Cannot patch - escalate to Security for suppression - Examples: OS update channel/RMM broken after troubleshooting, client defers patching after verification, or no approved path yet. - Do not suppress solely because the host is on an older feature build - feature upgrades require explicit client approval. - Suppression only stops tracking; it does not patch or remove the vulnerability. Residual risk remains until a real fix is applied. - The client must accept or be notified. Record discussion notes in the ticket (who, what, hosts, and that risk remains). Client coordination - READ BEFORE UPDATING: Agree on a maintenance window before reboots, feature upgrades, or broad patch pushes. If a user may be interrupted, schedule the work after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: - Apply missing Windows updates via RMM, Windows Update, or Intune. - If the host is a VM, take a pre-update snapshot so you can revert if there are issues. - Reboot if Windows Update requires it. - After updating, confirm the host has the latest quality/security updates for its current Windows version. - If the host is already fully updated and still flagged, escalate to Security as no further action - do not force a feature upgrade. Source material: Full scan exports and Top N reports are in the Client Folder at the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Windows 11 (all versions) (Agility Retail - E-Comm Cumberland) - Updates Required
Vulnerability Remediation - Windows 11 (all versions) (Agility Retail - E-Comm Cumberland) - Updates Required Product/System: Windows 11 (all versions) Location: Agility Retail - E-Comm Cumberland Affected Systems Count: 3 Finding summary: Windows 11 (all versions) is missing required updates on the listed hosts. Apply the missing quality/security updates via RMM, Windows Update, or Intune. Stay on the current Windows version and coordinate a maintenance window before any reboots. CVE references: CVE-2026-33824 https://nvd.nist.gov/vuln/detail/CVE-2026-33824 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824 Additional CVEs (1516 more) are listed in the Client Folder report. Minimum version to reach: - Apply Windows Update KB5129195 (or the latest available). Affected Systems: - LAPTOP-PF5SGD86 - 192.168.82.2 [10.0.26100] [1512 vulns] - alma - 192.168.1.169 [10.0] [1512 vulns] - DELL-DGS43-MK.cormarkinc - 192.168.4.81 [10.0.26100] [1351 vulns] Before updating, quick-check each host: Confirm the OS/build on the host matches this finding. Stop and escalate to Security as a false positive/no further action if any of the following apply: - the host is already at or above the minimum version to reach (build/KB) - the host already has the latest quality/security updates for its current Windows version - the vendor documents this CVE as not applicable or already fixed When escalating, include the hostname, current build, what was verified, and any vendor documentation link. Note that a fully updated host can still show a CVE until the vendor releases a fix - do not force a feature upgrade in that case. If none of the stop conditions apply, choose the appropriate remediation option below and document it in the ticket. Remediation (pick the most appropriate option): A. Apply missing OS quality/security updates (default) - Apply the build/KB listed under Minimum version to reach (or the latest available) via RMM, Windows Update, or Intune. - Prefer current vendor quality/security updates for the host's existing Windows version. B. Host not needed - decommission/rebuild - Only if the host should not exist; do not uninstall the OS. C. Cannot patch - escalate to Security for suppression - Examples: OS update channel or RMM broken after troubleshooting, client defers patching after verification, or no approved path yet. - Do not suppress solely because the host is on an older feature build - feature upgrades require explicit client approval. - Suppression only stops tracking; it does not patch or remove the vulnerability. Residual risk remains until a real fix is applied. - The client must accept or be notified. Record discussion notes (who, what, hosts, and confirmation that risk remains). Client coordination - read before updating: Agree on a maintenance window before reboots, feature upgrades, or broad patch pushes. If a user may be interrupted, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance (do this): - Apply missing Windows updates via RMM, Windows Update, or Intune. - If the host is a VM, take a pre-update snapshot so you can revert if there are issues. - Reboot if Windows Update requires it. - After the update, confirm the host has the latest quality/security updates for its current Windows version. - If it is already fully updated and still flagged, escalate to Security as no further action - do not force a feature upgrade. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
After Hours - Vulnerability Remediation - Windows Server 2012 (all versions) (Agility Retail - E-Comm Cumberland) - End of Support Migration Required
After Hours - Vulnerability Remediation - Windows Server 2012 (all versions) (Agility Retail - E-Comm Cumberland) - End of Support Migration Required Product/System: Windows Server 2012 (all versions) Location: Agility Retail - E-Comm Cumberland Affected Systems Count: 1 Finding summary: Windows Server 2012 (all versions) requires an infrastructure change on the listed host (upgrade, replace, or migrate). If the fix requires a new server, OS, or workstation, generate a quote (inform the client that you are doing so), then contact the vCIO. Plan the upgrade or retirement with client approval and coordinate maintenance windows. CVE references: CVE-2023-24941 https://nvd.nist.gov/vuln/detail/CVE-2023-24941 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24941 Additional CVEs (3933 more) are listed in the Client Folder report. Minimum version to reach: - Apply Windows Update KB5123066 - Upgrade to a supported Operating System is recommended (or the latest available). Affected Systems: - HOSTDC - 192.168.0.11 [Windows] [3947 vulns] Before remediating, quick-check the host: confirm the OS build/SKU or migration scope matches this finding. Even for EOL products, check whether a newer final build exists and apply it if the host is behind. If the host is already on a supported platform or is not present, stop and escalate to Security as a false positive, including the hostname and what you found. Otherwise, choose one of the remediation options below and document it in the ticket. Remediation (pick the most appropriate option): A. Complete the infrastructure remediation (default when approved) - Upgrade, replace, or migrate per the technical guidance and client-approved plan. - Even when the OS/software is EOL, check whether a newer final build still exists and apply the latest available first. - If new servers, OS licenses, workstations, or similar are required, generate a quote (inform the client that you are doing so), contact the vCIO so they can discuss it with the client, then escalate to Security for suppression of the current asset. B. Asset not needed - decommission - Only if the host/service should not exist. C. Keeping EOL / deferred - notify the client, then escalate to Security for suppression - After confirming the host is on the latest available build for this EOL product (or that no further update exists), notify the client of the residual risk, record discussion notes to the client, then escalate to Security for suppression. - Do not request suppression until the latest-available check is complete and the client has been notified. - Suppression only stops tracking; it does not patch or remove the vulnerability. Residual risk remains until a real fix is applied. - The client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: Agree on project scope, timing, and cutover with the client. If keeping EOL, notify the client before escalating to Security for suppression. ===== TECHNICAL GUIDANCE (do this) ===== - Apply the latest available updates for this OS if any exist (EOL releases often have none). - Create a Sales quote for new hardware or an OS upgrade to a supported release, and inform the client that you are doing so. - Contact the vCIO so they can discuss the quote with the client. - Escalate to Security for suppression of the current host. Remediation occurs when the old device is retired, or when the purchased software/OS/license update is applied. ===== END TECHNICAL GUIDANCE ===== Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Windows 10 (all versions) (Agility Retail - Chicago North) - Apply Missing OS Updates (Windows 10 EOL - plan upgrade)
Vulnerability Remediation - Windows 10 (all versions) (Agility Retail - Chicago North) - Apply Missing OS Updates (Windows 10 EOL - plan upgrade) Product/System: Windows 10 (all versions) Location: Agility Retail - Chicago North Affected Systems Count: 3 Finding summary: Windows 10 (all versions) is missing required updates on the listed hosts. Apply the remaining quality/security updates for the current build via RMM or Windows Update. Windows 10 is EOL; do not force a Windows 11 upgrade from this ticket. After the updates are applied, a Windows 11 / new workstation project goes through a Sales quote and a vCIO conversation, followed by Security suppression of the current OS. CVE references: CVE-2025-60724 https://nvd.nist.gov/vuln/detail/CVE-2025-60724 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60724 Additional CVEs (1487 more) are listed in the Client Folder report. Minimum version to reach: - Apply Windows Update KB5122878. Upgrade to supported Operating System is recommended - (1 end-of-life component notices omitted) (or the latest available). Affected Systems: - SATURN - 192.168.9.37 [10.0.19045] [1488 vulns] - LAPTOP-LI5TEO9Q - 192.168.9.52 [10.0.19045] [1488 vulns] - DESKTOP-KHOUJ3K - 172.20.1.181 [10.0.19045] [1441 vulns] Quick-check each host first. Confirm the OS/build matches this finding, then stop and escalate to Security (false positive or no further action) if any of the following apply: - Already at/above the minimum version to reach (build/KB) - Already on the latest quality/security updates for the current Windows version - The vendor documents this CVE as not applicable or already fixed When escalating, include hostnames, current build, what you verified, and any vendor documentation link. Note that a fully updated host can still show a CVE until the vendor releases a fix; do not force a feature upgrade in that case. Otherwise, choose update, remove, or suppress below and document the choice in the ticket. Remediation (pick the most appropriate option): A. Apply missing OS quality/security updates (default) - Apply the build/KB listed under Minimum version to reach (or the latest available) via RMM, Windows Update, or Intune. - Prefer current vendor quality/security updates for the host's existing Windows version. B. Host not needed - decommission / rebuild - Only if the host should not exist. Do not uninstall the OS. C. Cannot patch - escalate to Security for suppression - Examples: OS update channel/RMM broken after troubleshooting, client defers patching after verification, or no approved path yet. - Do not suppress solely because the host is on an older feature build; feature upgrades need explicit client approval. - Suppression only stops tracking. It does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. - The client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: Agree a maintenance window before reboots, feature upgrades, or broad patch pushes. If a user may be interrupted, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: - Apply missing Windows updates via RMM, Windows Update, or Intune. - If the host is a VM, take a pre-update snapshot so you can revert if there are issues. - Reboot if Windows Update requires it. - After updating, confirm the host has the latest quality/security updates for its current Windows version. - If it is already fully updated and still flagged, escalate to Security as no further action; do not force a feature upgrade. - Windows 10 is EOL: apply any remaining quality/security updates first. For a Windows 11 / new workstation project, generate a quote (inform the client you are doing so), contact the vCIO so they can discuss it with the client, then escalate to Security for suppression of the current OS. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Windows 11 (all versions) (Agility Retail - San Diego) - Updates Required
Vulnerability Remediation - Windows 11 (all versions) (Agility Retail - San Diego) - Updates Required Product/System: Windows 11 (all versions) Location: Agility Retail - San Diego Affected Systems Count: 1 Finding summary: Windows 11 (all versions) is missing required updates on the listed host. Apply the missing quality/security updates via RMM, Windows Update, or Intune. Stay on the current Windows version and coordinate a maintenance window before any reboot. CVE references: CVE-2026-42990 https://nvd.nist.gov/vuln/detail/CVE-2026-42990 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42990 Additional CVEs (1190 more) are listed in the Client Folder report. Minimum version to reach: Apply Windows Update KB5129195 (or the latest available). Affected Systems: - ENGENEERING-4 - 192.168.10.95 [10.0.26200] [1185 vulns] Before updating: Quick-check the host first. Confirm the OS/build matches this finding. Stop and escalate to Security as a false positive or no further action if any of the following apply: - Already at/above the minimum version to reach (build/KB) - Already on the latest quality/security updates for the current Windows version - The vendor documents this CVE as not applicable or already fixed If escalating, include the hostname, current build, what you verified, and any vendor documentation link. Note that a fully updated host can still show a CVE until the vendor releases a fix - do not force a feature upgrade in that case. Otherwise, choose one of the remediation options below and document it in the ticket. Remediation (pick the most appropriate option): A. Apply missing OS quality/security updates (default) Apply the build/KB listed under Minimum version to reach (or the latest available) via RMM, Windows Update, or Intune. Prefer current vendor quality/security updates for the host's existing Windows version. B. Host not needed - decommission/rebuild Only if the host should not exist. Do not uninstall the OS. C. Cannot patch - escalate to Security for suppression Examples: OS update channel or RMM broken after troubleshooting, client defers patching after verification, or no approved path yet. Do not use suppression only because the host is on an older feature build - feature upgrades need explicit client approval. Suppression only stops tracking; it does not patch or remove the vulnerability, and residual risk stays until a real fix is applied. The client must accept this or be notified - record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: Agree a maintenance window before reboots, feature upgrades, or broad patch pushes. If a user may be interrupted, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: - Apply missing Windows updates via RMM, Windows Update, or Intune. - If this host is a VM, take a pre-update snapshot so you can revert if there are issues. - Reboot if Windows Update requires it. - After the update, confirm the host has the latest quality/security updates for its current Windows version. - If it is already fully updated and still flagged, escalate to Security as no further action - do not force a feature upgrade. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Windows 11 (all versions) (Agility Retail - Milwaukee) - Updates Required
Vulnerability Remediation - Windows 11 (all versions) (Agility Retail - Milwaukee) - Updates Required Product/System: Windows 11 (all versions) Location: Agility Retail - Milwaukee Affected Systems Count: 2 Finding summary: Windows 11 (all versions) is missing required updates on the listed hosts. Apply the missing quality/security updates via RMM, Windows Update, or Intune. Stay on the current Windows version and coordinate a maintenance window before any reboots. CVE references: CVE-2025-60724 https://nvd.nist.gov/vuln/detail/CVE-2025-60724 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60724 Additional CVEs (1871 more) are listed in the Client Folder report. Minimum version to reach: - Apply Windows Update KB5129195 (or the latest available). Affected Systems: - Aaron-LPT - 192.168.0.227 [10.0.26100] [1872 vulns] - LAPTOP-NQEJAOFU - 10.10.100.108 [10.0.26100] [1471 vulns] Before updating, quick-check each host: Confirm the OS/build on the host matches this finding. Stop and escalate to Security (false positive or no further action) if any of the following apply: - the host is already at or above the minimum version to reach (build/KB) - the host is already on the latest quality/security updates for its current Windows version - the vendor documents this CVE as not applicable or already fixed If escalating, include the hostname, current build, what you verified, and any vendor documentation link. Note that a fully updated host can still show a CVE until the vendor releases a fix - do not force a feature upgrade in that case. Otherwise, choose one remediation option below and document it in the ticket. Remediation (pick the most appropriate option): A. Apply missing OS quality/security updates (default) - Apply the build/KB listed under Minimum version to reach (or the latest available) via RMM, Windows Update, or Intune. - Prefer current vendor quality/security updates for the host's existing Windows version. B. Host not needed - decommission / rebuild - Only if the host should not exist. Do not uninstall the OS. C. Cannot patch - escalate to Security for suppression - Examples: OS update channel or RMM broken after troubleshooting, client defers patching after verification, or no approved path yet. - Do not suppress solely because the host is on an older feature build - feature upgrades need explicit client approval. - Suppression only stops tracking; it does not patch or remove the vulnerability. Residual risk remains until a real fix is applied. - The client must accept or be notified. Record discussion notes (who, what, hosts, and that risk remains). Client coordination - READ BEFORE UPDATING: Agree a maintenance window before reboots, feature upgrades, or broad patch pushes. If a user may be interrupted, schedule the work after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: - Apply missing Windows updates via RMM, Windows Update, or Intune. - If the host is a VM, take a pre-update snapshot so you can revert if there are issues. - Reboot if Windows Update requires it. - After updating, confirm the host has the latest quality/security updates for its current Windows version. - If the host is already fully updated and still flagged, escalate to Security as no further action - do not force a feature upgrade. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Windows 10 (all versions) (Agility Retail - Chicago - Cicero) - Apply Missing OS Updates (Windows 10 EOL - plan upgrade)
Vulnerability Remediation - Windows 10 (all versions) (Agility Retail - Chicago - Cicero) - Apply Missing OS Updates (Windows 10 EOL - plan upgrade) Product/System: Windows 10 (all versions) Location: Agility Retail - Chicago - Cicero Affected Systems Count: 1 Finding summary: Windows 10 (all versions) is missing required updates on the listed host. Apply the remaining quality/security updates for the current build via RMM or Windows Update. Windows 10 is EOL; do not force a Windows 11 upgrade from this ticket. After the updates are applied, a Windows 11 / new workstation project should go through a Sales quote and a vCIO conversation with the client, then Security suppression of the current OS. CVE references: CVE-2025-60724 https://nvd.nist.gov/vuln/detail/CVE-2025-60724 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60724 Additional CVEs (1487 more) are listed in the Client Folder report. Minimum version to reach: - Apply Windows Update KB5122878 (or the latest available). Affected Systems: - DESKTOP-JBKUHND - 192.168.1.70 [10.0.19045] [1488 vulns] Quick-check the host first. Confirm the OS/build matches this finding. Stop and escalate to Security (as a false positive or no further action) if any of the following apply: - already at or above the minimum version to reach (build/KB) - already on the latest quality/security updates for the current Windows version - the vendor documents this CVE as not applicable or already fixed If escalating, include the hostname, current build, what you verified, and any vendor documentation link. Note that a fully updated host can still show a CVE until the vendor releases a fix, so do not force a feature upgrade in that case. Otherwise, choose update, remove, or suppress below and document the choice in the ticket. Remediation (pick the most appropriate option): A. Apply missing OS quality/security updates (default) - Apply the build/KB listed under Minimum version to reach (or the latest available) via RMM, Windows Update, or Intune. - Prefer current vendor quality/security updates for the host's existing Windows version. B. Host not needed - decommission / rebuild - Only if the host should not exist; do not uninstall the OS. C. Cannot patch - escalate to Security for suppression - Examples: OS update channel / RMM broken after troubleshooting, client defers patching after verification, or no approved path yet. - Do not suppress solely because the host is on an older feature build; feature upgrades need explicit client approval. - Suppression only stops tracking. It does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. - The client must accept or be notified. Record discussion notes (who, what, hosts, and that risk remains). Client coordination - read before updating: Agree on a maintenance window before any reboots, feature upgrades, or broad patch pushes. If a user may be interrupted, schedule the work after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: - Apply missing Windows updates via RMM, Windows Update, or Intune. - If this host is a VM, take a pre-update snapshot so you can revert if there are issues. - Reboot if Windows Update requires it. - After the update, confirm the host has the latest quality/security updates for its current Windows version. - If it is already fully updated and still flagged, escalate to Security as no further action; do not force a feature upgrade. - Windows 10 is EOL: still apply any remaining quality/security updates first. For a Windows 11 / new workstation project, generate a quote (inform the client that you are doing so), contact the vCIO so they can discuss it with the client, then escalate to Security for suppression of the current OS. Source material: Full scan exports and Top N reports are in the Client Folder under the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Windows 10 (all versions) (Agility Retail - Los Angeles) - Apply Missing OS Updates (Windows 10 EOL - plan upgrade)
Vulnerability Remediation - Windows 10 (all versions) (Agility Retail - Los Angeles) - Apply Missing OS Updates (Windows 10 EOL - plan upgrade) Product/System: Windows 10 (all versions) Location: Agility Retail - Los Angeles Affected Systems Count: 1 Finding summary: Windows 10 (all versions) is missing required updates on the listed host. Apply the remaining quality/security updates for the current build via RMM or Windows Update. Windows 10 is EOL, but apply these updates first. Do not force a Windows 11 upgrade from this ticket - that is a separate Sales quote and vCIO conversation, followed by Security suppression of the current OS. CVE references: CVE-2025-60724 https://nvd.nist.gov/vuln/detail/CVE-2025-60724 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60724 Additional CVEs (1487 more) are listed in the Client Folder report. Minimum version to reach: - Apply Windows Update KB5122878 (or the latest available). Affected Systems: - vinyl-PC.moonmfg - 10.0.0.30 [10.0.19045] [1488 vulns] Quick-check the host first. Confirm the OS/build matches this finding. Stop and escalate to Security as a false positive or no further action if any of the following apply: - Already at or above the minimum version to reach (build/KB). - Already on the latest quality/security updates for the current Windows version. - The vendor documents this CVE as not applicable or already fixed. Document hostname, current build, what you verified, and any vendor documentation link. Note that a fully updated host can still show a CVE until the vendor releases a fix - do not force a feature upgrade in that case. Otherwise, choose update, remove, or suppress below and document your choice in the ticket. Remediation (pick the most appropriate option): A. Apply missing OS quality/security updates (default) - Apply the build/KB listed under Minimum version to reach (or the latest available) via RMM, Windows Update, or Intune. - Prefer current vendor quality/security updates for the host's existing Windows version. B. Host not needed - decommission / rebuild - Only if the host should not exist. Do not uninstall the OS. C. Cannot patch - escalate to Security for suppression - Examples: OS update channel or RMM broken after troubleshooting, client defers patching after verification, or no approved path yet. - Do not suppress solely because the host is on an older feature build - feature upgrades need explicit client approval. - Suppression only stops tracking; it does not patch or remove the vulnerability. Residual risk remains until a real fix is applied. - The client must accept or be notified. Record who was contacted, what was discussed, the affected hosts, and that risk remains. Client coordination - read before updating: Agree a maintenance window before reboots, feature upgrades, or broad patch pushes. If a user may be interrupted, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: - Apply missing Windows updates via RMM, Windows Update, or Intune. - If this host is a VM, take a pre-update snapshot so you can revert if there are issues. - Reboot if Windows Update requires it. - After updating, confirm the host has the latest quality/security updates for its current Windows version. - If it is already fully updated and still flagged, escalate to Security as no further action - do not force a feature upgrade. - Windows 10 is EOL: apply any remaining quality/security updates first. For a Windows 11 or new workstation project, generate a quote (inform the client you are doing so), contact vCIO so they can discuss it with the client, then escalate to Security for suppression of the current OS. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - San Diego) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - San Diego) - Update Required - 3rd party application Product/System: Microsoft .NET (all versions) Location: Agility Retail - San Diego Affected Systems Count: 28 Finding summary: Microsoft .NET (all versions) is outdated on the listed hosts. These runtimes update within the same major version. An app built on one major version is tied to that version, so removing it will break the app. CVE references: CVE-2024-0057 https://nvd.nist.gov/vuln/detail/CVE-2024-0057 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0057 Additional CVEs (71 more) are listed in the Client Folder report. Affected Systems: Sorry for the long host list below (28 hosts). Every hostname is on this ticket so you can work it without opening the reports. - AgilityRetailHZ - 192.168.10.112 [9.0.10] [405 vulns] - AgilityRetailHZ - 192.168.10.112 [8.0.21] [205 vulns] - AgilityRetailHZ - 192.168.10.112 [174 vulns] - AgilityRetailHZ - 192.168.10.112 [3.1.15] [112 vulns] - AgilityRetailHZ - 192.168.10.112 [10.0.26200] [82 vulns] - FrontOfficeFl - 192.168.10.107 [6.0.25] [24 vulns] - FrontOfficeFl - 192.168.10.107 [6.0.33] [12 vulns] - AgilityRetailHZ - 192.168.10.112 [6.0.36] [6 vulns] - PRINTMASTERPC - 192.168.10.137 [6.0.36] [3 vulns] - Mona1 - 192.168.10.147 [6.0.36] [3 vulns] - DESKTOP-A0L35K5 - 192.168.10.56 [6.0.36] [3 vulns] - 28CFWM3 - 192.168.10.75 [6.0.36] [3 vulns] - 192.168.10.84 [6.0.36] [3 vulns] - ENGENEERING-4 - 192.168.10.95 [6.0.36] [3 vulns] - HESNA-PC - 192.168.1.59 [6.0.36] [3 vulns] - Carlosg-Home - 192.168.0.7 [6.0.36] [3 vulns] - ENGINEERING-3 - 192.168.10.111 [6.0.36] [3 vulns] - DESKTOP-97QU41M - 192.168.10.113 [6.0.36] [3 vulns] - DESKTOP-JC0LEGB - 192.168.10.117 [6.0.36] [3 vulns] - Mona1 - 192.168.10.147 [5.0.17] [3 vulns] - DESKTOP-A0L35K5 - 192.168.10.56 [5.0.17] [3 vulns] - 28CFWM3 - 192.168.10.75 [5.0.17] [3 vulns] - 192.168.10.84 [5.0.17] [3 vulns] - ENGENEERING-4 - 192.168.10.95 [7.0.20] [3 vulns] - HESNA-PC - 192.168.1.59 [7.0.20] [3 vulns] - DESKTOP-97QU41M - 192.168.10.113 [7.0.20] [3 vulns] - DESKTOP-97QU41M - 192.168.10.113 [2 vulns] - PRINTMASTERPC - 192.168.10.137 [10.0.9] [1 vulns] IP-only host (no hostname) - identify it before remediating: - Ping the IP to confirm it is online. - Connect to the site network (VPN, ScreenConnect jump host, or on-site) if you cannot reach it from the usual tools. - Check DHCP (lease, reservation, MAC) for a name. - Look up the IP in RMM, ScreenConnect, Liongard, AD, DNS (reverse lookup), firewall, and switch/ARP. - If still unknown, run a network scan from a trusted site host (do not scan from the internet). - Record the hostname (or device type) on the ticket before remediating. - If the IP is offline, unused, or not this client, document what you checked and escalate to Security as a false positive. Quick-check each host first. Stop and escalate to Security as a false positive if the redistributable/runtime is not present, or is already at or above the minimum version to reach for that major version. Include hostnames and what you found. Otherwise choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (usual path when keeping the major version) Install the updated package for the same major version to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only after dependency testing proves the major version is unused (test machine; uninstall one major version at a time). C. Vulnerable major version is required - escalate to Security for suppression Dependency testing showed apps need this major version, and it remains (or will remain) vulnerable. Suppression only stops tracking; it does not patch or remove the vulnerability, and residual risk stays until a real fix. Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance (do this): .NET Framework and modern .NET (.NET 5+) are not interchangeable. An app built on one major version is tied to that version, so removing it will break the app. Update each runtime line via WU/vendor installer; uninstall only when unused and verified. If this host is a VM, take a pre-update snapshot so you can revert if there are issues. - .NET Core 3.x: out of support - uninstall if unused and verified, or escalate cannot-update - .NET 5: out of support - uninstall if unused and verified, or escalate cannot-update - .NET 6: out of support - uninstall if unused and verified, or escalate cannot-update - .NET 7: out of support since May 14, 2024 - uninstall if unused and verified, or escalate cannot-update - .NET 8 (LTS): update runtime to the reported target within the 8.x line (Windows Update or runtime installer) - .NET 9 (non-LTS): update 9.x runtime via WU/vendor installer, or uninstall if unused - .NET 10 (LTS): update runtime to the reported target within the 10.x line Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Adobe Creative Suite 6 Design Standard (Agility Retail - Los Angeles) - Update Required - 3rd party application
Vulnerability Remediation - Adobe Creative Suite 6 Design Standard (Agility Retail - Los Angeles) - Update Required - 3rd party application Product/System: Adobe Creative Suite 6 Design Standard Location: Agility Retail - Los Angeles Affected Systems Count: 1 Finding summary: Adobe Creative Suite 6 Design Standard is outdated on the listed host. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. CVE references: CVE-2011-2462 https://nvd.nist.gov/vuln/detail/CVE-2011-2462 Vendor security center: https://helpx.adobe.com/security.html Additional CVEs (442 more) are listed in the Client Folder report. Minimum version to reach: Multiple bundled scanner entries report end-of-life components; patch within each runtime line per remediation guidance (or the latest available). Affected Systems: - Moon-Fabrication - 10.0.0.50 [444 vulns] Quick-check the host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version to reach. Include the hostname and what you found. Otherwise choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove. Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression. You verified it exists at a vulnerable version, and install/update/uninstall is not viable after preferred methods. If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance (do this): Try updates in this order: 1) RMM automated patching or software deployment (preferred) 2) ScreenConnect Backstage CMD/PS or command/script (silent installer) 3) Only if 1 and 2 fail: live remote session with the end user for in-app UI updates If this host is a VM, take a pre-update snapshot so you can revert if there are issues. Identify the product from the Product and host list above, and confirm it is installed on the host before changing anything. Update/configure to the version listed under Minimum version to reach when present. If no minimum version is listed, use the CVE/product from this ticket plus the vendor security advisory, and document the version applied. Verify the update was successful. If the installer or firmware indicates a reboot or service restart, coordinate with the client first. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - Minneapolis) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - Minneapolis) - Update Required - 3rd party application Product/System: Microsoft .NET (all versions) Location: Agility Retail - Minneapolis Affected Systems Count: 6 Finding summary: Microsoft .NET (all versions) is outdated on the listed hosts. These runtimes update within the same major version. An app built on one major version is tied to that version - removing it will break the app. CVE references: CVE-2023-36049 https://nvd.nist.gov/vuln/detail/CVE-2023-36049 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36049 Additional CVEs (42 more) are listed in the Client Folder report. Affected Systems: - L-LEN-PF5V3QDM - 192.168.1.109 [6.0.3] [301 vulns] - L-Len-PF5AY1LH - 192.168.2.18 [6.0.29] [21 vulns] - L-Len-PF5AY1ES - 192.168.2.24 [6.0.29] [21 vulns] - L-LEN-PF5V3QDM - 192.168.1.109 [18 vulns] - LAPTOP-E5A1CAJI - 10.10.12.128 [6.0.29] [7 vulns] - LAPTOP-E5A1CAJI - 10.10.12.128 [6.0.36] [3 vulns] Quick-check each host first. Stop and escalate to Security as a false positive if the redistributable/runtime is not present, or is already at/above the minimum version to reach for that major version. Include hostnames and what you found. Otherwise choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (usual path when keeping the major version) Install the updated package for the same major version to the minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only after dependency testing proves the major version is unused (test machine; uninstall one major version at a time). C. Vulnerable major version is required - escalate to Security for suppression Dependency testing showed apps need this major version, and it remains (or will remain) vulnerable. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk stays until a real fix. The client must accept this or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: .NET Framework and modern .NET (.NET 5+) are not interchangeable. Update each runtime line via WU/vendor installer; uninstall only when unused and verified. If this host is a VM, take a pre-update snapshot so you can revert if there are issues. .NET 6 is out of support - uninstall if unused and verified, or escalate as cannot-update. Source material: Full scan exports and Top N reports are in the Client Folder under the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Adobe Acrobat Reader DC MUI (Agility Retail - Los Angeles) - Update Required - 3rd party application
Vulnerability Remediation - Adobe Acrobat Reader DC MUI (Agility Retail - Los Angeles) - Update Required - 3rd party application Product/System: Adobe Acrobat Reader DC MUI Location: Agility Retail - Los Angeles Affected Systems Count: 1 Finding summary: Adobe Acrobat Reader DC MUI is outdated on the listed host. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. CVE references: CVE-2025-43573 https://nvd.nist.gov/vuln/detail/CVE-2025-43573 Vendor security center: https://helpx.adobe.com/security.html Additional CVEs (379 more) are listed in the Client Folder report. Minimum version to reach: - Update to version 26.002.21931 (or the latest available). Affected Systems: - vinyl-PC.moonmfg - 10.0.0.30 [380 vulns] Quick-check the host first. If the product is not installed or is already at/above the minimum version to reach, stop and escalate to Security as a false positive, including the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression - You verified it exists at a vulnerable version, and install/update/uninstall is not viable after preferred methods. - If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Confirm Acrobat Pro vs Adobe Reader (and 32 vs 64) on the host before choosing an installer. Update to the reported remediation target. Use RMM/automated patching when deployed. Versions 20.x and 21.x are EOL, so this requires a full upgrade to a supported track, not a security patch on 20/21. For Backstage (CMD/PS), deploy the matching Acrobat installer/package (Admin Console when enterprise). Use a live user session only if needed, via Help > Check for Updates. Verify the version after updating. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Adobe Acrobat X Standard - English, Français, Deutsch (Agility Retail - E-Comm Cumberland) - Update Required - 3rd party application
Vulnerability Remediation - Adobe Acrobat X Standard - English, Français, Deutsch (Agility Retail - E-Comm Cumberland) - Update Required - 3rd party application Product/System: Adobe Acrobat X Standard - English, Français, Deutsch Location: Agility Retail - E-Comm Cumberland Affected Systems Count: 1 Finding summary: Adobe Acrobat X Standard - English, Français, Deutsch is outdated on the listed host. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those methods fail. CVE references: CVE-2016-4203 https://nvd.nist.gov/vuln/detail/CVE-2016-4203 Vendor security center: https://helpx.adobe.com/security.html Additional CVEs (372 more) are listed in the Client Folder report. Minimum version to reach: Multiple bundled scanner entries report end-of-life components. Patch within each runtime line per remediation guidance, or to the latest available version. Affected Systems: - DESKTOP-PJRUCQG - 10.0.0.82 [374 vulns] Quick-check the host first. If the product is not installed, or is already at or above the minimum version to reach, stop and escalate to Security as a false positive, noting the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach, or the latest available. B. Not needed / not in use - uninstall or remove - Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression - Use if you verified the product exists at a vulnerable version and install/update/uninstall is not viable after preferred methods. - If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix is applied. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: - Confirm Acrobat Pro vs. Adobe Reader (and 32-bit vs. 64-bit) on the host before choosing an installer. - Update to the reported remediation target. - Use RMM/automated patching when deployed. - Versions 20.x and 21.x are EOL; these require a full upgrade to a supported track, not a security patch on 20/21. - Via Backstage (CMD/PS): deploy the matching Acrobat installer/package (use Admin Console when enterprise). - Live user session only if needed: Help > Check for Updates. - Verify the version after updating. Source material: Full scan exports and Top N reports are in the Client Folder at the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Adobe Acrobat X Pro - English, Français, Deutsch (Agility Retail - Los Angeles) - Update Required - 3rd party application
Vulnerability Remediation - Adobe Acrobat X Pro - English, Français, Deutsch (Agility Retail - Los Angeles) - Update Required - 3rd party application Product/System: Adobe Acrobat X Pro - English, Français, Deutsch Location: Agility Retail - Los Angeles Affected Systems Count: 1 Finding summary: Adobe Acrobat X Pro - English, Français, Deutsch is outdated on the listed host. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. CVE references: CVE-2016-4203 https://nvd.nist.gov/vuln/detail/CVE-2016-4203 Vendor security center: https://helpx.adobe.com/security.html Additional CVEs (372 more) are listed in the Client Folder report. Minimum version to reach: Multiple bundled scanner entries report end-of-life components. Patch within each runtime line per remediation guidance (or update to the latest available version). Affected Systems: - Moon-Fabrication - 10.0.0.50 [374 vulns] Quick-check the host first. If the product is not installed, or is already at or above the minimum version to reach, stop and escalate to Security as a false positive, including the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression Use only if you verified the product exists at a vulnerable version and update/uninstall is not viable after trying preferred methods. If the product is EOL, check and apply the latest available final build first; if keeping it, notify the client, then escalate to Security. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. The client must accept or be notified; record discussion notes (who, what, hosts, and that risk remains). Client coordination - read before updating: If the update may interrupt a user, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Confirm Acrobat Pro vs Adobe Reader (and 32-bit vs 64-bit) on the host before choosing an installer. Update to the reported remediation target. Use RMM/automated patching when deployed. Versions 20.x and 21.x are EOL - perform a full upgrade to a supported track, not a security patch on 20/21. Backstage (CMD/PS): deploy the matching Acrobat installer/package (use Admin Console when enterprise). Live user session only if needed: Help > Check for Updates. Verify the version after updating. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft 365 Apps for business - en-us (Agility Retail - San Diego) - Updates Required
Vulnerability Remediation - Microsoft 365 Apps for business - en-us (Agility Retail - San Diego) - Updates Required Product/System: Microsoft 365 Apps for business - en-us Location: Agility Retail - San Diego Affected Systems Count: 1 Finding summary: Microsoft 365 Apps for business - en-us is outdated on the listed host. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. CVE references: CVE-2026-21509 https://nvd.nist.gov/vuln/detail/CVE-2026-21509 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 Additional CVEs (230 more) are listed in the Client Folder report. Minimum version to reach: Apply the latest patch. Affected Systems: - FrontOfficeFl - 192.168.10.107 [231 vulns] Quick-check the host first. Stop and escalate to Security as a false positive if the product is not installed or is already at or above the minimum version to reach, and include the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach, or the latest available. B. Not needed / not in use - uninstall or remove Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression Use only if you verified the product exists at a vulnerable version and install/update/uninstall is not viable after preferred methods. If the product is EOL, check and apply the latest available final build first; if keeping it, notify the client, then escalate to Security. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. The client must accept or be notified; record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Microsoft 365 Apps uses the Click-to-Run update channel, not winget. Verify the Office update channel (Current Channel, etc.) in the M365 admin center or Intune. Automate with the RMM script "Update Microsoft 365" where deployed. If a live user session is needed, use Office app > File > Account > Update Options > Update Now. For Backstage (CMD/PS), use RMM or Click-to-Run automation only, not the Office UI. Confirm the build version on the affected host after updating. Source material: Full scan exports and Top N reports are in the Client Folder under the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - E-Comm Cumberland) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - E-Comm Cumberland) - Update Required - 3rd party application Product/System: Microsoft .NET (all versions) Location: Agility Retail - E-Comm Cumberland Affected Systems Count: 17 Finding summary: Microsoft .NET (all versions) is outdated on the listed hosts. These runtimes update within the same major version. An app built on one major version is tied to that version - removing it will break the app. CVE references: CVE-2023-36049 https://nvd.nist.gov/vuln/detail/CVE-2023-36049 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36049 Additional CVEs (35 more) are listed in the Client Folder report. Affected Systems: - RebeccaByron - 192.168.12.136 [6.0.9] [111 vulns] - DESKTOP-M8ICQCG - 10.0.0.127 [5.0.17] [3 vulns] - DESKTOP-ULFPN40 - 192.168.0.159 [5.0.17] [3 vulns] - DELL-DGS43-MK.cormarkinc - 192.168.4.81 [5.0.17] [3 vulns] - DESKTOP-M8ICQCG - 10.0.0.127 [6.0.36] [3 vulns] - SherylMendoza - 10.0.0.170 [6.0.36] [3 vulns] - M-Bartczak - 10.0.0.195 [6.0.36] [3 vulns] - FarrahBradley - 10.0.0.204 [6.0.36] [3 vulns] - TiffanyBlack - 10.0.0.61 [6.0.36] [3 vulns] - win-eael5m09bfk - 10.0.0.65 [6.0.36] [3 vulns] - DESKTOP-ULFPN40 - 192.168.0.159 [6.0.36] [3 vulns] - EwaMankowski - 192.168.1.66 [6.0.36] [3 vulns] - DELL-DGS43-MK.cormarkinc - 192.168.4.81 [6.0.36] [3 vulns] - DESKTOP-CENHO7S - 192.168.52.52 [6.0.36] [3 vulns] - DESKTOP-LTES1BM - 192.168.68.51 [6.0.36] [3 vulns] - EwaMankowski - 192.168.1.66 [7.0.20] [3 vulns] - EwaMankowski - 192.168.1.66 [2 vulns] Quick-check each host first. Stop and escalate to Security as a false positive if the redistributable/runtime is not present, or is already at/above the minimum version to reach for that major version. Include hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (usual path when keeping the major version) Install the updated package for the same major version to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only after dependency testing proves the major version is unused (test machine; uninstall one major version at a time). C. Vulnerable major version is required - escalate to Security for suppression Dependency testing showed apps need this major version, and it remains (or will remain) vulnerable. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk stays until a real fix. Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: .NET Framework and modern .NET (.NET 5+) are not interchangeable. An app built on one major version is tied to that version - removing it will break the app. Update each runtime line via WU/vendor installer; uninstall only when unused and verified. If this host is a VM, take a pre-update snapshot so you can revert if there are issues. .NET 5: out of support - uninstall if unused and verified, or escalate cannot-update. .NET 6: out of support - uninstall if unused and verified, or escalate cannot-update. .NET 7: out of support since May 14, 2024 - uninstall if unused and verified, or escalate cannot-update. Source material: Full scan exports and Top N reports are in the Client Folder under Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - Chicago - Cicero) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - Chicago - Cicero) - Update Required - 3rd party application Product/System: Microsoft .NET (all versions) Location: Agility Retail - Chicago - Cicero Affected Systems Count: 5 Finding summary: Microsoft .NET (all versions) is outdated on the listed hosts. These runtimes update within the same major version. An app built on one major version is tied to that version, so removing it will break the app. CVE references: CVE-2022-23267 https://nvd.nist.gov/vuln/detail/CVE-2022-23267 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23267 Additional CVEs (54 more) are listed in the Client Folder report. Affected Systems: - DESKTOP-RBJIB4E - 192.168.4.157 [8.0.24] [120 vulns] - DESKTOP-LJANK6I - 192.168.2.76 [3.1.10] [48 vulns] - DESKTOP-RBJIB4E - 192.168.4.157 [10.0.26200] [40 vulns] - DESKTOP-RBJIB4E - 192.168.4.157 [10.0.11] [15 vulns] - DESKTOP-RBJIB4E - 192.168.4.157 [6.0.36] [3 vulns] Quick-check each host first. If the redistributable/runtime is not present, or is already at/above the minimum version to reach for that major version, stop and escalate to Security as a false positive. Include hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (usual path when keeping the major version) Install the updated package for the same major version to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only after dependency testing proves the major version is unused (test machine; uninstall one major version at a time). C. Vulnerable major version is required - escalate to Security for suppression Dependency testing showed apps need this major version, and it remains (or will remain) vulnerable. Suppression only stops tracking; it does not patch or remove the vulnerability, and residual risk stays until a real fix. Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - READ BEFORE UPDATING: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: .NET Framework and modern .NET (.NET 5+) are not interchangeable. An app built on one major version is tied to that version, so removing it will break the app. Update each runtime line via WU/vendor installer, and uninstall only when unused and verified. If the host is a VM, take a pre-update snapshot so you can revert if there are issues. - .NET Core 3.x: out of support - uninstall if unused and verified, or escalate cannot-update - .NET 6: out of support - uninstall if unused and verified, or escalate cannot-update - .NET 8 (LTS): update runtime to the reported target within the 8.x line (Windows Update or runtime installer) - .NET 10 (LTS): update runtime to the reported target within the 10.x line Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft 365 Apps for business - en-us (Agility Retail - E-Comm Cumberland) - Updates Required
Vulnerability Remediation - Microsoft 365 Apps for business - en-us (Agility Retail - E-Comm Cumberland) - Updates Required Product/System: Microsoft 365 Apps for business - en-us Location: Agility Retail - E-Comm Cumberland Affected Systems Count: 1 Finding summary: Microsoft 365 Apps for business - en-us is outdated on the listed host. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. CVE references: CVE-2026-70329 https://nvd.nist.gov/vuln/detail/CVE-2026-70329 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70329 Additional CVEs (180 more) are listed in the Client Folder report. Minimum version to reach: Apply the latest patch. Apply Windows Update KB5122878. Affected Systems: - DESKTOP-PJRUCQG - 10.0.0.82 [181 vulns] Steps: Quick-check the host first. If the product is not installed, or is already at/above the minimum version to reach, stop and escalate to Security as a false positive, including the hostname and what you found. Otherwise choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove. Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression. Use only if you verified the product exists at a vulnerable version and install/update/uninstall is not viable after preferred methods. If the product is EOL, check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk stays until a real fix. The client must accept or be notified; record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Microsoft 365 Apps use the Click-to-Run update channel, not winget. - Verify the Office update channel (Current Channel, etc.) in M365 admin or Intune. - Automate with the RMM script "Update Microsoft 365" when deployed. - Use a live user session only if needed: Office app > File > Account > Update Options > Update Now. - Backstage (CMD/PS) is for RMM / Click-to-Run automation only, not the Office UI. - Confirm the build version on the affected host after updating. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Foxit PDF Editor (Agility Retail - Minneapolis) - Update Required - 3rd party application
Vulnerability Remediation - Foxit PDF Editor (Agility Retail - Minneapolis) - Update Required - 3rd party application Product/System: Foxit PDF Editor Location: Agility Retail - Minneapolis Affected Systems Count: 2 Finding summary: Foxit PDF Editor is outdated on the listed hosts. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. CVE references: CVE-2026-91789 https://nvd.nist.gov/vuln/detail/CVE-2026-91789 Vendor security center: https://www.foxit.com/support/security-bulletins.html Additional CVEs (87 more) are listed in the Client Folder report. Minimum version to reach: Update to version 13.1.6.23570 (or the latest available). Affected Systems: - AleshireEng - 192.168.1.101 [88 vulns] - JordanEngineer - 192.168.1.103 [88 vulns] Quick-check each host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version to reach, and include hostnames and what you found. Otherwise choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression Use only if you verified the software exists at a vulnerable version and update/uninstall is not viable after preferred methods. If the product is EOL, check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk stays until a real fix. The client must accept or be notified; record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Confirm Foxit PDF Reader vs Foxit PDF Editor on each host. Update via RMM or the matching Foxit installer. Do not use Adobe Reader winget IDs for Foxit. Verify Help > About after update. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - Milwaukee) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - Milwaukee) - Update Required - 3rd party application Product/System: Microsoft Visual C++ (all versions) Location: Agility Retail - Milwaukee Affected Systems Count: 27 Finding summary: Microsoft Visual C++ (all versions) is outdated on the listed hosts. These runtimes update within the same major version. An app built on one major version is tied to that version - removing it will break the app. Affected Systems: Sorry for the long host list below (27 hosts). Every hostname is on this ticket so you can work it without opening the reports. - 10.10.100.110 [11.0.61030] [6 vulns] - LAPTOP-CT3OBSLV - 10.10.100.107 [11.0.61030] [6 vulns] - LAPTOP-NQEJAOFU - 10.10.100.108 [12.0.21005] [4 vulns] - LAPTOP-4BQ0Q6F7 - 10.10.100.109 [12.0.21005] [4 vulns] - 10.10.100.110 [12.0.21005] [4 vulns] - LAPTOP-N36HPSLT - 10.10.100.119 [12.0.21005] [4 vulns] - OfficeLPT - 10.10.100.121 [12.0.21005] [4 vulns] - LAPTOP-H189O8CF - 10.10.100.123 [12.0.21005] [4 vulns] - Aaron-LPT - 192.168.0.227 [12.0.21005] [4 vulns] - LAPTOP-A0MCMC9H - 10.10.100.101 [12.0.21005] [4 vulns] - LAPTOP-4IAP1Q3R - 10.10.100.105 [12.0.21005] [4 vulns] - LAPTOP-HG7ATGBA - 10.10.100.106 [12.0.21005] [4 vulns] - LAPTOP-NQEJAOFU - 10.10.100.108 [12.0.30501] [2 vulns] - LAPTOP-4BQ0Q6F7 - 10.10.100.109 [12.0.30501] [2 vulns] - 10.10.100.110 [12.0.30501] [2 vulns] - LAPTOP-N36HPSLT - 10.10.100.119 [12.0.30501] [2 vulns] - OfficeLPT - 10.10.100.121 [12.0.30501] [2 vulns] - LAPTOP-H189O8CF - 10.10.100.123 [12.0.30501] [2 vulns] - Aaron-LPT - 192.168.0.227 [12.0.30501] [2 vulns] - LAPTOP-A0MCMC9H - 10.10.100.101 [12.0.30501] [2 vulns] - LAPTOP-4IAP1Q3R - 10.10.100.105 [12.0.30501] [2 vulns] - LAPTOP-HG7ATGBA - 10.10.100.106 [12.0.30501] [2 vulns] - 10.10.100.110 [9.0.30729.6161] [2 vulns] - 10.10.100.110 [10.0.40219] [2 vulns] - LAPTOP-CT3OBSLV - 10.10.100.107 [10.0.40219] [2 vulns] - Aaron-LPT - 192.168.0.227 [10.0.30319] [2 vulns] - 10.10.100.110 [1 vulns] IP-only host (no hostname) - identify it before remediating: - Ping the IP to confirm it is online. - Connect to the site network (VPN, ScreenConnect jump host, or on-site) if you cannot reach it from the usual tools. - Check DHCP (lease, reservation, MAC) for a name. - Look up the IP in RMM, ScreenConnect, Liongard, AD, DNS (reverse lookup), firewall, and switch/ARP. - If still unknown, run a network scan from a trusted site host (do not scan from the internet). - Record the hostname (or device type) on the ticket before remediating. - If the IP is offline, unused, or not this client, document what you checked and escalate to Security as a false positive. Quick-check each host first. Stop and escalate to Security as a false positive if the redistributable/runtime is not present, or is already at/above the minimum version to reach for that major version - include hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (usual path when keeping the major version) - Install the updated package for the same major version to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only after dependency testing proves the major version is unused (test machine; uninstall one major version at a time). C. Vulnerable major version is required - escalate to Security for suppression - Dependency testing showed apps need this major version, and it remains (or will remain) vulnerable. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - READ BEFORE UPDATING: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. ===== TECHNICAL GUIDANCE (do this) ===== Visual C++ redistributables are side-by-side - do not upgrade everything to the latest year. An app built on one major version is tied to that version - removing it will break the app. Only remove a year if no app is using it. Patch each major version seen below using the matching vc_redist package or Windows Update; do not remove unless unused. If this host is a VM, take a pre-update snapshot so you can revert if there are issues. Verify the update was successful. Major versions found on this ticket: - 2008 (9.x) - 2010 (10.x) - 2012 (11.x) - 2013 (12.x) ===== END TECHNICAL GUIDANCE ===== Source material: Full scan exports and Top N reports are in the Client Folder under Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - Milwaukee) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - Milwaukee) - Update Required - 3rd party application Product/System: Microsoft .NET (all versions) Location: Agility Retail - Milwaukee Affected Systems Count: 4 Finding summary: Microsoft .NET (all versions) is outdated on the listed hosts. These runtimes update within the same major version. An app built on one major version is tied to that version - removing it will break the app. CVE references: CVE-2026-71328 https://nvd.nist.gov/vuln/detail/CVE-2026-71328 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-71328 Additional CVEs (14 more) are listed in the Client Folder report. Affected Systems: - LAPTOP-NQEJAOFU - 10.10.100.108 [8.0.29] [90 vulns] - LAPTOP-NQEJAOFU - 10.10.100.108 [5 vulns] - OfficeLPT - 10.10.100.121 [6.0.36] [3 vulns] - Aaron-LPT - 192.168.0.227 [6.0.36] [3 vulns] Quick-check each host first. Stop and escalate to Security as a false positive if the redistributable/runtime is not present or is already at/above the minimum version to reach for that major version. Include hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (usual path when keeping the major version) Install the updated package for the same major version to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only after dependency testing proves the major version is unused (test machine; uninstall one major version at a time). C. Vulnerable major version is required - escalate to Security for suppression Dependency testing showed apps need this major version, and it remains (or will remain) vulnerable. Suppression only stops tracking; it does not patch or remove the vulnerability, and residual risk stays until a real fix. Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: .NET Framework and modern .NET (.NET 5+) are not interchangeable. An app built on one major version is tied to that version - removing it will break the app. Update each runtime line via WU/vendor installer; uninstall only when unused and verified. If the host is a VM, take a pre-update snapshot so you can revert if there are issues. .NET 6: out of support - uninstall if unused and verified, or escalate cannot-update. .NET 8 (LTS): update runtime to the reported target within the 8.x line (Windows Update or runtime installer). Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - San Diego) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - San Diego) - Update Required - 3rd party application Product/System: Microsoft Visual C++ (all versions) Location: Agility Retail - San Diego Affected Systems Count: 27 Finding summary: Microsoft Visual C++ (all versions) is outdated on the listed hosts. These runtimes update within the same major version, and an app built on one major version is tied to that version, so removing it will break the app. Affected Systems: Sorry for the long host list below (27 hosts). Every hostname is on this ticket so you can work it without opening the reports. - PRINTMASTERPC - 192.168.10.137 [12.0.40664] [6 vulns] - Mona1 - 192.168.10.147 [12.0.40664] [6 vulns] - DESKTOP-ITMA3VO - 192.168.10.50 [12.0.40664] [6 vulns] - DESKTOP-A0L35K5 - 192.168.10.56 [12.0.40664] [6 vulns] - DESKTOP-L07U07V - 192.168.10.64 [12.0.40664] [6 vulns] - 28CFWM3 - 192.168.10.75 [12.0.40664] [6 vulns] - 192.168.10.84 [12.0.40664] [6 vulns] - ENGENEERING-4 - 192.168.10.95 [12.0.40664] [3 vulns] - HESNA-PC - 192.168.1.59 [12.0.40664] [3 vulns] - Carlosg-Home - 192.168.0.7 [12.0.40664] [3 vulns] - DESKTOP-N9IPL96 - 192.168.10.72 [12.0.40664] [3 vulns] - ENGENEERING-4 - 192.168.10.95 [11.0.61030] [3 vulns] - ENGINEERING-3 - 192.168.10.111 [11.0.61030] [3 vulns] - DESKTOP-A0L35K5 - 192.168.10.56 [12.0.30501] [2 vulns] - 28CFWM3 - 192.168.10.75 [12.0.30501] [2 vulns] - ENGINEERING-3 - 192.168.10.111 [10.0.40219] [2 vulns] - AgilityRetailHZ - 192.168.10.112 [12.0.21005] [2 vulns] - DESKTOP-97QU41M - 192.168.10.113 [12.0.21005] [2 vulns] - Mona1 - 192.168.10.147 [9.0.30729.6161] [1 vulns] - DESKTOP-A0L35K5 - 192.168.10.56 [9.0.30729.6161] [1 vulns] - 28CFWM3 - 192.168.10.75 [9.0.30729.6161] [1 vulns] - 192.168.10.84 [9.0.30729.6161] [1 vulns] - ENGINEERING-3 - 192.168.10.111 [9.0.30729.6161] [1 vulns] - DESKTOP-A0L35K5 - 192.168.10.56 [12.0.21005] [1 vulns] - AgilityRetailHZ - 192.168.10.112 [12.0.30501] [1 vulns] - DESKTOP-97QU41M - 192.168.10.113 [12.0.30501] [1 vulns] - ENGINEERING-3 - 192.168.10.111 [9.0.30729.17] [1 vulns] IP-only host (no hostname) - identify it before remediating: - Ping the IP to confirm it is online. - Connect to the site network (VPN, ScreenConnect jump host, or on-site) if you cannot reach it from the usual tools. - Check DHCP (lease, reservation, MAC) for a name. - Look up the IP in RMM, ScreenConnect, Liongard, AD, DNS (reverse lookup), firewall, and switch/ARP. - If still unknown, run a network scan from a trusted site host (do not scan from the internet). - Record the hostname (or device type) on the ticket before remediating. - If the IP is offline, unused, or not this client, document what you checked and escalate to Security as a false positive. Quick-check each host first. If the redistributable/runtime is not present, or is already at or above the minimum version to reach for that major version, stop and escalate to Security as a false positive, and include the hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (usual path when keeping the major version) - Install the updated package for the same major version to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only after dependency testing proves the major version is unused (test machine; uninstall one major version at a time). C. Vulnerable major version is required - escalate to Security for suppression - Dependency testing showed apps need this major version, and it remains (or will remain) vulnerable. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update; if they are unable or unwilling, escalate to Security for suppression. ===== TECHNICAL GUIDANCE (do this) ===== Visual C++ redistributables are side-by-side; do not upgrade everything to the latest year. Only remove a year if no app is using it. Patch each major version seen below with the matching vc_redist or Windows Update package. Applies to 2008 (9.x), 2010 (10.x), 2012 (11.x), and 2013 (12.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused. If this host is a VM, take a pre-update snapshot so you can revert if there are issues. Verify the update was successful. ===== END TECHNICAL GUIDANCE ===== Source material: Full scan exports and Top N reports are in the Client Folder under Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - Chicago North) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - Chicago North) - Update Required - 3rd party application Product/System: Microsoft Visual C++ (all versions) Location: Agility Retail - Chicago North Affected Systems Count: 25 Finding summary: Microsoft Visual C++ (all versions) is outdated on the listed hosts. These runtimes update within the same major version. An app built on one major version is tied to that version, so removing it will break the app. Affected Systems: Sorry for the long host list below (25 hosts). Every hostname is on this ticket so you can work it without opening the reports. - LAPTOP-0PI88JJK - 192.168.60.116 [11.0.61030] [6 vulns] - SATURN - 192.168.9.37 [11.0.61030] [6 vulns] - SMS-WKS6 - 192.168.99.158 [11.0.61030] [6 vulns] - LAPTOP-0PI88JJK - 192.168.60.116 [12.0.40664] [6 vulns] - SATURN - 192.168.9.37 [12.0.40664] [6 vulns] - 192.168.9.40 [12.0.40664] [6 vulns] - SMS-WKS6 - 192.168.99.158 [12.0.40664] [6 vulns] - ChicagoNorth-Fishbowl - 10.10.4.11 [12.0.21005] [4 vulns] - LAPTOP-0PI88JJK - 192.168.60.116 [9.0.30729.6161] [2 vulns] - LAPTOP-0PI88JJK - 192.168.60.116 [10.0.40219] [2 vulns] - Pluto1 - 192.168.9.36 [10.0.40219] [2 vulns] - SATURN - 192.168.9.37 [10.0.40219] [2 vulns] - SMS-WKS6 - 192.168.99.158 [10.0.40219] [2 vulns] - LAPTOP-0PI88JJK - 192.168.60.116 [12.0.30501] [2 vulns] - ChicagoNorth-Fishbowl - 10.10.4.11 [12.0.30501] [2 vulns] - LAPTOP-LI5TEO9Q - 192.168.9.52 [10.0.30319] [2 vulns] - BYT14 - 172.20.10.2 [10.0.30319] [2 vulns] - LAPTOP-0PI88JJK - 192.168.60.116 [9.0.30729.17] [1 vulns] - ChicagoNorth-Fishbowl - 10.10.4.11 [9.0.30729.17] [1 vulns] - LAPTOP-LI5TEO9Q - 192.168.9.52 [9.0.30729.6161] [1 vulns] - ChicagoNorth-Fishbowl - 10.10.4.11 [9.0.30729.6161] [1 vulns] - SATURN - 192.168.9.37 [12.0.30501] [1 vulns] - SATURN - 192.168.9.37 [11.0.60610] [1 vulns] - LAPTOP-LI5TEO9Q - 192.168.9.52 [1 vulns] - LAPTOP-LI5TEO9Q - 192.168.9.52 [9.0.21022] [1 vulns] IP-only host (no hostname) - identify before remediating: - Ping the IP to confirm it is online. - If you cannot reach it from the usual tools, connect to the site network (VPN, ScreenConnect jump host, or on-site). - Check DHCP (lease, reservation, MAC) for a name. - Look up the IP in RMM, ScreenConnect, Liongard, AD, DNS (reverse lookup), firewall, and switch/ARP. - If still unknown, run a network scan from a trusted site host (do not scan from the internet). - Record the hostname (or device type) on the ticket before remediating. - If the IP is offline, unused, or not this client, document what you checked and escalate to Security as a false positive. Quick-check each host first. Stop and escalate to Security as a false positive if the redistributable/runtime is not present, or is already at/above the minimum version to reach for that major version. Include hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (usual path when keeping the major version) Install the updated package for the same major version to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only after dependency testing proves the major version is unused (test machine; uninstall one major version at a time). C. Vulnerable major version is required - escalate to Security for suppression Dependency testing showed apps need this major version, and it remains (or will remain) vulnerable. Suppression only stops tracking; it does not patch or remove the vulnerability, and residual risk stays until a real fix. The client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Visual C++ redistributables are side-by-side - do not upgrade everything to the latest year. An app built on one major version is tied to that version, so removing it will break the app. Only remove a year if no app is using it. Patch each major version seen below with the matching vc_redist or Windows Update package. If a host is a VM, take a pre-update snapshot so you can revert if there are issues. Verify the update was successful. Patch via https://aka.ms/vcredist or Windows Update; do not remove unless unused: - 2008 (9.x) - 2010 (10.x) - 2012 (11.x) - 2013 (12.x) Source material: Full scan exports and Top N reports are in the Client Folder under Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - Boston) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - Boston) - Update Required - 3rd party application Product/System: Microsoft Visual C++ (all versions) Location: Agility Retail - Boston Affected Systems Count: 36 Finding summary: Microsoft Visual C++ (all versions) is outdated on the listed hosts. These runtimes update within the same major version. An app built on one major version is tied to that version - removing it will break the app. Affected Systems: Sorry for the long host list below (36 hosts). Every hostname is on this ticket so you can work it without opening the reports. - DESKTOP-GUKI3V9 - 192.168.4.133 [12.0.40664] [6 vulns] - LAPTOP-PI88L0PE - 192.168.1.107 [12.0.21005] [6 vulns] - Agility-H7-3306 - 10.0.1.63 [12.0.40664] [3 vulns] - Agility-H7-3262 - 10.0.1.78 [12.0.40664] [3 vulns] - Agility-H7-3268 - 10.0.1.95 [12.0.40664] [3 vulns] - Agility-R5-0253 - 10.0.1.74 [11.0.61030] [3 vulns] - CUSTSERV2-DSPC - 10.0.1.82 [11.0.61030] [3 vulns] - CUSTSERV3-SLPC - 10.0.1.88 [11.0.61030] [3 vulns] - CUSTSERV2-DSPC - 10.0.1.82 [11.0.51106] [3 vulns] - CUSTSERV3-SLPC - 10.0.1.88 [11.0.51106] [3 vulns] - Agility-H7-3261 - 10.0.1.93 [12.0.40664] [3 vulns] - LAPTOP-D7HGG20H - 10.0.0.34 [10.0.40219] [2 vulns] - Agility-R5-0253 - 10.0.1.74 [10.0.40219] [2 vulns] - LAPTOP-PI88L0PE - 192.168.1.107 [10.0.40219] [2 vulns] - Agility-TC-000N - 10.0.1.81 [10.0.30319] [2 vulns] - Agility-H7-3306 - 10.0.1.63 [10.0.40219] [1 vulns] - Agility-H7-3267 - 10.0.1.65 [10.0.40219] [1 vulns] - Agility-H7-3262 - 10.0.1.78 [10.0.40219] [1 vulns] - Agility-H7-3268 - 10.0.1.95 [10.0.40219] [1 vulns] - CUSTSERV2-DSPC - 10.0.1.82 [10.0.40219] [1 vulns] - CUSTSERV3-SLPC - 10.0.1.88 [10.0.40219] [1 vulns] - Agility-H7-3261 - 10.0.1.93 [10.0.40219] [1 vulns] - Agility-H7-3306 - 10.0.1.63 [1 vulns] - Agility-H7-3262 - 10.0.1.78 [1 vulns] - Agility-H7-3268 - 10.0.1.95 [1 vulns] - Agility-H7-3306 - 10.0.1.63 [9.0.30729.17] [1 vulns] - Agility-H7-3262 - 10.0.1.78 [9.0.30729.17] [1 vulns] - Agility-H7-3261 - 10.0.1.93 [9.0.30729.17] [1 vulns] - Agility-H7-3268 - 10.0.1.95 [9.0.30729.17] [1 vulns] - Agility-H7-3306 - 10.0.1.63 [9.0.30729.6161] [1 vulns] - Agility-H7-3262 - 10.0.1.78 [9.0.30729.6161] [1 vulns] - Agility-H7-3261 - 10.0.1.93 [9.0.30729.6161] [1 vulns] - Agility-H7-3268 - 10.0.1.95 [9.0.30729.6161] [1 vulns] - Agility-H7-3261 - 10.0.1.93 [1 vulns] - DESKTOP-GUKI3V9 - 192.168.4.133 [9.0.30729.4148] [1 vulns] - DESKTOP-GUKI3V9 - 192.168.4.133 [9.0.30729.6161] [1 vulns] Quick-check each host first. Stop and escalate to Security as a false positive if the redistributable/runtime is not present, or is already at/above the minimum version to reach for that major version. Include hostnames and what you found. Otherwise choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (usual path when keeping the major version) - Install the updated package for the same major version to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only after dependency testing proves the major version is unused (test machine; uninstall one major version at a time). C. Vulnerable major version is required - escalate to Security for suppression - Dependency testing showed apps need this major version, and it remains (or will remain) vulnerable. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Visual C++ redistributables are side-by-side - do not upgrade everything to the latest year. Only remove a year if no app is using it. Patch each major version seen below with the matching vc_redist or Windows Update package. If this host is a VM, take a pre-update snapshot so you can revert if there are issues. Verify the update was successful. - 2008 (9.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused - 2010 (10.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused - 2012 (11.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused - 2013 (12.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused Source material: Full scan exports and Top N reports are in the Client Folder under Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Foxit PDF Editor (Agility Retail - San Diego) - Update Required - 3rd party application
Vulnerability Remediation - Foxit PDF Editor (Agility Retail - San Diego) - Update Required - 3rd party application Product/System: Foxit PDF Editor Location: Agility Retail - San Diego Affected Systems Count: 1 Finding summary: Foxit PDF Editor is outdated on the listed host. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those methods fail. CVE references: CVE-2026-91789 https://nvd.nist.gov/vuln/detail/CVE-2026-91789 Vendor security center: https://www.foxit.com/support/security-bulletins.html Additional CVEs (87 more) are listed in the Client Folder report. Minimum version to reach: - Update to version 13.1.6.23570 (or the latest available). Affected Systems: - DESKTOP-JC0LEGB - 192.168.10.117 [88 vulns] Quick-check the host first. Escalate to Security as a false positive if Foxit PDF Editor is not installed or is already at/above the minimum version to reach, and include the hostname with what you found. Otherwise choose update, remove, or suppress below and document the choice in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression - You verified it exists at a vulnerable version, and install/update/uninstall is not viable after preferred methods. - If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Confirm Foxit PDF Reader vs Foxit PDF Editor on the host. Update via RMM or the matching Foxit installer. Do not use Adobe Reader winget IDs for Foxit. Verify Help > About after the update. Source material: Full scan exports and Top N reports are in the Client Folder under the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Google Chrome (Agility Retail - Chicago North) - Update Required - 3rd party application
Vulnerability Remediation - Google Chrome (Agility Retail - Chicago North) - Update Required - 3rd party application
Product/System: Google Chrome
Location: Agility Retail - Chicago North
Affected Systems Count: 4
Finding summary:
Google Chrome is outdated on the listed hosts. Prefer RMM, the vendor updater, or Backstage CMD/PS - this app often updates in the background. A live user session is usually not needed, and a reboot is usually not required.
CVE references:
CVE-2026-87464
https://nvd.nist.gov/vuln/detail/CVE-2026-87464
Vendor security center:
https://chromereleases.googleblog.com/
Additional CVEs (324 more) are listed in the Client Folder report.
Minimum version to reach:
- Update to version 154.0.8037.58 (or the latest available)
- Update to version 154.0.4258.37 (or the latest available)
Affected Systems:
- 192.168.9.40 [325 vulns]
- BYT14 - 172.20.10.2 [16 vulns]
- LAPTOP-0PI88JJK - 192.168.60.116 [16 vulns]
- Pluto1 - 192.168.9.36 [16 vulns]
IP-only host (no hostname) - identify it before remediating:
- Ping the IP to confirm it is online.
- If you cannot reach it from the usual tools, connect to the site network (VPN, ScreenConnect jump host, or on-site).
- Check DHCP (lease, reservation, MAC) for a name.
- Look up the IP in RMM, ScreenConnect, Liongard, AD, DNS (reverse lookup), firewall, and switch/ARP.
- If still unknown, run a network scan from a trusted site host (do not scan from the internet).
- Record the hostname (or device type) on the ticket before remediating.
- If the IP is offline, unused, or not this client, document what you checked and escalate to Security as a false positive.
Process:
Quick-check each host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version to reach. Include hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket.
Remediation (pick the most appropriate option):
A. Update (default when still needed)
- Update the app to the version listed under Minimum version to reach (or the latest available) via vendor updater, RMM, or Backstage CMD/PS.
- Relaunch the app if an update downloaded but did not apply.
B. Not needed / not in use - uninstall or remove
- Only if the app is not required on that host (confirm site standard / client).
C. Cannot reach a secure release - escalate to Security for suppression
- Typical case: the OS cannot support the secure release, or the update is blocked after RMM/Backstage CMD/PS/live-session attempts.
- If the product is EOL, check and apply the latest available final build first. If keeping it, notify the client, then escalate to Security.
- Use this option only after confirming the app is present at a vulnerable version.
- Do not use suppression for ordinary update failures - finish preferred methods or escalate troubleshooting first.
- Suppression only stops tracking. It does not patch or remove the vulnerability, and residual risk remains until a real fix is applied.
- The client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains).
Client coordination - read before updating:
If this update may interrupt a user, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression.
Technical guidance:
- Try updates in this order: 1) RMM automated patching or software deployment (preferred), 2) ScreenConnect Backstage CMD/PS or command/script (silent installer), 3) only if 1 and 2 fail, a live remote session with the end user for in-app UI updates.
- If the host is a VM, take a pre-update snapshot so you can revert if there are issues.
- Chrome updates via Google Update (background); a relaunch may be needed to apply a downloaded update.
- If still behind, check the Chrome update policy / Google Update scheduled tasks.
- Verify the update was successful.
Source material:
Full scan exports and Top N reports are in the Client Folder under the Reports location below.
Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3
Ticket created by Chris Knospe.Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - Corporate Headquarters) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - Corporate Headquarters) - Update Required - 3rd party application Product/System: Microsoft .NET (all versions) Location: Agility Retail - Corporate Headquarters Affected Systems Count: 8 Finding summary: Microsoft .NET (all versions) is outdated on the listed hosts. These runtimes update within the same major version. An app built on one major version is tied to that version, so removing it will break the app. CVE references: CVE-2026-69439 https://nvd.nist.gov/vuln/detail/CVE-2026-69439 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69439 Additional CVEs (4 more) are listed in the Client Folder report. Affected Systems: - LAPTOP-0VDGBMFV - 192.168.0.122 [8.0.30] [15 vulns] - JoshDesktop - 192.168.2.54 [8.0.30] [15 vulns] - JoshDesktop - 192.168.2.54 [10.0.11] [15 vulns] - JoshDesktop - 192.168.2.54 [9.0.19] [15 vulns] - LAPTOP-0VDGBMFV - 192.168.0.122 [10.0.26100] [5 vulns] - JoshDesktop - 192.168.2.54 [10.0.26100] [5 vulns] - JoshDesktop - 192.168.2.54 [5.0.17] [3 vulns] - JoshDesktop - 192.168.2.54 [6.0.36] [3 vulns] Quick-check each host first. Stop and escalate to Security as a false positive if the redistributable/runtime is not present, or is already at or above the minimum version to reach for that major version. Include hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (usual path when keeping the major version) Install the updated package for the same major version to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only after dependency testing proves the major version is unused (test machine; uninstall one major version at a time). C. Vulnerable major version is required - escalate to Security for suppression Dependency testing showed apps need this major version, and it remains (or will remain) vulnerable. Suppression only stops tracking; it does not patch or remove the vulnerability, and residual risk stays until a real fix. The client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: .NET Framework and modern .NET (.NET 5+) are not interchangeable. An app built on one major version is tied to that version, so removing it will break the app. Update each runtime line via WU/vendor installer; uninstall only when unused and verified. If this host is a VM, take a pre-update snapshot so you can revert if there are issues. - .NET 5: out of support - uninstall if unused and verified, or escalate cannot-update - .NET 6: out of support - uninstall if unused and verified, or escalate cannot-update - .NET 8 (LTS): update runtime to the reported target within the 8.x line (Windows Update or runtime installer) - .NET 9 (non-LTS): update 9.x runtime via WU/vendor installer, or uninstall if unused - .NET 10 (LTS): update runtime to the reported target within the 10.x line Source material: Full scan exports and Top N reports are in the Client Folder under Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - Boston) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - Boston) - Update Required - 3rd party application Product/System: Microsoft .NET (all versions) Location: Agility Retail - Boston Affected Systems Count: 5 Finding summary: Microsoft .NET (all versions) is outdated on the listed hosts. These runtimes update within the same major version. An app built on one major version is tied to that version - removing it will break the app. CVE references: CVE-2026-71328 https://nvd.nist.gov/vuln/detail/CVE-2026-71328 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-71328 Additional CVEs (14 more) are listed in the Client Folder report. Affected Systems: - DESKTOP-E32TV1A - 192.168.52.27 [8.0.29] [45 vulns] - DESKTOP-E32TV1A - 192.168.52.27 [10.0.26100] [15 vulns] - DESKTOP-E32TV1A - 192.168.52.27 [5.0.17] [3 vulns] - DESKTOP-E32TV1A - 192.168.52.27 [6.0.36] [3 vulns] - AGILITY-AM- - 10.0.1.72 [6.0.36] [3 vulns] Quick-check each host first. If the redistributable/runtime for a given major version is not present, or is already at/above the minimum version to reach, stop and escalate to Security as a false positive - include the hostname and what you found. Otherwise, choose update, remove, or suppress below and document your choice in the ticket. Remediation (pick the most appropriate option): A. Update (usual path when keeping the major version) - Install the updated package for the same major version to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only after dependency testing proves the major version is unused (test on a machine; uninstall one major version at a time). C. Vulnerable major version is required - escalate to Security for suppression - Dependency testing showed apps need this major version, and it remains (or will remain) vulnerable. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If the update may interrupt a user, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance (do this): .NET Framework and modern .NET (.NET 5+) are not interchangeable. Update each runtime line via WU/vendor installer; uninstall only when unused and verified. If the host is a VM, take a pre-update snapshot so you can revert if there are issues. - .NET 5: out of support - uninstall if unused and verified, or escalate cannot-update - .NET 6: out of support - uninstall if unused and verified, or escalate cannot-update - .NET 8 (LTS): update runtime to the reported target within the 8.x line (Windows Update or runtime installer) - .NET 10 (LTS): update runtime to the reported target within the 10.x line Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - Los Angeles) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - Los Angeles) - Update Required - 3rd party application Product/System: Microsoft Visual C++ (all versions) Location: Agility Retail - Los Angeles Affected Systems Count: 24 Finding summary: Microsoft Visual C++ (all versions) is outdated on the listed hosts. These runtimes update within the same major version. An app built on one major version is tied to that version, so removing it will break the app. Affected Systems: Sorry for the long host list below (24 hosts). Every hostname is on this ticket so you can work it without opening the reports. - LAPTOP-9SFHJCD5 - 10.0.0.25 [12.0.40664] [6 vulns] - LAPTOP-NUV0PMBB - 10.0.0.21 [12.0.21005] [6 vulns] - LAPTOP-NTB3SJ43 - 10.99.0.12 [12.0.21005] [6 vulns] - LAPTOP-F5FORECH - 10.0.0.15 [12.0.40664] [3 vulns] - LAPTOP-UE1T1R2C - 10.99.0.5 [12.0.40664] [3 vulns] - LAPTOP-9SFHJCD5 - 10.0.0.25 [2 vulns] - Moon-Fabrication - 10.0.0.50 [2 vulns] - MOON-LT-01 - 10.99.0.8 [2 vulns] - LAPTOP-NUV0PMBB - 10.0.0.21 [10.0.40219] [2 vulns] - LAPTOP-9SFHJCD5 - 10.0.0.25 [10.0.40219] [2 vulns] - vinyl-PC.moonmfg - 10.0.0.30 [10.0.40219] [2 vulns] - Moon-Fabrication - 10.0.0.50 [10.0.40219] [2 vulns] - LAPTOP-NTB3SJ43 - 10.99.0.12 [10.0.40219] [2 vulns] - MOON-LT-01 - 10.99.0.8 [10.0.30319] [2 vulns] - Moon-Fabrication - 10.0.0.50 [9.0.30729.4148] [2 vulns] - Moon-Fabrication - 10.0.0.50 [9.0.30729.6161] [2 vulns] - LAPTOP-F5FORECH - 10.0.0.15 [1 vulns] - LAPTOP-UE1T1R2C - 10.99.0.5 [1 vulns] - LAPTOP-F5FORECH - 10.0.0.15 [10.0.40219] [1 vulns] - moon-dt-acct - 10.0.0.22 [10.0.40219] [1 vulns] - LAPTOP-UE1T1R2C - 10.99.0.5 [10.0.40219] [1 vulns] - moon-dt-acct - 10.0.0.22 [10.0.30319] [1 vulns] - LAPTOP-R8OEN4P4 - 10.0.0.44 [10.0.30319] [1 vulns] - LAPTOP-RO56NKMM - 10.0.0.45 [10.0.30319] [1 vulns] Quick-check each host first. Stop and escalate to Security as a false positive if the redistributable/runtime is not present, or is already at/above the minimum version to reach for that major version. Include hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (usual path when keeping the major version) - Install the updated package for the same major version to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only after dependency testing proves the major version is unused (test machine; uninstall one major version at a time). C. Vulnerable major version is required - escalate to Security for suppression - Dependency testing showed apps need this major version, and it remains (or will remain) vulnerable. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance (do this): Visual C++ redistributables are side-by-side - do not upgrade everything to the latest year. An app built on one major version is tied to that version - removing it will break the app. Only remove a year if no app is using it. Patch each major version seen below with the matching vc_redist or Windows Update package. If this host is a VM, take a pre-update snapshot so you can revert if there are issues. Verify the update was successful. - 2008 (9.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused - 2010 (10.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused - 2013 (12.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused Source material: Full scan exports and Top N reports are in the Client Folder under Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Adobe Illustrator 2026 (Agility Retail - San Diego) - Update Required - 3rd party application
Vulnerability Remediation - Adobe Illustrator 2026 (Agility Retail - San Diego) - Update Required - 3rd party application Product/System: Adobe Illustrator 2026 Location: Agility Retail - San Diego Affected Systems Count: 4 Finding summary: Adobe Illustrator 2026 is outdated on the listed hosts. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. CVE references: CVE-2026-48334 https://nvd.nist.gov/vuln/detail/CVE-2026-48334 Vendor security center: https://helpx.adobe.com/security.html Additional CVEs (21 more) are listed in the Client Folder report. Minimum version to reach: - Update to version 30.8 (or the latest available). Affected Systems: - ENGENEERING-4 - 192.168.10.95 [22 vulns] - DESKTOP-CPM25O2 - 10.0.0.26 [20 vulns] - L-LEN-PF5YMR5J - 10.229.214.25 [13 vulns] - AgilityRetailHZ - 192.168.10.112 [3 vulns] Quick-check each host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version to reach. Include hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression - You verified it exists at a vulnerable version, and install/update/uninstall is not viable after preferred methods. - If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - READ BEFORE UPDATING: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Try updates in this order: 1) RMM automated patching or software deployment (preferred), 2) ScreenConnect Backstage CMD/PS or command/script (silent installer), 3) only if 1 and 2 fail, a live remote session with the end user for in-app UI updates. If this host is a VM, take a pre-update snapshot so you can revert if there are issues. Identify the product from the Product and host list, and confirm it is installed on each host before changing anything. Update/configure to the version listed under Minimum version to reach when present. If no minimum version is listed, use the CVE/product from this ticket plus the vendor security advisory, and document the version applied. Verify the update was successful. If the installer or firmware indicates a reboot or service restart, coordinate with the client first. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft Teams (Agility Retail - San Diego) - Application Update Required
Vulnerability Remediation - Microsoft Teams (Agility Retail - San Diego) - Application Update Required Product/System: Microsoft Teams Location: Agility Retail - San Diego Affected Systems Count: 7 Finding summary: Microsoft Teams is outdated on the listed hosts. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. CVE references: CVE-2023-4863 https://nvd.nist.gov/vuln/detail/CVE-2023-4863 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863 Additional CVEs (6 more) are listed in the Client Folder report. Minimum version to reach: - Update to version 1.08.00.9760 (or the latest available) - Update to version 26225.1806.5074.1452 (or the latest available) Affected Systems: - Mona1 - 192.168.10.147 [7 vulns] - FrontOfficeFl - 192.168.10.107 [7 vulns] - DESKTOP-ITMA3VO - 192.168.10.50 [7 vulns] - DESKTOP-N9IPL96 - 192.168.10.72 [4 vulns] - DESKTOP-JC0LEGB - 192.168.10.117 [2 vulns] - DESKTOP-L07U07V - 192.168.10.64 [2 vulns] - 28CFWM3 - 192.168.10.75 [2 vulns] Quick-check each host first. Stop and escalate to Security as a false positive if the product is not installed, or is already at or above the minimum version to reach. Include hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression - You verified it exists at a vulnerable version, and install/update/uninstall is not viable after preferred methods. - If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Confirm the flagged Teams version, since Classic is not always the source. Classic Teams is sometimes a per-user install; a user who has not logged into this workstation in a while, or is not the primary user, can still have Classic leftover. Run the RMM Teams Classic cleanup script for those leftover per-user installs. If Classic or a duplicate is suspected, use R-Security - Teams Classic Cleanup Remediation (Scripts > RR Custom > RR Custom - R-Security Remediation > R-Security - Teams Classic Cleanup Remediation). If current Teams is behind, use automated patching/RMM first. Use a live user session only if needed, via the three-dot menu > Settings > About Teams. In Backstage (CMD/PS), use an RMM script or installer only, not the Teams UI. Source material: Full scan exports and Top N reports are in the Client Folder under the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - GPL Ghostscript (Agility Retail - Boston) - Update Required
Vulnerability Remediation - GPL Ghostscript (Agility Retail - Boston) - Update Required Product/System: GPL Ghostscript Location: Agility Retail - Boston Affected Systems Count: 1 Finding summary: GPL Ghostscript is outdated on the listed host. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. CVE references: CVE-2021-3781 https://nvd.nist.gov/vuln/detail/CVE-2021-3781 Additional CVEs (31 more) are listed in the Client Folder report. Minimum version to reach: Update to version 10.08.0 (or the latest available). Affected Systems: - Agility-H7-3262 - 10.0.1.78 [32 vulns] Quick-check the host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version to reach. Include the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression Use only if you verified it exists at a vulnerable version and install/update/uninstall is not viable after preferred methods. If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. Suppression only stops tracking; it does not patch or remove the vulnerability, and residual risk stays until a real fix. The client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance (do this): Try updates in this order: 1) RMM automated patching or software deployment (preferred), 2) ScreenConnect Backstage CMD/PS or command/script (silent installer), 3) only if 1 and 2 fail, a live remote session with the end user for in-app UI updates. If this host is a VM, take a pre-update snapshot so you can revert if there are issues. Identify the product from the Product and host list, and confirm it is installed on the host before changing anything. Update/configure to the version listed under Minimum version to reach. If no minimum version is listed, use the CVE/product from this ticket plus the vendor security advisory, and document the version applied. Verify the update was successful. If the installer or firmware indicates a reboot or service restart, coordinate with the client first. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Adobe Illustrator 2025 (Agility Retail - San Diego) - Update Required - 3rd party application
Vulnerability Remediation - Adobe Illustrator 2025 (Agility Retail - San Diego) - Update Required - 3rd party application Product/System: Adobe Illustrator 2025 Location: Agility Retail - San Diego Affected Systems Count: 2 Finding summary: Adobe Illustrator 2025 is outdated on the listed hosts. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those methods fail. CVE references: CVE-2026-48334 https://nvd.nist.gov/vuln/detail/CVE-2026-48334 Vendor security center: https://helpx.adobe.com/security.html Additional CVEs (23 more) are listed in the Client Folder report. Minimum version to reach: Update to version 30.8 (or the latest available). Affected Systems: - Carlosg-Home - 192.168.0.7 [24 vulns] - ENGENEERING-4 - 192.168.10.95 [24 vulns] Quick-check each host first. If the product is not installed or is already at/above the minimum version, stop and escalate to Security as a false positive, including hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression Use if you verified the product exists at a vulnerable version and install/update/uninstall is not viable after preferred methods. If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Try updates in this order: 1. RMM automated patching or software deployment (preferred) 2. ScreenConnect Backstage CMD/PS or command/script (silent installer) 3. Only if 1 and 2 fail: live remote session with the end user for in-app UI updates If this host is a VM, take a pre-update snapshot so you can revert if there are issues. Identify the product from the Product + host list, and confirm it is installed on each host before changing anything. Update/configure to the version listed under Minimum version to reach. Verify the update was successful. If the installer or firmware indicates a reboot or service restart, coordinate with the client first. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - Los Angeles) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - Los Angeles) - Update Required - 3rd party application Product/System: Microsoft .NET (all versions) Location: Agility Retail - Los Angeles Affected Systems Count: 7 Finding summary: Microsoft .NET (all versions) is outdated on the listed hosts. These runtimes update within the same major version. An app built on one major version is tied to that version, so removing it will break the app. Affected Systems: - MOON-DT-3 - 10.0.0.20 [5.0.17] [6 vulns] - moon-dt-acct - 10.0.0.22 [5.0.17] [6 vulns] - MOON-LT-01 - 10.99.0.8 [5.0.17] [6 vulns] - MOON-DT-3 - 10.0.0.20 [6.0.36] [6 vulns] - moon-dt-acct - 10.0.0.22 [6.0.36] [6 vulns] - MOON-LT-01 - 10.99.0.8 [6.0.36] [6 vulns] - JERRYREIS - 10.0.0.29 [6.0.36] [3 vulns] Quick-check each host first. If the redistributable/runtime is not present, or is already at/above the minimum version to reach for that major version, stop and escalate to Security as a false positive, including the hostname and what you found. Otherwise, choose update, remove, or suppress below and document your choice in the ticket. Remediation (pick the most appropriate option): A. Update (usual path when keeping the major version) - Install the updated package for the same major version, to the minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only after dependency testing proves the major version is unused (test machine; uninstall one major version at a time). C. Vulnerable major version is required - escalate to Security for suppression - Dependency testing showed apps need this major version, and it remains (or will remain) vulnerable. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: - .NET Framework and modern .NET (.NET 5+) are not interchangeable. - Update each runtime line via WU/vendor installer; uninstall only when unused and verified. - If this host is a VM, take a pre-update snapshot so you can revert if there are issues. - .NET 5: out of support - uninstall if unused and verified, or escalate cannot-update. - .NET 6: out of support - uninstall if unused and verified, or escalate cannot-update. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft Teams (Agility Retail - E-Comm Cumberland) - Application Update Required
Vulnerability Remediation - Microsoft Teams (Agility Retail - E-Comm Cumberland) - Application Update Required
Product/System: Microsoft Teams
Location: Agility Retail - E-Comm Cumberland
Affected Systems Count: 4
Finding summary:
Microsoft Teams is outdated on the listed hosts. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail.
CVE references:
CVE-2023-4863
https://nvd.nist.gov/vuln/detail/CVE-2023-4863
Vendor advisory:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
Additional CVEs (6 more) are listed in the Client Folder report.
Minimum version to reach:
Update to version 1.08.00.9760 (or the latest available), and update to version 26225.1806.5074.1452 (or the latest available).
Affected Systems:
- DESKTOP-LTES1BM - 192.168.68.51 [7 vulns]
- DESKTOP-3N4U9QE - 10.0.0.69 [7 vulns]
- DESKTOP-RREJ582 - 192.168.0.15 [7 vulns]
- EwaMankowski - 192.168.1.66 [4 vulns]
Quick-check each host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version to reach. Include hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket.
Remediation (pick the most appropriate option):
A. Update (default when still needed)
- Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available).
B. Not needed / not in use - uninstall or remove
- Only if the software should not exist on the host.
C. Cannot update or uninstall - escalate to Security for suppression
- You verified it exists at a vulnerable version, and install/update/uninstall is not viable after preferred methods.
- If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security.
- Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix.
- Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains).
Client coordination - READ BEFORE UPDATING:
If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression.
===== TECHNICAL GUIDANCE (do this) =====
- Confirm the flagged Teams version - Classic is not always the source.
- Classic Teams is sometimes a per-user install:
- A user who has not logged into this workstation in a while, or is not the primary user, can still have Classic leftover.
- Run the RMM Teams Classic cleanup script for those leftover per-user installs.
- Classic/duplicate suspected: R-Security - Teams Classic Cleanup Remediation (Scripts > RR Custom > RR Custom - R-Security Remediation > R-Security - Teams Classic Cleanup Remediation).
- Current Teams behind: use automated patching/RMM first.
- Live user session only if needed: three-dot menu > Settings > About Teams.
- Backstage (CMD/PS): RMM script / installer only - not the Teams UI.
===== END TECHNICAL GUIDANCE =====
Source material:
Full scan exports and Top N reports are in the Client Folder under Reports location below.
Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3
Ticket created by Chris Knospe.Vulnerability Remediation - Microsoft Teams (Agility Retail - Chicago North) - Application Update Required
Vulnerability Remediation - Microsoft Teams (Agility Retail - Chicago North) - Application Update Required Product/System: Microsoft Teams Location: Agility Retail - Chicago North Affected Systems Count: 5 Finding summary: Microsoft Teams is outdated on the listed hosts. Update via RMM or a silent installer in Backstage CMD/PS. Only use a live user session if those methods fail. CVE references: CVE-2023-4863 https://nvd.nist.gov/vuln/detail/CVE-2023-4863 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863 Additional CVEs (6 more) are listed in the Client Folder report. Minimum version to reach: Update to version 26225.1806.5074.1452 (or the latest available). Affected Systems: - Pluto1 - 192.168.9.36 [7 vulns] - SATURN - 192.168.9.37 [7 vulns] - DESKTOP-KHOUJ3K - 172.20.1.181 [7 vulns] - BYT14 - 172.20.10.2 [2 vulns] - LAPTOP-LI5TEO9Q - 192.168.9.52 [2 vulns] Quick-check each host first. If the product is not installed, or is already at/above the minimum version to reach, stop and escalate to Security as a false positive. Include hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression Use this only after you have verified the software exists at a vulnerable version and update/uninstall is not viable after trying the preferred methods. If the product is EOL, check and apply the latest available final build first; if it is being kept, notify the client, then escalate to Security. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. The client must accept or be notified. Record discussion notes to the client, including who, what, hosts, and that risk remains. Client coordination - read before updating: If the update may interrupt a user, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance (do this): Confirm the flagged Teams version - Classic is not always the source. Classic Teams is sometimes a per-user install, so a user who has not logged into this workstation in a while, or is not the primary user, can still have Classic leftover. Run the RMM Teams Classic cleanup script for those leftover per-user installs. If Classic or a duplicate is suspected, use: R-Security - Teams Classic Cleanup Remediation (Scripts > RR Custom > RR Custom - R-Security Remediation > R-Security - Teams Classic Cleanup Remediation). If current Teams is behind, use automated patching/RMM first. Only use a live user session if needed, via the three-dot menu > Settings > About Teams. For Backstage (CMD/PS), use the RMM script/installer only - not the Teams UI. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - E-Comm Cumberland) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - E-Comm Cumberland) - Update Required - 3rd party application Product/System: Microsoft Visual C++ (all versions) Location: Agility Retail - E-Comm Cumberland Affected Systems Count: 7 Finding summary: Microsoft Visual C++ (all versions) is outdated on the listed hosts. These runtimes update within the same major version. An app built on one major version is tied to that version - removing it will break the app. Affected Systems: - DESKTOP-RREJ582 - 192.168.0.15 [11.0.61030] [6 vulns] - DESKTOP-LTES1BM - 192.168.68.51 [11.0.61030] [6 vulns] - DESKTOP-RREJ582 - 192.168.0.15 [12.0.40664] [6 vulns] - DESKTOP-LTES1BM - 192.168.68.51 [12.0.40664] [6 vulns] - AnnaPisanskiDGS - 10.0.0.11 [11.0.61030] [3 vulns] - AnnaPisanskiDGS - 10.0.0.11 [11.0.50522] [3 vulns] - DESKTOP-CENHO7S - 192.168.52.52 [10.0.30319] [1 vulns] Quick-check each host first. If the redistributable/runtime is not present, or is already at/above the minimum version to reach for that major version, stop and escalate to Security as a false positive. Include hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (usual path when keeping the major version) Install the updated package for the same major version to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only after dependency testing proves the major version is unused (test machine; uninstall one major version at a time). C. Vulnerable major version is required - escalate to Security for suppression Dependency testing showed apps need this major version, and it remains (or will remain) vulnerable. Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance (do this): Visual C++ redistributables are side-by-side - do not upgrade everything to the latest year. An app built on one major version is tied to that version - removing it will break the app. Only remove a year if no app is using it. Patch each major version seen below with the matching vc_redist or Windows Update package. If this host is a VM, take a pre-update snapshot so you can revert if there are issues. Verify the update was successful. 2010 (10.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused 2012 (11.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused 2013 (12.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused Source material: Full scan exports and Top N reports are in the Client Folder under Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Adobe InDesign 2024 (Agility Retail - San Diego) - Update Required - 3rd party application
Vulnerability Remediation - Adobe InDesign 2024 (Agility Retail - San Diego) - Update Required - 3rd party application Product/System: Adobe InDesign 2024 Location: Agility Retail - San Diego Affected Systems Count: 1 Finding summary: Adobe InDesign 2024 is outdated on the listed host. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. CVE references: CVE-2024-49507 https://nvd.nist.gov/vuln/detail/CVE-2024-49507 Vendor security center: https://helpx.adobe.com/security.html Additional CVEs (38 more) are listed in the Client Folder report. Minimum version to reach: - Update to version 21.3 (or the latest available). Affected Systems: - PRINTMASTERPC - 192.168.10.137 [39 vulns] Quick-check the host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version to reach. Include the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression - You verified it exists at a vulnerable version, and install/update/uninstall is not viable after preferred methods. - If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Try updates in this order: 1) RMM automated patching or software deployment (preferred) 2) ScreenConnect Backstage CMD/PS or command/script (silent installer) 3) Only if 1 and 2 fail: live remote session with the end user for in-app UI updates If this host is a VM, take a pre-update snapshot so you can revert if there are issues. Identify the product from the Product + host list and confirm it is installed on the host before changing anything. Update/configure to the version listed under Minimum version to reach when present. If no minimum version is listed, use the CVE/product from this ticket plus the vendor security advisory, and document the version applied. Verify the update was successful. If the installer/firmware indicates a reboot or service restart, coordinate with the client first. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Python 3.13.5 (64-bit) (Agility Retail - Corporate Headquarters) - Update Required - 3rd party application
Vulnerability Remediation - Python 3.13.5 (64-bit) (Agility Retail - Corporate Headquarters) - Update Required - 3rd party application Product/System: Python 3.13.5 (64-bit) Location: Agility Retail - Corporate Headquarters Affected Systems Count: 1 Finding summary: Python 3.13.5 (64-bit) is outdated on the listed host. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. CVE references: CVE-2025-13836 https://nvd.nist.gov/vuln/detail/CVE-2025-13836 Vendor security center: https://mail.python.org/archives/list/security-announce@python.org/ Additional CVEs (48 more) are listed in the Client Folder report. Minimum version to reach: - Update to version 3.14.7 (or the latest available). Affected Systems: - JoshDesktop - 192.168.2.54 [49 vulns] Quick-check the host first. If Python is not installed, or is already at/above the minimum version to reach, stop and escalate to Security as a false positive, including the hostname and what you found. Otherwise choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression - You verified it exists at a vulnerable version, and install/update/uninstall is not viable after preferred methods. - If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Confirm which Python major.minor is installed and which apps require it. Update within the same minor line when a patch exists. Python 2.x and old 3.7/3.8 lines are EOL - uninstall if unused after a dependency check. If an EOL line must stay, notify the client, then escalate to Security. Do not jump major/minor without the app vendor. Source material: Full scan exports and Top N reports are in the Client Folder under Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Python 3.13.5 Executables (64-bit) (Agility Retail - Corporate Headquarters) - Update Required - 3rd party application
Vulnerability Remediation - Python 3.13.5 Executables (64-bit) (Agility Retail - Corporate Headquarters) - Update Required - 3rd party application Product/System: Python 3.13.5 Executables (64-bit) Location: Agility Retail - Corporate Headquarters Affected Systems Count: 1 Finding summary: Python 3.13.5 Executables (64-bit) is outdated on the listed host. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those methods fail. CVE references: CVE-2025-13836 https://nvd.nist.gov/vuln/detail/CVE-2025-13836 Vendor security center: https://mail.python.org/archives/list/security-announce@python.org/ Additional CVEs (48 more) are listed in the Client Folder report. Minimum version to reach: - Update to version 3.14.7 (or the latest available). Affected Systems: - JoshDesktop - 192.168.2.54 [49 vulns] Quick-check the host first. If the product is not installed or is already at/above the minimum version, stop and escalate to Security as a false positive, noting the hostname and what you found. Otherwise, choose one of the remediation options below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression - Use only if you verified the software exists at a vulnerable version and update/uninstall is not viable after trying the preferred methods. - If the product is EOL: check for and apply the latest available final build first; if it must remain, notify the client, then escalate to Security. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk remains until a real fix is applied. - The client must accept the risk or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If the update may interrupt a user, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Confirm which Python major.minor version is installed and which apps require it. Update within the same minor line when a patch exists. Python 2.x and old 3.7/3.8 lines are EOL - uninstall if unused, after a dependency check. If an EOL line must stay, notify the client, then escalate to Security. Do not jump major/minor versions without confirming with the app vendor. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Adobe Illustrator 2024 (Agility Retail - San Diego) - Update Required - 3rd party application
Vulnerability Remediation - Adobe Illustrator 2024 (Agility Retail - San Diego) - Update Required - 3rd party application Product/System: Adobe Illustrator 2024 Location: Agility Retail - San Diego Affected Systems Count: 1 Finding summary: Adobe Illustrator 2024 is outdated on the listed host. See the technical guidance below for the update method and order. CVE references: CVE-2025-30330 https://nvd.nist.gov/vuln/detail/CVE-2025-30330 Vendor security center: https://helpx.adobe.com/security.html Additional CVEs (38 more) are listed in the Client Folder report. Minimum version to reach: - Update to version 30.8 (or the latest available). Affected Systems: - PRINTMASTERPC - 192.168.10.137 [39 vulns] Quick-check the host first. If the product is not installed, or is already at/above the minimum version to reach, stop and escalate to Security as a false positive, including the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression - You verified it exists at a vulnerable version, and install/update/uninstall is not viable after preferred methods. - If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - READ BEFORE UPDATING: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server: that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. ===== TECHNICAL GUIDANCE (do this) ===== - Try updates in this order: 1) RMM automated patching or software deployment (preferred) 2) ScreenConnect Backstage CMD/PS or command/script (silent installer) 3) Only if 1 and 2 fail: live remote session with the end user for in-app UI updates - If this host is a VM, take a pre-update snapshot so you can revert if there are issues. - Identify the product from the Product + host list; confirm it is installed on the host before changing anything. - Update/configure to the version listed under Minimum version to reach when present. - If no minimum version is listed: use CVE/product from this ticket + vendor security advisory; document version applied. - Verify the update was successful. - If installer/firmware indicates reboot or service restart: coordinate with client first. ===== END TECHNICAL GUIDANCE ===== Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Foxit PDF Editor (Agility Retail - Los Angeles) - Update Required - 3rd party application
Vulnerability Remediation - Foxit PDF Editor (Agility Retail - Los Angeles) - Update Required - 3rd party application Product/System: Foxit PDF Editor Location: Agility Retail - Los Angeles Affected Systems Count: 1 Finding summary: Foxit PDF Editor is outdated on the listed host. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. CVE references: CVE-2026-91789 https://nvd.nist.gov/vuln/detail/CVE-2026-91789 Vendor security center: https://www.foxit.com/support/security-bulletins.html Additional CVEs (37 more) are listed in the Client Folder report. Minimum version to reach: - Update to version 2026.2.1.39815 (or the latest available). Affected Systems: - Desktop-PF5SCZB - 10.0.0.16 [38 vulns] Quick-check the host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version to reach. Include the hostname and what you found. Otherwise choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression - You verified it exists at a vulnerable version, and install/update/uninstall is not viable after preferred methods. - If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance (do this): - Confirm Foxit PDF Reader vs Foxit PDF Editor on the host. - Update via RMM or the matching Foxit installer. - Do not use Adobe Reader winget IDs for Foxit. - Verify Help > About after update. Source material: Full scan exports and Top N reports are in the Client Folder under the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Speculative Store Bypass (Agility Retail - Boston) - Updates Required - 3rd party application
Vulnerability Remediation - Speculative Store Bypass (Agility Retail - Boston) - 3rd party application Product/System: Speculative Store Bypass Location: Agility Retail - Boston Affected Systems Count: 33 Finding summary: Speculative Store Bypass is a configuration/hardening finding. Correct the listed setting(s) per Technical guidance. CVE reference: CVE-2018-3639 https://nvd.nist.gov/vuln/detail/CVE-2018-3639 Affected Systems: Sorry for the long host list below (33 hosts). Every hostname is on this ticket so you can work it without opening the reports. - AGILITY-AM- - 10.0.1.72 [1 vulns] - Agility-H7-3261 - 10.0.1.93 [1 vulns] - Agility-H7-3262 - 10.0.1.78 [1 vulns] - Agility-H7-3266 - 10.0.1.90 [1 vulns] - Agility-H7-3267 - 10.0.1.65 [1 vulns] - Agility-H7-3268 - 10.0.1.95 [1 vulns] - Agility-H7-3304 - 10.0.1.84 [1 vulns] - Agility-H7-3306 - 10.0.1.63 [1 vulns] - Agility-R5-0253 - 10.0.1.74 [1 vulns] - Agility-TC-000N - 10.0.1.81 [1 vulns] - Agility-TC-00CX - 10.0.1.60 [1 vulns] - Agility-TC-00RZ - 10.0.1.77 [1 vulns] - Agility-TC-00S3 - 10.0.1.75 [1 vulns] - Agility-TC-00SG - 10.0.1.87 [1 vulns] - Agility-TC-00SJ - 10.0.1.85 [1 vulns] - ARG-MSP-Admin - 10.10.4.10 [1 vulns] - AR-MGMT-RR-04 - 10.0.1.76 [1 vulns] - CUSTSERV1-CBPC - 10.0.1.62 [1 vulns] - CUSTSERV2-DSPC - 10.0.1.82 [1 vulns] - CUSTSERV3-SLPC - 10.0.1.88 [1 vulns] - DESKTOP-E32TV1A - 192.168.52.27 [1 vulns] - DESKTOP-GUKI3V9 - 192.168.4.133 [1 vulns] - DESKTOP-HLD5C2T - 10.0.5.4 [1 vulns] - LAPTOP-2TN7SKFJ - 192.168.2.10 [1 vulns] - LAPTOP-4GNJ03P4 - 192.168.1.175 [1 vulns] - LAPTOP-768965L7 - 192.168.1.71 [1 vulns] - LAPTOP-8HSVAPMI - 10.0.1.54 [1 vulns] - LAPTOP-D7HGG20H - 10.0.0.34 [1 vulns] - LAPTOP-LU45RTS5 - 10.99.0.9 [1 vulns] - LAPTOP-PI88L0PE - 192.168.1.107 [1 vulns] - LAPTOP-QAQ1LMU0 - 192.168.0.107 [1 vulns] - LAPTOP-SHJTQ6VH - 10.0.0.112 [1 vulns] - Tom - 192.168.1.121 [1 vulns] Before acting: quick-check each host/domain. If the configuration is already correct or the finding does not apply, stop and escalate to Security as a false positive, with details of what you checked. Otherwise, pick one remediation option below and document your choice on the ticket. Remediation options: A. Correct the configuration (default) - apply the setting change per Technical guidance. B. Finding does not apply - escalate false positive. Document what you checked; Security suppresses if appropriate. C. Client will not or cannot change - escalate to Security for suppression. - Record the client's notification/acceptance in discussion notes. - Suppression only stops tracking; it does not patch or remove the vulnerability. Residual risk remains until a real fix is applied. - The client must accept or be notified. Record who was notified, what was discussed, which hosts are affected, and that risk remains. Client coordination - read before changing: If this change may affect access, authentication, mail/DNS, or security posture, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must make the change. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Speculative Store Bypass (CVE-2018-3639) is a Windows CPU-mitigation registry setting, not a software install. - Apply the latest Windows quality/security updates first - the registry setting does nothing without those KBs. - Enable the OS mitigation at: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management - If FeatureSettingsOverride is missing, set FeatureSettingsOverride=8 and FeatureSettingsOverrideMask=3. - If Override already has a value, add bit 8 (SSB) per Microsoft KB4072698. Do not wipe other Spectre bits already in use. - Prefer domain GPO (or Intune) over one-off registry edits. - Reboot, then verify with: Install-Module SpeculationControl; Get-SpeculationControlSettings - If the system is already patched and mitigations show enabled, escalate to Security as a false positive with hostname, build, and the cmdlet output, then stop. - These mitigations can slow a busy server - discuss with the client if users will notice. - Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-3639 Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Mozilla Firefox (Agility Retail - Minneapolis) - Update Required - 3rd party application
Vulnerability Remediation - Mozilla Firefox (Agility Retail - Minneapolis) - Update Required - 3rd party application Product/System: Mozilla Firefox Location: Agility Retail - Minneapolis Affected Systems Count: 2 Finding summary: Mozilla Firefox is outdated on the listed hosts. Prefer RMM, the vendor updater, or Backstage CMD/PS. This app often updates in the background, so a live user session is usually not needed and a reboot is usually not required. CVE references: CVE-2011-3389 https://nvd.nist.gov/vuln/detail/CVE-2011-3389 Vendor security center: https://www.mozilla.org/en-US/security/advisories/ Additional CVEs (1 more) are listed in the Client Folder report. Minimum version to reach: Update to version 156.0.1 (or the latest available). Affected Systems: - AleshireEng - 192.168.1.101 [2 vulns] - JordanEngineer - 192.168.1.103 [2 vulns] Quick-check each host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version to reach. Include hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) Update the app to the version listed under Minimum version to reach (or the latest available) via vendor updater, RMM, or Backstage CMD/PS. Relaunch the app if an update downloaded but did not apply. B. Not needed / not in use - uninstall or remove Only if the app is not required on that host (confirm site standard / client). C. Cannot reach a secure release - escalate to Security for suppression Typical case: OS cannot support the secure release, or update is blocked after RMM/Backstage CMD/PS/live-session attempts. If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. You verified the app is present at a vulnerable version. Do not use suppress for ordinary update failures - finish preferred methods or escalate troubleshooting first. Suppression only stops tracking; it does not patch or remove the vulnerability, and residual risk stays until a real fix. Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance (do this): Try updates in this order: 1) RMM automated patching or software deployment (preferred), 2) ScreenConnect Backstage CMD/PS or command/script (silent installer), 3) only if 1 and 2 fail, a live remote session with the end user for in-app UI updates. If this host is a VM, take a pre-update snapshot so you can revert if there are issues. Firefox updates in the background, so a relaunch may be needed to apply a downloaded update. If still behind, check Firefox update settings / Maintenance Service. ESR and release can both be present - update the channel that is installed. Verify the update was successful. Source material: Full scan exports and Top N reports are in the Client Folder under the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Speculative Store Bypass (Agility Retail - Minneapolis) - Updates Required - 3rd party application
Vulnerability Remediation - Speculative Store Bypass (Agility Retail - Minneapolis) - Configuration Change Required - 3rd party application
Product/System: Speculative Store Bypass
Location: Agility Retail - Minneapolis
Affected Systems Count: 31
Finding summary:
Speculative Store Bypass is a configuration / hardening finding.
Correct the listed setting(s) per Technical guidance.
CVE references:
CVE-2018-3639
https://nvd.nist.gov/vuln/detail/CVE-2018-3639
Affected Systems:
Sorry for the long host list below (31 hosts). Every hostname is on this ticket so you can work it without opening the reports.
- 10.10.12.13 [1 vulns]
- AleshireEng - 192.168.1.101 [1 vulns]
- AndyZauftLenovo - 10.10.12.5 [1 vulns]
- AR-MGMT-RR-09 - 192.168.1.9 [1 vulns]
- InfinityIT - 192.168.2.28 [1 vulns]
- JordanEngineer - 192.168.1.103 [1 vulns]
- Kiosk-01251 - 10.10.12.123 [1 vulns]
- Kiosk-60946 - 10.10.12.136 [1 vulns]
- KnufThinkBook - 10.10.12.23 [1 vulns]
- LAPTOP-191H8K8O - 192.168.2.12 [1 vulns]
- LAPTOP-594KP8JU - 10.10.12.6 [1 vulns]
- LAPTOP-77G99LOQ - 10.10.12.130 [1 vulns]
- LAPTOP-98P2V02G - 192.168.2.8 [1 vulns]
- LAPTOP-AEVF2R0P - 192.168.2.29 [1 vulns]
- LAPTOP-BP6PC05F - 10.10.12.31 [1 vulns]
- LAPTOP-E5A1CAJI - 10.10.12.128 [1 vulns]
- LAPTOP-MEC30P6A - 10.10.12.15 [1 vulns]
- L-Len-21FE00-- - 192.168.2.19 [1 vulns]
- L-Len-21FV002-- - 192.168.2.22 [1 vulns]
- L-Len-PF466A5E - 192.168.2.23 [1 vulns]
- L-Len-PF5AY1ES - 192.168.2.24 [1 vulns]
- L-Len-PF5AY1LH - 192.168.2.18 [1 vulns]
- L-Len-PF5RJVJT - 192.168.2.9 [1 vulns]
- L-Len-PF5RLK1E - 192.168.2.3 [1 vulns]
- L-LEN-PF5V3QDM - 192.168.1.109 [1 vulns]
- L-LEN-PF5Z83HP - 192.168.2.25 [1 vulns]
- RyanSaverine - 192.168.2.2 [1 vulns]
- Shared-49339 - 192.168.1.19 [1 vulns]
- Shared-53052 - 10.10.12.34 [1 vulns]
- Shared-57887 - 192.168.2.6 [1 vulns]
- Shared-76323 - 192.168.1.21 [1 vulns]
IP-only host (no hostname) - identify it before remediating:
- Ping the IP to confirm it is online
- Connect to the site network (VPN, ScreenConnect jump host, or on-site) if you cannot reach it from the usual tools
- Check DHCP (lease, reservation, MAC) for a name
- Look up the IP in RMM, ScreenConnect, Liongard, AD, DNS (reverse lookup), firewall, and switch/ARP
- If still unknown: run a network scan from a trusted site host (do not scan from the internet)
- Record the hostname (or device type) on the ticket before remediating
- If the IP is offline, unused, or not this client: document what you checked and escalate to Security as a false positive
Quick-check each host/domain first.
Then stop (escalate to Security as a false positive) if the configuration is already correct or the finding does not apply.
Include details.
Otherwise choose change, false positive, or suppress below and document it in the ticket.
Remediation (pick the most appropriate option):
A. Correct the configuration (default)
- Apply the setting change in Technical guidance.
B. Finding does not apply - escalate false positive
- Document what you checked; Security suppresses if appropriate.
C. Client will not change / cannot change - escalate to Security for suppression
- Record client notification/acceptance in discussion notes to the client.
- Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix.
- Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains).
Client coordination - READ BEFORE CHANGING:
If this change may affect access, authentication, mail/DNS, or security posture:
schedule after hours or contact the client first.
If another vendor manages this application, device, workstation, or server: that vendor or the service owner must make the change. If they are unable or unwilling, escalate to Security for suppression.
===== TECHNICAL GUIDANCE (do this) =====
- Speculative Store Bypass (CVE-2018-3639) is a Windows CPU-mitigation registry setting - not a software install
- Apply latest Windows quality/security updates first - the registry does nothing without those KBs
- Enable the OS mitigation: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
- If FeatureSettingsOverride is missing: set FeatureSettingsOverride=8 and FeatureSettingsOverrideMask=3
- If Override already has a value: add bit 8 (SSB) per Microsoft KB4072698 - do not wipe other Spectre bits already in use
- Prefer domain GPO (or Intune) over one-off registry edits
- Reboot, then verify: Install-Module SpeculationControl; Get-SpeculationControlSettings
- If already patched and mitigations show enabled: escalate to Security as a false positive with hostname, build, and the cmdlet output - then stop
- These mitigations can slow a busy server - discuss with the client if users will notice
- Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-3639
===== END TECHNICAL GUIDANCE =====
Source material:
Full scan exports and Top N reports are in the Client Folder under Reports location below.
Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3
Vulnerability Remediation - CVE-2023-38408 (Agility Retail - Minneapolis) - Investigate and Resolve - 3rd party application
Vulnerability Remediation - CVE-2023-38408 (Agility Retail - Minneapolis) - Investigate and Resolve - 3rd party application Product/System: CVE-2023-38408 Location: Agility Retail - Minneapolis Affected Systems Count: 1 Finding summary: CVE-2023-38408 is a CVE-only finding - the scan did not clearly name an installed product. Identify the real vulnerable component on the listed host before choosing update, uninstall, or suppress. CVE references: CVE-2023-38408 https://nvd.nist.gov/vuln/detail/CVE-2023-38408 Vendor advisory: http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html Affected Systems: - mosaic-al56-static-178 - 173.248.56.178 [1 vulns] Quick-check the host first. Identify the real product or firmware that matches this CVE before remediating, and include the hostname and what you found. If the CVE does not apply or the component is not present, stop and escalate to Security as a false positive. Otherwise, choose one of the following and document it in the ticket: A. Update (default once the component is identified and still needed) After identifying the product/firmware, update to the version listed under Minimum version to reach (or the latest available), or follow the vendor advisory for that exact product line. B. Not needed / not in use - uninstall or remove Only after the component is identified and confirmed that it should not exist on the host. C. Cannot remediate after identification - escalate to Security for suppression Use only if the component is identified at a vulnerable version and update/uninstall is not viable. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. The client must accept or be notified; record discussion notes (who, what, hosts, and that risk remains). Client coordination - read before updating: Once the component is identified, if the change may interrupt a user or service, schedule after hours or contact the client first. If another vendor manages the identified application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: For this CVE-only finding, identify the vulnerable component on the host before remediating. Check the Product/minimum version on this ticket, installed programs, services, and the scan export detail in the Client Folder under the Reports location below. Once identified, apply the version listed under Minimum version to reach when present, or follow the vendor advisory for that product line. If the host is a VM, take a pre-update snapshot so you can revert if there are issues. Verify the update was successful and note the product and version in the ticket. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - WinVerifyTrust Signature Validation Vulnerability (Agility Retail - Chicago - Cicero) - Configuration Change Required
Vulnerability Remediation - WinVerifyTrust Signature Validation Vulnerability (Agility Retail - Chicago - Cicero) - Configuration Change Required Product/System: WinVerifyTrust Signature Validation Vulnerability Location: Agility Retail - Chicago - Cicero Affected Systems Count: 28 Finding summary: WinVerifyTrust Signature Validation Vulnerability is a configuration/hardening finding. Correct the listed setting(s) per Technical guidance. CVE references: CVE-2013-3900 https://nvd.nist.gov/vuln/detail/CVE-2013-3900 Affected Systems: Sorry for the long host list below (28 hosts). Every hostname is on this ticket so you can work it without opening the reports. - AR-Cicero-01 - 192.168.2.53 [1 vulns] - AR-Cicero-02 - 192.168.2.68 [1 vulns] - AR-Cicero-03 - 192.168.2.51 [1 vulns] - AR-Cicero-04 - 192.168.2.90 [1 vulns] - AR-Cicero-05 - 192.168.2.72 [1 vulns] - AR-Cicero-06 - 192.168.72.37 [1 vulns] - AR-Cicero-07 - 192.168.2.87 [1 vulns] - AR-Cicero-08 - 192.168.2.67 [1 vulns] - AR-Cicero-09 - 192.168.2.84 [1 vulns] - ARG - 192.168.1.113 [1 vulns] - AR-MGMT-RR-03 - 192.168.2.85 [1 vulns] - BrianP - 192.168.60.117 [1 vulns] - DESKTOP-0G11K9F - 192.168.2.55 [1 vulns] - DESKTOP-5M62Q7P - 192.168.2.88 [1 vulns] - DESKTOP-A17DOU5 - 192.168.2.80 [1 vulns] - DESKTOP-DR40DIH - 192.168.2.59 [1 vulns] - DESKTOP-IG37GOT - 192.168.2.81 [1 vulns] - DESKTOP-JBKUHND - 192.168.1.70 [1 vulns] - DESKTOP-LJANK6I - 192.168.2.76 [1 vulns] - DESKTOP-OBI4EA8 - 192.168.2.63 [1 vulns] - DESKTOP-RBJIB4E - 192.168.4.157 [1 vulns] - DGSRAFA - 192.168.72.27 [1 vulns] - LAPTOP-1ON9DL5T - 192.168.2.52 [1 vulns] - LAPTOP-67TGIKRE - 10.0.0.168 [1 vulns] - LAPTOP-AMEDNSI7 - 192.168.4.22 [1 vulns] - LAPTOP-EPL7RODK - 10.14.101.121 [1 vulns] - LAPTOP-JK3JBCVL - 192.168.72.19 [1 vulns] - LAPTOP-UN4OVI86 - 192.168.4.159 [1 vulns] Instructions: Quick-check each host first. If the configuration is already correct or the finding does not apply, stop and escalate to Security as a false positive, including details of what you checked. Otherwise, choose one of the remediation options below and document your choice in the ticket. Remediation options (pick the most appropriate): A. Correct the configuration (default) - apply the setting change in Technical guidance. B. Finding does not apply - escalate as a false positive. Document what you checked; Security will suppress if appropriate. C. Client will not or cannot change - escalate to Security for suppression. Record client notification/acceptance in discussion notes (who, what, hosts, and that risk remains). Note that suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. Client coordination - read before changing: If this change may affect access, authentication, mail/DNS, or security posture, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must make the change. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: WinVerifyTrust / CVE-2013-3900 is Authenticode hardening, not a software install or Windows Update. - Set EnableCertPaddingCheck=1 under HKLM\Software\Microsoft\Cryptography\Wintrust\Config - On 64-bit hosts, also set the Wow6432Node\...\Wintrust\Config copy - Prefer domain GPO (or Intune) over one-off registry edits - Verify signed installers and vendor tools still launch after the change - Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900 Source material: Full scan exports and Top N reports are in the Client Folder at the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - WinVerifyTrust Signature Validation Vulnerability (Agility Retail - Minneapolis) - Configuration Change Required
Vulnerability Remediation - WinVerifyTrust Signature Validation Vulnerability (Agility Retail - Minneapolis) - Configuration Change Required
Product/System: WinVerifyTrust Signature Validation Vulnerability
Location: Agility Retail - Minneapolis
Affected Systems Count: 28
Finding summary:
WinVerifyTrust Signature Validation Vulnerability is a configuration / hardening finding.
Correct the listed setting(s) per Technical guidance.
CVE references:
CVE-2013-3900
https://nvd.nist.gov/vuln/detail/CVE-2013-3900
Affected Systems:
Sorry for the long host list below (28 hosts). Every hostname is on this ticket so you can work it without opening the reports.
- 10.10.12.13 [1 vulns]
- AleshireEng - 192.168.1.101 [1 vulns]
- AndyZauftLenovo - 10.10.12.5 [1 vulns]
- AR-MGMT-RR-09 - 192.168.1.9 [1 vulns]
- InfinityIT - 192.168.2.28 [1 vulns]
- JordanEngineer - 192.168.1.103 [1 vulns]
- KnufThinkBook - 10.10.12.23 [1 vulns]
- LAPTOP-191H8K8O - 192.168.2.12 [1 vulns]
- LAPTOP-594KP8JU - 10.10.12.6 [1 vulns]
- LAPTOP-77G99LOQ - 10.10.12.130 [1 vulns]
- LAPTOP-98P2V02G - 192.168.2.8 [1 vulns]
- LAPTOP-AEVF2R0P - 192.168.2.29 [1 vulns]
- LAPTOP-BP6PC05F - 10.10.12.31 [1 vulns]
- LAPTOP-E5A1CAJI - 10.10.12.128 [1 vulns]
- LAPTOP-MEC30P6A - 10.10.12.15 [1 vulns]
- L-Len-21FE00-- - 192.168.2.19 [1 vulns]
- L-Len-21FV002-- - 192.168.2.22 [1 vulns]
- L-Len-PF466A5E - 192.168.2.23 [1 vulns]
- L-Len-PF5AY1ES - 192.168.2.24 [1 vulns]
- L-Len-PF5AY1LH - 192.168.2.18 [1 vulns]
- L-Len-PF5RJVJT - 192.168.2.9 [1 vulns]
- L-Len-PF5RLK1E - 192.168.2.3 [1 vulns]
- L-LEN-PF5V3QDM - 192.168.1.109 [1 vulns]
- L-LEN-PF5Z83HP - 192.168.2.25 [1 vulns]
- Shared-49339 - 192.168.1.19 [1 vulns]
- Shared-53052 - 10.10.12.34 [1 vulns]
- Shared-57887 - 192.168.2.6 [1 vulns]
- Shared-76323 - 192.168.1.21 [1 vulns]
IP-only host (no hostname) - identify it before remediating:
- Ping the IP to confirm it is online
- Connect to the site network (VPN, ScreenConnect jump host, or on-site) if you cannot reach it from the usual tools
- Check DHCP (lease, reservation, MAC) for a name
- Look up the IP in RMM, ScreenConnect, Liongard, AD, DNS (reverse lookup), firewall, and switch/ARP
- If still unknown: run a network scan from a trusted site host (do not scan from the internet)
- Record the hostname (or device type) on the ticket before remediating
- If the IP is offline, unused, or not this client: document what you checked and escalate to Security as a false positive
Quick-check each host/domain first.
Then stop (escalate to Security as a false positive) if the configuration is already correct or the finding does not apply.
Include details.
Otherwise choose change, false positive, or suppress below and document it in the ticket.
Remediation (pick the most appropriate option):
A. Correct the configuration (default)
- Apply the setting change in Technical guidance.
B. Finding does not apply - escalate false positive
- Document what you checked; Security suppresses if appropriate.
C. Client will not change / cannot change - escalate to Security for suppression
- Record client notification/acceptance in discussion notes to the client.
- Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix.
- Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains).
Client coordination - READ BEFORE CHANGING:
If this change may affect access, authentication, mail/DNS, or security posture:
schedule after hours or contact the client first.
If another vendor manages this application, device, workstation, or server: that vendor or the service owner must make the change. If they are unable or unwilling, escalate to Security for suppression.
===== TECHNICAL GUIDANCE (do this) =====
- WinVerifyTrust / CVE-2013-3900 is Authenticode hardening - not a software install or Windows Update
- Set EnableCertPaddingCheck=1 under HKLM\Software\Microsoft\Cryptography\Wintrust\Config
- On 64-bit hosts also set the Wow6432Node\...\Wintrust\Config copy
- Prefer domain GPO (or Intune) over one-off registry edits
- Verify signed installers and vendor tools still launch after the change
- Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900
===== END TECHNICAL GUIDANCE =====
Source material:
Full scan exports and Top N reports are in the Client Folder under Reports location below.
Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3
Vulnerability Remediation - Speculative Store Bypass (Agility Retail - Chicago - Cicero) - Updates Required - 3rd party application
Vulnerability Remediation - Speculative Store Bypass (Agility Retail - Chicago - Cicero) - Configuration Change Required - 3rd party application Product/System: Speculative Store Bypass Location: Agility Retail - Chicago - Cicero Affected Systems Count: 30 Finding summary: Speculative Store Bypass is a configuration/hardening finding. Correct the listed setting(s) per Technical guidance. CVE references: CVE-2018-3639 https://nvd.nist.gov/vuln/detail/CVE-2018-3639 Affected Systems: Sorry for the long host list below (30 hosts). Every hostname is on this ticket so you can work it without opening the reports. - AR-Cicero-01 - 192.168.2.53 [1 vulns] - AR-Cicero-02 - 192.168.2.68 [1 vulns] - AR-Cicero-03 - 192.168.2.51 [1 vulns] - AR-Cicero-04 - 192.168.2.90 [1 vulns] - AR-Cicero-05 - 192.168.2.72 [1 vulns] - AR-Cicero-06 - 192.168.72.37 [1 vulns] - AR-Cicero-07 - 192.168.2.87 [1 vulns] - AR-Cicero-08 - 192.168.2.67 [1 vulns] - AR-Cicero-09 - 192.168.2.84 [1 vulns] - AR-Cicero-10 - 192.168.2.61 [1 vulns] - ARG - 192.168.1.113 [1 vulns] - AR-MGMT-RR-03 - 192.168.2.85 [1 vulns] - BrianP - 192.168.60.117 [1 vulns] - DESKTOP-0G11K9F - 192.168.2.55 [1 vulns] - DESKTOP-5M62Q7P - 192.168.2.88 [1 vulns] - DESKTOP-A17DOU5 - 192.168.2.80 [1 vulns] - DESKTOP-DR40DIH - 192.168.2.59 [1 vulns] - DESKTOP-IG37GOT - 192.168.2.81 [1 vulns] - DESKTOP-JBKUHND - 192.168.1.70 [1 vulns] - DESKTOP-JV036S2 - 192.168.4.151 [1 vulns] - DESKTOP-LJANK6I - 192.168.2.76 [1 vulns] - DESKTOP-OBI4EA8 - 192.168.2.63 [1 vulns] - DESKTOP-RBJIB4E - 192.168.4.157 [1 vulns] - DGSRAFA - 192.168.72.27 [1 vulns] - LAPTOP-1ON9DL5T - 192.168.2.52 [1 vulns] - LAPTOP-67TGIKRE - 10.0.0.168 [1 vulns] - LAPTOP-AMEDNSI7 - 192.168.4.22 [1 vulns] - LAPTOP-EPL7RODK - 10.14.101.121 [1 vulns] - LAPTOP-JK3JBCVL - 192.168.72.19 [1 vulns] - LAPTOP-UN4OVI86 - 192.168.4.159 [1 vulns] Before making any change, quick-check each host. If the configuration is already correct or the finding does not apply, stop and escalate to Security as a false positive, with details of what you checked. Otherwise, pick one of the remediation options below and document it in the ticket. Remediation (pick the most appropriate option): A. Correct the configuration (default) - Apply the setting change in Technical guidance. B. Finding does not apply - escalate false positive - Document what you checked; Security suppresses if appropriate. C. Client will not change/cannot change - escalate to Security for suppression - Record client notification/acceptance in discussion notes to the client. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before changing: If this change may affect access, authentication, mail/DNS, or security posture, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must make the change. If they are unable or unwilling, escalate to Security for suppression. ===== TECHNICAL GUIDANCE (do this) ===== Speculative Store Bypass (CVE-2018-3639) is a Windows CPU-mitigation registry setting, not a software install. - Apply the latest Windows quality/security updates first. The registry setting does nothing without those KBs. - Enable the OS mitigation at: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management - If FeatureSettingsOverride is missing: set FeatureSettingsOverride=8 and FeatureSettingsOverrideMask=3 - If Override already has a value: add bit 8 (SSB) per Microsoft KB4072698. Do not wipe other Spectre bits already in use. - Prefer domain GPO (or Intune) over one-off registry edits. - Reboot, then verify: Install-Module SpeculationControl; Get-SpeculationControlSettings - If already patched and mitigations show enabled: escalate to Security as a false positive with hostname, build, and the cmdlet output, then stop. - These mitigations can slow a busy server. Discuss with the client if users will notice. - Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-3639 ===== END TECHNICAL GUIDANCE ===== Source material: Full scan exports and Top N reports are in the Client Folder under Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Python 3.14.5 Executables (64-bit) (Agility Retail - Chicago - Cicero) - Update Required - 3rd party application
Vulnerability Remediation - Python 3.14.5 Executables (64-bit) (Agility Retail - Chicago - Cicero) - Update Required - 3rd party application Product/System: Python 3.14.5 Executables (64-bit) Location: Agility Retail - Chicago - Cicero Affected Systems Count: 2 Finding summary: Python 3.14.5 Executables (64-bit) is outdated on the listed hosts. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. CVE references: CVE-2026-11940 https://nvd.nist.gov/vuln/detail/CVE-2026-11940 Vendor security center: https://mail.python.org/archives/list/security-announce@python.org/ Additional CVEs (19 more) are listed in the Client Folder report. Minimum version to reach: - Update to version 3.14.7 (or the latest available). Affected Systems: - LAPTOP-67TGIKRE - 10.0.0.168 [20 vulns] - LAPTOP-EPL7RODK - 10.14.101.121 [20 vulns] Quick-check each host first. If the product is not installed or is already at/above the minimum version to reach, stop and escalate to Security as a false positive, including hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression - You verified it exists at a vulnerable version, and install/update/uninstall is not viable after preferred methods. - If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Confirm which Python major.minor is installed and which apps require it. Update within the same minor line when a patch exists. Python 2.x and old 3.7/3.8 lines are EOL - uninstall if unused after a dependency check. If an EOL line must stay, notify the client, then escalate to Security. Do not jump major/minor without the app vendor. Source material: Full scan exports and Top N reports are in the Client Folder under Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - Minneapolis) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - Minneapolis) - Update Required - 3rd party application Product/System: Microsoft Visual C++ (all versions) Location: Agility Retail - Minneapolis Affected Systems Count: 10 Finding summary: Microsoft Visual C++ (all versions) is outdated on the listed hosts. These runtimes update within the same major version. An app built on one major version is tied to that version - removing it will break the app. Affected Systems: - L-Len-PF466A5E - 192.168.2.23 [11.0.61030] [6 vulns] - L-Len-PF466A5E - 192.168.2.23 [12.0.40664] [6 vulns] - AleshireEng - 192.168.1.101 [11.0.61030] [3 vulns] - L-Len-PF466A5E - 192.168.2.23 [10.0.40219] [2 vulns] - AleshireEng - 192.168.1.101 [10.0.40219] [1 vulns] - L-LEN-PF5V3QDM - 192.168.1.109 [9.0.30729.17] [1 vulns] - L-LEN-PF5V3QDM - 192.168.1.109 [9.0.30729.6161] [1 vulns] - RyanSaverine - 192.168.2.2 [10.0.40219] [1 vulns] - L-Len-PF466A5E - 192.168.2.23 [9.0.30729.17] [1 vulns] - L-Len-PF466A5E - 192.168.2.23 [9.0.30729.6161] [1 vulns] Before remediating, quick-check each host. If the redistributable/runtime is not present, or is already at or above the minimum version to reach for that major version, stop and escalate to Security as a false positive. Include hostnames and what you found. Otherwise, choose one of the remediation options below and document it in the ticket. Remediation options (pick the most appropriate one): A. Update (usual path when keeping the major version) Install the updated package for the same major version, to the minimum version to reach for that major version (or the latest available). B. Not needed / not in use - uninstall or remove Only after dependency testing proves the major version is unused. Test on a test machine, and uninstall one major version at a time. C. Vulnerable major version is required - escalate to Security for suppression Use this when dependency testing shows apps need this major version and it remains (or will remain) vulnerable. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk stays until a real fix is applied. The client must accept or be notified. Record discussion notes to the client, including who, what, hosts, and that risk remains. Client coordination - read before updating: If the update may interrupt a user, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Visual C++ redistributables are side-by-side - do not upgrade everything to the latest year. An app built on one major version is tied to that version, so removing it will break the app. Only remove a year if no app is using it. Patch each major version seen below with the matching vc_redist or Windows Update package. If the host is a VM, take a pre-update snapshot so you can revert if there are issues. Verify the update was successful after patching. - 2008 (9.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused - 2010 (10.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused - 2012 (11.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused - 2013 (12.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused Source material: Full scan exports and Top N reports are in the Client Folder, at the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - WinVerifyTrust Signature Validation Vulnerability (Agility Retail - E-Comm Cumberland) - Configuration Change Required
Vulnerability Remediation - WinVerifyTrust Signature Validation Vulnerability (Agility Retail - E-Comm Cumberland) - Configuration Change Required Product/System: WinVerifyTrust Signature Validation Vulnerability Location: Agility Retail - E-Comm Cumberland Affected Systems Count: 23 Finding summary: WinVerifyTrust Signature Validation Vulnerability is a configuration/hardening finding. Correct the listed setting(s) per Technical guidance. CVE references: CVE-2013-3900 https://nvd.nist.gov/vuln/detail/CVE-2013-3900 Affected Systems: Sorry for the long host list below (23 hosts). Every hostname is on this ticket so you can work it without opening the reports. - alma - 192.168.1.169 [1 vulns] - AnnaPisanskiDGS - 10.0.0.11 [1 vulns] - AR-MGMT-RR-02 - 192.168.0.41 [1 vulns] - DELL-DGS43-MK.cormarkinc - 192.168.4.81 [1 vulns] - DESKTOP-3N4U9QE - 10.0.0.69 [1 vulns] - DESKTOP-CENHO7S - 192.168.52.52 [1 vulns] - DESKTOP-LTES1BM - 192.168.68.51 [1 vulns] - DESKTOP-M8ICQCG - 10.0.0.127 [1 vulns] - DESKTOP-PJRUCQG - 10.0.0.82 [1 vulns] - DESKTOP-RREJ582 - 192.168.0.15 [1 vulns] - DESKTOP-ULFPN40 - 192.168.0.159 [1 vulns] - ERIKALUSTER - 10.0.0.62 [1 vulns] - FarrahBradley - 10.0.0.204 [1 vulns] - GABRIELLAGARCIA - 10.0.0.98 [1 vulns] - LAPTOP-PF5SCZGS - 192.168.50.162 [1 vulns] - LAPTOP-PF5SGD86 - 192.168.82.2 [1 vulns] - M-Bartczak - 10.0.0.195 [1 vulns] - MELISSAFIORITA - 192.168.1.55 [1 vulns] - MICHAELKEATING - 192.168.0.39 [1 vulns] - RebeccaByron - 192.168.12.136 [1 vulns] - SherylMendoza - 10.0.0.170 [1 vulns] - TiffanyBlack - 10.0.0.61 [1 vulns] - win-eael5m09bfk - 10.0.0.65 [1 vulns] Before making any change, quick-check each host/domain. If the configuration is already correct or the finding does not apply, stop and escalate to Security as a false positive, including the details of what you checked. Otherwise, pick one of the following and document your choice in the ticket: A. Correct the configuration (default) - apply the setting change in Technical guidance. B. Finding does not apply - escalate false positive. Document what you checked; Security will suppress if appropriate. C. Client will not or cannot change - escalate to Security for suppression. Record the client notification/acceptance in discussion notes to the client (who, what, hosts affected, and that risk remains). Note that suppression only stops tracking; it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. Client coordination - read before changing: If this change may affect access, authentication, mail/DNS, or security posture, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must make the change. If they are unable or unwilling, escalate to Security for suppression. Technical guidance (do this): WinVerifyTrust/CVE-2013-3900 is Authenticode hardening, not a software install or Windows Update. - Set EnableCertPaddingCheck=1 under HKLM\Software\Microsoft\Cryptography\Wintrust\Config - On 64-bit hosts, also set the Wow6432Node\...\Wintrust\Config copy - Prefer domain GPO (or Intune) over one-off registry edits - Verify signed installers and vendor tools still launch after the change - Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900 Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Mozilla Firefox (Agility Retail - E-Comm Cumberland) - Update Required - 3rd party application
Vulnerability Remediation - Mozilla Firefox (Agility Retail - E-Comm Cumberland) - Update Required - 3rd party application Product/System: Mozilla Firefox Location: Agility Retail - E-Comm Cumberland Affected Systems Count: 1 Finding summary: Mozilla Firefox is outdated on the listed host. Prefer RMM, the vendor updater, or Backstage CMD/PS, since this app often updates in the background. A live user session is usually not needed, and a reboot is usually not required. CVE references: CVE-2026-84134 https://nvd.nist.gov/vuln/detail/CVE-2026-84134 Vendor security center: https://www.mozilla.org/en-US/security/advisories/ Additional CVEs (103 more) are listed in the Client Folder report. Minimum version to reach: - Update to version 156.0.1 (or the latest available). Affected Systems: - DESKTOP-RREJ582 - 192.168.0.15 [104 vulns] Quick-check the host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version to reach - include the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - Update the app to the version listed under Minimum version to reach (or the latest available) via vendor updater, RMM, or Backstage CMD/PS. - Relaunch the app if an update downloaded but did not apply. B. Not needed / not in use - uninstall or remove - Only if the app is not required on that host (confirm site standard / client). C. Cannot reach a secure release - escalate to Security for suppression - Typical case: OS cannot support the secure release, or update is blocked after RMM/Backstage CMD/PS/live-session attempts. - If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. - You verified the app is present at a vulnerable version. - Do not use suppress for ordinary update failures - finish preferred methods or escalate troubleshooting first. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Try updates in this order: 1) RMM automated patching or software deployment (preferred) 2) ScreenConnect Backstage CMD/PS or command/script (silent installer) 3) Only if 1 and 2 fail: live remote session with the end user for in-app UI updates If this host is a VM, take a pre-update snapshot so you can revert if there are issues. Firefox updates in the background, so a relaunch may be needed to apply a downloaded update. If still behind, check Firefox update settings / Maintenance Service. ESR and release can both be present, so update the channel that is installed. Verify the update was successful. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft Teams (Agility Retail - Los Angeles) - Application Update Required
Vulnerability Remediation - Microsoft Teams (Agility Retail - Los Angeles) - Application Update Required Product/System: Microsoft Teams Location: Agility Retail - Los Angeles Affected Systems Count: 3 Finding summary: Microsoft Teams is outdated on the listed hosts. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. CVE references: CVE-2023-4863 https://nvd.nist.gov/vuln/detail/CVE-2023-4863 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863 Additional CVEs (6 more) are listed in the Client Folder report. Minimum version to reach: - Classic Teams: update to version 1.08.00.9760 (or the latest available). - New Teams: update to version 26225.1806.5074.1452 (or the latest available). Affected Systems: - Moon-Fabrication - 10.0.0.50 [7 vulns] - MOON-DT-3 - 10.0.0.20 [4 vulns] - vinyl-PC.moonmfg - 10.0.0.30 [2 vulns] Quick-check each host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version to reach. Include hostnames and what you found. Otherwise choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression - You verified it exists at a vulnerable version, and install/update/uninstall is not viable after preferred methods. - If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - READ BEFORE UPDATING: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: - Confirm the flagged Teams version. Classic is not always the source. - Classic Teams is sometimes a per-user install. A user who has not logged into this workstation in a while, or is not the primary user, can still have Classic leftover. Run the RMM Teams Classic cleanup script for those leftover per-user installs. - Classic/duplicate suspected: R-Security - Teams Classic Cleanup Remediation (Scripts > RR Custom > RR Custom - R-Security Remediation > R-Security - Teams Classic Cleanup Remediation). - Current Teams behind: use automated patching/RMM first. - Live user session only if needed: three-dot menu > Settings > About Teams. - Backstage (CMD/PS): use the RMM script or installer only, not the Teams UI. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - Chicago North) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft .NET (all versions) (Agility Retail - Chicago North) - Update Required - 3rd party application Product/System: Microsoft .NET (all versions) Location: Agility Retail - Chicago North Affected Systems Count: 3 Finding summary: Microsoft .NET (all versions) is outdated on the listed hosts. These runtimes update within the same major version. An app built on one major version is tied to that version - removing it will break the app. CVE references: CVE-2026-69522 https://nvd.nist.gov/vuln/detail/CVE-2026-69522 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69522 Additional CVEs (4 more) are listed in the Client Folder report. Affected Systems: - LAPTOP-MDIUJJTB - 192.168.60.122 [8.0.30] [15 vulns] - LAPTOP-MDIUJJTB - 192.168.60.122 [10.0.26200] [5 vulns] - teri-sms - 192.168.68.69 [6.0.36] [3 vulns] Quick-check each host first. If the redistributable/runtime is not present, or is already at/above the minimum version to reach for that major version, stop and escalate to Security as a false positive. Include the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (usual path when keeping the major version) Install the updated package for the same major version to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only after dependency testing proves the major version is unused (test machine; uninstall one major version at a time). C. Vulnerable major version is required - escalate to Security for suppression Dependency testing showed apps need this major version, and it remains (or will remain) vulnerable. Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: .NET Framework and modern .NET (.NET 5+) are not interchangeable. An app built on one major version is tied to that version - removing it will break the app. Update each runtime line via WU/vendor installer; uninstall only when unused and verified. If the host is a VM, take a pre-update snapshot so you can revert if there are issues. - .NET 6: out of support - uninstall if unused and verified, or escalate cannot-update - .NET 8 (LTS): update runtime to the reported target within the 8.x line (Windows Update or runtime installer) - .NET 10 (LTS): update runtime to the reported target within the 10.x line Source material: Full scan exports and Top N reports are in the Client Folder at the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - WinVerifyTrust Signature Validation Vulnerability (Agility Retail - Boston) - Configuration Change Required
Vulnerability Remediation - WinVerifyTrust Signature Validation Vulnerability (Agility Retail - Boston) - Configuration Change Required Product/System: WinVerifyTrust Signature Validation Vulnerability Location: Agility Retail - Boston Affected Systems Count: 19 Finding summary: WinVerifyTrust Signature Validation Vulnerability is a configuration/hardening finding. Correct the listed setting(s) per Technical guidance below. CVE references: CVE-2013-3900 https://nvd.nist.gov/vuln/detail/CVE-2013-3900 Affected Systems: - AGILITY-AM- - 10.0.1.72 [1 vulns] - Agility-H7-3261 - 10.0.1.93 [1 vulns] - Agility-H7-3262 - 10.0.1.78 [1 vulns] - Agility-H7-3266 - 10.0.1.90 [1 vulns] - Agility-H7-3267 - 10.0.1.65 [1 vulns] - Agility-H7-3268 - 10.0.1.95 [1 vulns] - Agility-H7-3304 - 10.0.1.84 [1 vulns] - Agility-H7-3306 - 10.0.1.63 [1 vulns] - Agility-R5-0253 - 10.0.1.74 [1 vulns] - Agility-TC-000N - 10.0.1.81 [1 vulns] - Agility-TC-00CX - 10.0.1.60 [1 vulns] - Agility-TC-00RZ - 10.0.1.77 [1 vulns] - Agility-TC-00S3 - 10.0.1.75 [1 vulns] - Agility-TC-00SG - 10.0.1.87 [1 vulns] - AR-MGMT-RR-04 - 10.0.1.76 [1 vulns] - CUSTSERV1-CBPC - 10.0.1.62 [1 vulns] - DESKTOP-HLD5C2T - 10.0.5.4 [1 vulns] - LAPTOP-SHJTQ6VH - 10.0.0.112 [1 vulns] - Tom - 192.168.1.121 [1 vulns] Instructions: Quick-check each host first. If the configuration is already correct or the finding does not apply, stop and escalate to Security as a false positive, including details of what was checked. Otherwise, select change, false positive, or suppress below and document your choice in the ticket. Remediation (pick the most appropriate option): A. Correct the configuration (default) Apply the setting change described in Technical guidance. B. Finding does not apply - escalate false positive Document what you checked; Security will suppress if appropriate. C. Client will not change/cannot change - escalate to Security for suppression Record the client's notification or acceptance in the discussion notes. Note that suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. The client must be notified or must accept this, and the discussion notes should record who, what, which hosts, and that risk remains. Client coordination - read before changing: If this change may affect access, authentication, mail/DNS, or security posture, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must make the change. If they are unable or unwilling, escalate to Security for suppression. ===== TECHNICAL GUIDANCE (do this) ===== WinVerifyTrust/CVE-2013-3900 is Authenticode hardening, not a software install or Windows Update. - Set EnableCertPaddingCheck=1 under HKLM\Software\Microsoft\Cryptography\Wintrust\Config - On 64-bit hosts, also set the Wow6432Node\...\Wintrust\Config copy - Prefer domain GPO (or Intune) over one-off registry edits - Verify signed installers and vendor tools still launch after the change - Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900 ===== END TECHNICAL GUIDANCE ===== Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft Teams (Agility Retail - Boston) - Application Update Required
Vulnerability Remediation - Microsoft Teams (Agility Retail - Boston) - Application Update Required Product/System: Microsoft Teams Location: Agility Retail - Boston Affected Systems Count: 3 Finding summary: Microsoft Teams is outdated on the listed hosts. Update via RMM or a silent installer in Backstage CMD/PS. Only use a live user session if those methods fail. CVE references: CVE-2023-4863 https://nvd.nist.gov/vuln/detail/CVE-2023-4863 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863 Additional CVEs (3 more) are listed in the Client Folder report. Minimum version to reach: Update to version 26225.1806.5074.1452 (or the latest available). Affected Systems: - CUSTSERV2-DSPC - 10.0.1.82 [4 vulns] - CUSTSERV3-SLPC - 10.0.1.88 [4 vulns] - Tom - 192.168.1.121 [4 vulns] Before remediating, quick-check each host. If the product is not installed, or is already at or above the minimum version, stop and escalate to Security as a false positive, noting the hostname and what you found. Otherwise, choose one of the remediation options below and document your choice in the ticket. Remediation options (choose the most appropriate): A. Update (default when still needed) Install the updated vendor package via wizard or RMM to reach the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Use only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression Use only after confirming the software exists at a vulnerable version and update/uninstall is not viable through preferred methods. If the product is EOL, check for and apply the latest available final build first; if keeping it, notify the client, then escalate to Security. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. The client must accept or be notified; record discussion notes (who, what, hosts, and that risk remains). Client coordination - read before updating: If the update may interrupt a user, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Confirm the flagged Teams version - Classic is not always the source. Classic Teams is sometimes a per-user install, so a user who has not logged into the workstation recently, or is not the primary user, can still have a Classic leftover. Run the RMM Teams Classic cleanup script for these leftover per-user installs. If Classic or a duplicate is suspected, use: R-Security - Teams Classic Cleanup Remediation (Scripts > RR Custom > RR Custom - R-Security Remediation > R-Security - Teams Classic Cleanup Remediation). If current Teams is behind, use automated patching/RMM first. Only use a live user session if needed, via three-dot menu > Settings > About Teams. For Backstage (CMD/PS), use the RMM script or installer only - not the Teams UI. Source material: Full scan exports and Top N reports are in the Client Folder under the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Speculative Store Bypass (Agility Retail - Los Angeles) - Updates Required - 3rd party application
Vulnerability Remediation - Speculative Store Bypass (Agility Retail - Los Angeles) - Configuration Change Required - 3rd party application Product/System: Speculative Store Bypass Location: Agility Retail - Los Angeles Affected Systems Count: 19 Finding summary: Speculative Store Bypass is a configuration/hardening finding. Correct the listed setting(s) per Technical guidance. CVE references: CVE-2018-3639 https://nvd.nist.gov/vuln/detail/CVE-2018-3639 Affected Systems: - AR-MGMT-RR-05 - 10.0.0.33 [1 vulns] - Desktop-PF5SCZB - 10.0.0.16 [1 vulns] - JERRYREIS - 10.0.0.29 [1 vulns] - LAPTOP-3DN6A1LP - 10.0.0.48 [1 vulns] - LAPTOP-7OGM15M8 - 10.0.0.19 [1 vulns] - LAPTOP-9SFHJCD5 - 10.0.0.25 [1 vulns] - LAPTOP-F5FORECH - 10.0.0.15 [1 vulns] - LAPTOP-NLVQBJIB - 192.168.1.228 [1 vulns] - LAPTOP-NTB3SJ43 - 10.99.0.12 [1 vulns] - LAPTOP-NUV0PMBB - 10.0.0.21 [1 vulns] - LAPTOP-R8OEN4P4 - 10.0.0.44 [1 vulns] - LAPTOP-RO56NKMM - 10.0.0.45 [1 vulns] - LAPTOP-UE1T1R2C - 10.99.0.5 [1 vulns] - moon-dt-2.moonmfg - 10.0.0.24 [1 vulns] - MOON-DT-3 - 10.0.0.20 [1 vulns] - moon-dt-acct - 10.0.0.22 [1 vulns] - Moon-Fabrication - 10.0.0.50 [1 vulns] - MOON-LT-01 - 10.99.0.8 [1 vulns] - vinyl-PC.moonmfg - 10.0.0.30 [1 vulns] Quick-check each host/domain first. If the configuration is already correct or the finding does not apply, stop and escalate to Security as a false positive, including details of what was checked. Otherwise choose change, false positive, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Correct the configuration (default) - Apply the setting change in Technical guidance. B. Finding does not apply - escalate false positive - Document what you checked; Security suppresses if appropriate. C. Client will not change / cannot change - escalate to Security for suppression - Record client notification/acceptance in discussion notes to the client. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before changing: If this change may affect access, authentication, mail/DNS, or security posture, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must make the change. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Speculative Store Bypass (CVE-2018-3639) is a Windows CPU-mitigation registry setting, not a software install. Apply the latest Windows quality/security updates first - the registry setting does nothing without those KBs. Enable the OS mitigation at HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management. If FeatureSettingsOverride is missing, set FeatureSettingsOverride=8 and FeatureSettingsOverrideMask=3. If Override already has a value, add bit 8 (SSB) per Microsoft KB4072698 - do not wipe other Spectre bits already in use. Prefer domain GPO (or Intune) over one-off registry edits. Reboot, then verify with: Install-Module SpeculationControl; Get-SpeculationControlSettings. If already patched and mitigations show enabled, escalate to Security as a false positive with hostname, build, and the cmdlet output, then stop. These mitigations can slow a busy server - discuss with the client if users will notice. Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-3639 Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - CVE-2023-48795 (Agility Retail - Minneapolis) - Investigate and Resolve - 3rd party application
Vulnerability Remediation - CVE-2023-48795 (Agility Retail - Minneapolis) - Investigate and Resolve - 3rd party application Product/System: CVE-2023-48795 Location: Agility Retail - Minneapolis Affected Systems Count: 1 Finding summary: CVE-2023-48795 is a CVE-only finding - the scan did not clearly name an installed product. Identify the real vulnerable component on the listed host before choosing update, uninstall, or suppress. CVE references: CVE-2023-48795 https://nvd.nist.gov/vuln/detail/CVE-2023-48795 Vendor advisory: http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html Affected Systems: - mosaic-al56-static-178 - 173.248.56.178 [1 vulns] Quick-check the host first. Identify the real product or firmware that matches this CVE before remediating. Include the hostname and what you found. If the CVE does not apply or the component is not present, stop and escalate to Security as a false positive. Otherwise, choose one of the following and document it in the ticket: A. Update (default once the component is identified and still needed) After identifying the product/firmware, update to the version listed under Minimum version to reach, or to the latest available version, or follow the vendor advisory for that exact product line. B. Not needed / not in use - uninstall or remove Only after the component is identified and confirmed that it should not exist on the host. C. Cannot remediate after identification - escalate to Security for suppression Applies if the component is identified at a vulnerable version and update/uninstall is not viable. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. The client must accept or be notified; record discussion notes (who, what, hosts, and that risk remains). Client coordination - read before updating: Once the component is identified, if the change may interrupt a user or service, schedule after hours or contact the client first. If another vendor manages the identified application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: For this CVE-only finding, identify the vulnerable component on the host before remediating. Check the Product/minimum version on this ticket, installed programs, services, and the scan export detail in the Client Folder under the Reports location. Once identified, apply the version listed under Minimum version to reach when present, or follow the vendor advisory for that product line. If the host is a VM, take a pre-update snapshot so you can revert if there are issues. Verify the update was successful and note the product and version in the ticket. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Speculative Store Bypass (Agility Retail - Chicago North) - Updates Required - 3rd party application
Vulnerability Remediation - Speculative Store Bypass (Agility Retail - Chicago North) - Configuration Change Required - 3rd party application Product/System: Speculative Store Bypass Location: Agility Retail - Chicago North Affected Systems Count: 18 Finding summary: Speculative Store Bypass is a configuration/hardening finding. Correct the listed setting(s) per Technical guidance. CVE references: CVE-2018-3639 https://nvd.nist.gov/vuln/detail/CVE-2018-3639 Affected Systems: - 192.168.9.40 [1 vulns] - AR-CN-MH-01 - 192.168.60.105 [1 vulns] - AR-CN-PROD-01 - 192.168.60.113 [1 vulns] - AR-CN-PROD-02 - 192.168.60.103 [1 vulns] - AR-MGMT-RR-01 - 192.168.9.10 [1 vulns] - BYT14 - 172.20.10.2 [1 vulns] - ChicagoNorth-Fishbowl - 10.10.4.11 [1 vulns] - DESKTOP-KHOUJ3K - 172.20.1.181 [1 vulns] - LAPTOP-0PI88JJK - 192.168.60.116 [1 vulns] - LAPTOP-ACQ4KP50 - 10.0.0.14 [1 vulns] - LAPTOP-LI5TEO9Q - 192.168.9.52 [1 vulns] - LAPTOP-MDIUJJTB - 192.168.60.122 [1 vulns] - MCSpare - 10.0.0.227 [1 vulns] - Pluto1 - 192.168.9.36 [1 vulns] - SATURN - 192.168.9.37 [1 vulns] - SMS-WKS16 - 192.168.60.110 [1 vulns] - SMS-WKS6 - 192.168.99.158 [1 vulns] - teri-sms - 192.168.68.69 [1 vulns] The first entry, 192.168.9.40, has no hostname. Identify it before remediating: - Ping the IP to confirm it is online. - If it cannot be reached from the usual tools, connect to the site network (VPN, ScreenConnect jump host, or on-site). - Check DHCP (lease, reservation, MAC) for a name. - Look it up in RMM, ScreenConnect, Liongard, AD, DNS (reverse lookup), firewall, and switch/ARP. - If still unknown, run a network scan from a trusted site host (do not scan from the internet). - Record the hostname (or device type) on the ticket before remediating. - If the IP is offline, unused, or not this client, document what you checked and escalate to Security as a false positive. Quick-check each host first. Stop and escalate to Security as a false positive, with details, if the configuration is already correct or the finding does not apply. Otherwise choose one of the remediation options below and document it in the ticket. Remediation (pick the most appropriate option): A. Correct the configuration (default) - Apply the setting change in Technical guidance. B. Finding does not apply - escalate false positive - Document what you checked; Security suppresses if appropriate. C. Client will not change / cannot change - escalate to Security for suppression - Record client notification/acceptance in discussion notes to the client. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before changing: If this change may affect access, authentication, mail/DNS, or security posture, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must make the change. If they are unable or unwilling, escalate to Security for suppression. ===== TECHNICAL GUIDANCE (do this) ===== - Speculative Store Bypass (CVE-2018-3639) is a Windows CPU-mitigation registry setting, not a software install. - Apply the latest Windows quality/security updates first; the registry setting does nothing without those KBs. - Enable the OS mitigation at HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management. - If FeatureSettingsOverride is missing, set FeatureSettingsOverride=8 and FeatureSettingsOverrideMask=3. - If Override already has a value, add bit 8 (SSB) per Microsoft KB4072698; do not wipe other Spectre bits already in use. - Prefer domain GPO (or Intune) over one-off registry edits. - Reboot, then verify: Install-Module SpeculationControl; Get-SpeculationControlSettings. - If already patched and mitigations show enabled, escalate to Security as a false positive with hostname, build, and the cmdlet output, then stop. - These mitigations can slow a busy server; discuss with the client if users will notice. - Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-3639 ===== END TECHNICAL GUIDANCE ===== Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft Edge (Agility Retail - Boston) - Updates Required
Vulnerability Remediation - Microsoft Edge (Agility Retail - Boston) - Updates Required Product/System: Microsoft Edge Location: Agility Retail - Boston Affected Systems Count: 1 Finding summary: Microsoft Edge is outdated on the listed host. Prefer RMM, the vendor updater, or Backstage CMD/PS. This app often updates in the background, so a live user session and a reboot are usually not required. CVE references: CVE-2026-10886 https://nvd.nist.gov/vuln/detail/CVE-2026-10886 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-10886 Additional CVEs (2527 more) are listed in the Client Folder report. Minimum version to reach: Update to version 154.0.4258.37 (or the latest available). Affected Systems: - Agility-TC-00CX - 10.0.1.60 [2528 vulns] Quick-check the host first. Include the hostname and what you found. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version. Otherwise, choose one of the remediation options below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) Update the app to the minimum version listed above (or the latest available) via vendor updater, RMM, or Backstage CMD/PS. Relaunch the app if an update downloaded but did not apply. B. Not needed / not in use - uninstall or remove Only if the app is not required on that host (confirm site standard / client). C. Cannot reach a secure release - escalate to Security for suppression Typical case: the OS cannot support the secure release, or the update is blocked after RMM/Backstage CMD/PS/live-session attempts. If the product is EOL, check and apply the latest available final build first; if keeping it, notify the client, then escalate to Security. Use this only after confirming the app is present at a vulnerable version. Do not use suppression for ordinary update failures - finish preferred methods or escalate troubleshooting first. Suppression only stops tracking; it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. The client must accept or be notified, with discussion notes recorded (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: This is auto-updating software - verify the installed version against the target before patching, and patch only if stale. Edge updates via Microsoft Edge Update (primary); WU may also apply updates. A relaunch may be needed for a downloaded update to take effect. If a live user session is needed, use edge://settings/help > Download and install. For Backstage (CMD/PS), use the silent installer/script only, not the Edge UI. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft Edge (Agility Retail - Chicago - Cicero) - Updates Required
Vulnerability Remediation - Microsoft Edge (Agility Retail - Chicago - Cicero) - Updates Required Product/System: Microsoft Edge Location: Agility Retail - Chicago - Cicero Affected Systems Count: 1 Finding summary: Microsoft Edge is outdated on the listed host. Prefer RMM, the vendor updater, or Backstage CMD/PS. This app often updates in the background. A live user session is usually not needed. A reboot is usually not required. CVE references: CVE-2026-76036 https://nvd.nist.gov/vuln/detail/CVE-2026-76036 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-76036 Additional CVEs (1028 more) are listed in the Client Folder report. Minimum version to reach: Update to version 154.0.4258.37 (or the latest available). Affected Systems: - AR-Cicero-01 - 192.168.2.53 [1029 vulns] Quick-check the host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version. Include the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) Update the app to the version listed under Minimum version to reach (or the latest available) via vendor updater, RMM, or Backstage CMD/PS. Relaunch the app if an update downloaded but did not apply. B. Not needed / not in use - uninstall or remove Only if the app is not required on that host (confirm site standard / client). C. Cannot reach a secure release - escalate to Security for suppression Typical case: OS cannot support the secure release, or update is blocked after RMM/Backstage CMD/PS/live-session attempts. If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. You verified the app is present at a vulnerable version. Do not use suppress for ordinary update failures - finish preferred methods or escalate troubleshooting first. Suppression only stops tracking; it does not patch or remove the vulnerability, and residual risk stays until a real fix. Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: This is auto-updating software - verify first, patch only if stale. Confirm the installed version against the reported target on the affected host. Edge updates via Microsoft Edge Update (primary); WU may also apply updates. A relaunch may be needed for a downloaded update to take effect. Use a live user session only if needed, via edge://settings/help > Download and install. For Backstage (CMD/PS), use the silent installer/script only, not the Edge UI. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft Edge (Agility Retail - Chicago North) - Updates Required
Vulnerability Remediation - Microsoft Edge (Agility Retail - Chicago North) - Updates Required Product/System: Microsoft Edge Location: Agility Retail - Chicago North Affected Systems Count: 1 Finding summary: Microsoft Edge is outdated on the listed host. Prefer RMM, the vendor updater, or Backstage CMD/PS - this app often updates in the background. A live user session is usually not needed, and a reboot is usually not required. CVE references: CVE-2026-87527 https://nvd.nist.gov/vuln/detail/CVE-2026-87527 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87527 Additional CVEs (246 more) are listed in the Client Folder report. Minimum version to reach: - Update to version 154.0.4258.37 (or the latest available). Update to version 154.0.8037.58 (or the latest available) - (1 end-of-life component notices omitted) Affected Systems: - 192.168.9.40 [247 vulns] IP-only host (no hostname) - identify it before remediating: - Ping the IP to confirm it is online - Connect to the site network (VPN, ScreenConnect jump host, or on-site) if you cannot reach it from the usual tools - Check DHCP (lease, reservation, MAC) for a name - Look up the IP in RMM, ScreenConnect, Liongard, AD, DNS (reverse lookup), firewall, and switch/ARP - If still unknown, run a network scan from a trusted site host (do not scan from the internet) - Record the hostname (or device type) on the ticket before remediating - If the IP is offline, unused, or not this client, document what you checked and escalate to Security as a false positive Quick-check the host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version to reach. Include the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - Update the app to the version listed under Minimum version to reach (or the latest available) via vendor updater, RMM, or Backstage CMD/PS. - Relaunch the app if an update downloaded but did not apply. B. Not needed / not in use - uninstall or remove - Only if the app is not required on that host (confirm site standard / client). C. Cannot reach a secure release - escalate to Security for suppression - Typical case: OS cannot support the secure release, or the update is blocked after RMM/Backstage CMD/PS/live-session attempts. - If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. - Confirm the app is present at a vulnerable version before escalating. - Do not use suppress for ordinary update failures - finish preferred methods or escalate troubleshooting first. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: - Auto-updating software: verify first, patch only if stale. - Confirm installed version against the reported target on the affected host. - Edge updates via Microsoft Edge Update (primary); WU may also apply updates. - Relaunch may be needed for a downloaded update to take effect. - Live user session only if needed: edge://settings/help > Download and install. - Backstage (CMD/PS): silent installer/script only - not the Edge UI. Source material: Full scan exports and Top N reports are in the Client Folder under the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - WinVerifyTrust Signature Validation Vulnerability (Agility Retail - Chicago North) - Configuration Change Required
Vulnerability Remediation - WinVerifyTrust Signature Validation Vulnerability (Agility Retail - Chicago North) - Configuration Change Required Product/System: WinVerifyTrust Signature Validation Vulnerability Location: Agility Retail - Chicago North Affected Systems Count: 15 Finding summary: WinVerifyTrust Signature Validation Vulnerability is a configuration/hardening finding. Correct the listed setting(s) per Technical guidance below. CVE references: CVE-2013-3900 https://nvd.nist.gov/vuln/detail/CVE-2013-3900 Affected Systems: - 192.168.9.40 [1 vulns] - AR-CN-MH-01 - 192.168.60.105 [1 vulns] - AR-CN-PROD-01 - 192.168.60.113 [1 vulns] - AR-CN-PROD-02 - 192.168.60.103 [1 vulns] - AR-MGMT-RR-01 - 192.168.9.10 [1 vulns] - BYT14 - 172.20.10.2 [1 vulns] - DESKTOP-KHOUJ3K - 172.20.1.181 [1 vulns] - LAPTOP-LI5TEO9Q - 192.168.9.52 [1 vulns] - LAPTOP-MDIUJJTB - 192.168.60.122 [1 vulns] - MCSpare - 10.0.0.227 [1 vulns] - Pluto1 - 192.168.9.36 [1 vulns] - SATURN - 192.168.9.37 [1 vulns] - SMS-WKS16 - 192.168.60.110 [1 vulns] - SMS-WKS6 - 192.168.99.158 [1 vulns] - teri-sms - 192.168.68.69 [1 vulns] IP-only host (no hostname) - identify before remediating: 192.168.9.40 has no hostname on file. Before remediating: - Ping the IP to confirm it is online. - Connect to the site network (VPN, ScreenConnect jump host, or on-site) if it cannot be reached from the usual tools. - Check DHCP (lease, reservation, MAC) for a name. - Look up the IP in RMM, ScreenConnect, Liongard, AD, DNS (reverse lookup), firewall, and switch/ARP. - If still unknown, run a network scan from a trusted site host (do not scan from the internet). - Record the hostname (or device type) on the ticket before remediating. - If the IP is offline, unused, or not this client, document what was checked and escalate to Security as a false positive. Process: Quick-check each host first. Stop and escalate to Security as a false positive if the configuration is already correct or the finding does not apply, and include details. Otherwise, choose one of the remediation options below and document the choice on the ticket. Remediation options (pick the most appropriate): A. Correct the configuration (default) Apply the setting change described in Technical guidance. B. Finding does not apply - escalate false positive Document what was checked; Security will suppress if appropriate. C. Client will not change / cannot change - escalate to Security for suppression Record client notification/acceptance in the discussion notes to the client. Suppression only stops tracking; it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. The client must accept or be notified, and the discussion notes must record who, what, hosts, and that risk remains. Client coordination - read before changing: If this change may affect access, authentication, mail/DNS, or security posture, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must make the change. If they are unable or unwilling, escalate to Security for suppression. Technical guidance (do this): WinVerifyTrust / CVE-2013-3900 is Authenticode hardening, not a software install or Windows Update. - Set EnableCertPaddingCheck=1 under HKLM\Software\Microsoft\Cryptography\Wintrust\Config. - On 64-bit hosts, also set the Wow6432Node\...\Wintrust\Config copy. - Prefer domain GPO (or Intune) over one-off registry edits. - Verify signed installers and vendor tools still launch after the change. - Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900 Source material: Full scan exports and Top N reports are in the Client Folder at the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft.Microsoft3DViewer (Agility Retail - Chicago North) - Update Required
Vulnerability Remediation - Microsoft.Microsoft3DViewer (Agility Retail - Chicago North) - Update Required Product/System: Microsoft.Microsoft3DViewer Location: Agility Retail - Chicago North Affected Systems Count: 1 Finding summary: Microsoft.Microsoft3DViewer is outdated on the listed host. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. CVE references: CVE-2021-43209 https://nvd.nist.gov/vuln/detail/CVE-2021-43209 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43209 Additional CVEs (12 more) are listed in the Client Folder report. Minimum version to reach: Multiple bundled scanner entries report end-of-life components. Patch within each runtime line per remediation guidance, or to the latest available version. Affected Systems: - 192.168.9.40 [14 vulns] IP-only host (no hostname) - identify it before remediating: - Ping the IP to confirm it is online. - Connect to the site network (VPN, ScreenConnect jump host, or on-site) if you cannot reach it from the usual tools. - Check DHCP (lease, reservation, MAC) for a name. - Look up the IP in RMM, ScreenConnect, Liongard, AD, DNS (reverse lookup), firewall, and switch/ARP. - If still unknown, run a network scan from a trusted site host (do not scan from the internet). - Record the hostname (or device type) on the ticket before remediating. - If the IP is offline, unused, or not this client: document what you checked and escalate to Security as a false positive. Quick-check the host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version to reach. Include the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach, or the latest available. B. Not needed / not in use - uninstall or remove Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression Use only after verifying the software exists at a vulnerable version and install/update/uninstall is not viable via preferred methods. If the product is EOL, check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. The client must accept or be notified; record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - READ BEFORE UPDATING: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. ===== TECHNICAL GUIDANCE (do this) ===== Microsoft Store apps are per-user. ScreenConnect Backstage supports CMD/PS/scripts only (installer/winget), not in-app GUI menus - the in-app Check for Updates / Help > About option needs a live user session. The Backstage CMD console runs as SYSTEM. Winget as SYSTEM is not supported and may only update the SYSTEM profile, not the signed-in user's Store apps. For Store apps or per-user winget, use the Backstage user-context terminal (logged-on user) or a live user session. ===== END TECHNICAL GUIDANCE ===== Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - WinVerifyTrust Signature Validation Vulnerability (Agility Retail - Milwaukee) - Configuration Change Required
Vulnerability Remediation - WinVerifyTrust Signature Validation Vulnerability (Agility Retail - Milwaukee) - Configuration Change Required Product/System: WinVerifyTrust Signature Validation Vulnerability Location: Agility Retail - Milwaukee Affected Systems Count: 13 Finding summary: WinVerifyTrust Signature Validation Vulnerability is a configuration/hardening finding. Correct the listed setting(s) per Technical guidance. CVE reference: CVE-2013-3900 https://nvd.nist.gov/vuln/detail/CVE-2013-3900 Affected Systems: - 10.10.100.110 [1 vulns] - 10.10.100.112 [1 vulns] - Aaron-LPT - 192.168.0.227 [1 vulns] - AR-MGMT-RR-06 - 10.10.100.136 [1 vulns] - LAPTOP-4BQ0Q6F7 - 10.10.100.109 [1 vulns] - LAPTOP-4IAP1Q3R - 10.10.100.105 [1 vulns] - LAPTOP-A0MCMC9H - 10.10.100.101 [1 vulns] - LAPTOP-CT3OBSLV - 10.10.100.107 [1 vulns] - LAPTOP-H189O8CF - 10.10.100.123 [1 vulns] - LAPTOP-HG7ATGBA - 10.10.100.106 [1 vulns] - LAPTOP-N36HPSLT - 10.10.100.119 [1 vulns] - LAPTOP-NQEJAOFU - 10.10.100.108 [1 vulns] - OfficeLPT - 10.10.100.121 [1 vulns] Two hosts on the list have no hostname (10.10.100.110 and 10.10.100.112). Identify each before remediating: - Ping the IP to confirm it is online. - Connect to the site network (VPN, ScreenConnect jump host, or on-site) if you cannot reach it from the usual tools. - Check DHCP (lease, reservation, MAC) for a name. - Look up the IP in RMM, ScreenConnect, Liongard, AD, DNS (reverse lookup), firewall, and switch/ARP. - If still unknown, run a network scan from a trusted site host (do not scan from the internet). - Record the hostname (or device type) on the ticket before remediating. - If an IP is offline, unused, or not this client, document what you checked and escalate to Security as a false positive. Quick-check each host first. If the configuration is already correct or the finding does not apply, stop and escalate to Security as a false positive, including details of what you checked. Otherwise, choose one of the remediation options below and document it on the ticket. Remediation options (pick the most appropriate): A. Correct the configuration (default) - apply the setting change in Technical guidance. B. Finding does not apply - escalate as a false positive. Document what you checked; Security will suppress if appropriate. C. Client will not or cannot change - escalate to Security for suppression. Record client notification/acceptance in discussion notes (who, what, hosts, and that risk remains). Note: suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. Client coordination - read before changing: If this change may affect access, authentication, mail/DNS, or security posture, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must make the change. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: WinVerifyTrust / CVE-2013-3900 is Authenticode hardening, not a software install or Windows Update. - Set EnableCertPaddingCheck=1 under HKLM\Software\Microsoft\Cryptography\Wintrust\Config. - On 64-bit hosts, also set the Wow6432Node\...\Wintrust\Config copy. - Prefer domain GPO (or Intune) over one-off registry edits. - Verify signed installers and vendor tools still launch after the change. - Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900 Source material: Full scan exports and Top N reports are in the Client Folder at the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Python 3.14.5 (64-bit) (Agility Retail - Chicago - Cicero) - Update Required - 3rd party application
Vulnerability Remediation - Python 3.14.5 (64-bit) (Agility Retail - Chicago - Cicero) - Update Required - 3rd party application Product/System: Python 3.14.5 (64-bit) Location: Agility Retail - Chicago - Cicero Affected Systems Count: 1 Finding summary: Python 3.14.5 (64-bit) is outdated on the listed host. CVE references: CVE-2026-11940 https://nvd.nist.gov/vuln/detail/CVE-2026-11940 Vendor security center: https://mail.python.org/archives/list/security-announce@python.org/ Additional CVEs (19 more) are listed in the Client Folder report. Minimum version to reach: Update to version 3.14.7 (or the latest available). Affected Systems: - LAPTOP-EPL7RODK - 10.14.101.121 [20 vulns] Steps: 1. Quick-check the host first. Confirm which Python major.minor is installed and which apps require it. If the product is not installed, or is already at or above the minimum version to reach, stop and escalate to Security as a false positive. Include the hostname and what you found. 2. If still needed, update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. Update within the same minor line when a patch exists. Do not jump major/minor versions without checking with the app vendor. 3. If this update may interrupt a user, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update; if they are unable or unwilling, escalate to Security for suppression. 4. Choose the most appropriate remediation option and document it in the ticket: A. Update (default when still needed) Install the updated vendor package (wizard/RMM) to version 3.14.7 (or the latest available). B. Not needed / not in use - uninstall or remove Only if the software should not exist on the host. Python 2.x and old 3.7/3.8 lines are EOL - uninstall if unused after a dependency check. C. Cannot update or uninstall - escalate to Security for suppression Use only after confirming the product exists at a vulnerable version and update/uninstall is not viable through preferred methods. If the product is EOL, check and apply the latest available final build first; if it must stay, notify the client, then escalate to Security. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. The client must accept this or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - CVE-2021-28041 (Agility Retail - Minneapolis) - Investigate and Resolve - 3rd party application
Vulnerability Remediation - CVE-2021-28041 (Agility Retail - Minneapolis) - Investigate and Resolve - 3rd party application Product/System: CVE-2021-28041 Location: Agility Retail - Minneapolis Affected Systems Count: 1 Finding summary: CVE-2021-28041 is a CVE-only finding - the scan did not clearly name an installed product. Identify the real vulnerable component on the listed host before choosing update, uninstall, or suppress. CVE references: CVE-2021-28041 https://nvd.nist.gov/vuln/detail/CVE-2021-28041 Vendor advisory: https://github.com/openssh/openssh-portable/commit/e04fd6dde16de1cdc5a4d9946397ff60d96568db Affected Systems: - mosaic-al56-static-178 - 173.248.56.178 [1 vulns] Steps: 1. Quick-check the host. Identify the real product or firmware that matches this CVE before remediating. Check installed programs, services, and the scan export detail in the Client Folder under the Reports location below. 2. If the CVE does not apply or the component is not present, stop and escalate to Security as a false positive. Include the hostname and what you found. 3. Otherwise, choose one of the following and document it in the ticket: A. Update (default once the component is identified and still needed) - update to the version listed under Minimum version to reach, or the latest available, or per the vendor advisory for that exact product line. B. Not needed / not in use - uninstall or remove, only after confirming the component should not exist on the host. C. Cannot remediate after identification - escalate to Security for suppression. Note that suppression only stops tracking; it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. The client must accept or be notified - record who, what, host, and that risk remains. Client coordination: Once the component is identified, if the change may interrupt a user or service, schedule after hours or contact the client first. If another vendor manages the identified application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: - CVE-only: identify the vulnerable component on the host before remediating. Check Product/minimum version on this ticket, installed programs, services, and the scan export detail in the Client Folder under the Reports location below. - Once identified, apply the version listed under Minimum version to reach when present, or the vendor advisory for that product line. - If the host is a VM, take a pre-update snapshot so you can revert if there are issues. - Verify the update was successful and note the product and version in the ticket. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - CVE-2021-41617 (Agility Retail - Minneapolis) - Investigate and Resolve - 3rd party application
Vulnerability Remediation - CVE-2021-41617 (Agility Retail - Minneapolis) - Investigate and Resolve - 3rd party application Product/System: CVE-2021-41617 Location: Agility Retail - Minneapolis Affected Systems Count: 1 Finding summary: CVE-2021-41617 is a CVE-only finding - the scan did not clearly name an installed product. Identify the real vulnerable component on the host before choosing update, uninstall, or suppress. CVE references: CVE-2021-41617 https://nvd.nist.gov/vuln/detail/CVE-2021-41617 Vendor advisory: https://bugzilla.suse.com/show_bug.cgi?id=1190975 Affected Systems: - mosaic-al56-static-178 - 173.248.56.178 [1 vulns] Instructions: Quick-check the host first. Identify the real product or firmware that matches this CVE before remediating. If the CVE does not apply or the component is not present, stop and escalate to Security as a false positive, including the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default once the component is identified and still needed) - After identifying the product/firmware on the host, update to the version listed under Minimum version to reach (or the latest available), or follow the vendor advisory for that exact product line. B. Not needed / not in use - uninstall or remove - Only after the component is identified and confirmed it should not exist on the host. C. Cannot remediate after identification - escalate to Security for suppression - Use when the component is identified at a vulnerable version and update/uninstall is not viable. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: Once the component is identified, if the change may interrupt a user or service, schedule after hours or contact the client first. If another vendor manages the identified application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: CVE-only finding - identify the vulnerable component on the host before remediating. Check Product/minimum version on this ticket, installed programs, services, and scan export detail in the Client Folder under the Reports location. Once identified, apply the version listed under Minimum version to reach when present, or follow the vendor advisory for that product line. If this host is a VM, take a pre-update snapshot so you can revert if there are issues. Verify the update was successful and note the product and version in the ticket. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - Chicago - Cicero) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - Chicago - Cicero) - Update Required - 3rd party application Product/System: Microsoft Visual C++ (all versions) Location: Agility Retail - Chicago - Cicero Affected Systems Count: 4 Finding summary: Microsoft Visual C++ (all versions) is outdated on the listed hosts. These runtimes update within the same major version. An app built on one major version is tied to that version - removing it will break the app. Affected Systems: - AR-Cicero-10 - 192.168.2.61 [12.0.21005] [6 vulns] - AR-Cicero-10 - 192.168.2.61 [10.0.40219] [2 vulns] - LAPTOP-UN4OVI86 - 192.168.4.159 [10.0.30319] [2 vulns] - LAPTOP-JK3JBCVL - 192.168.72.19 [10.0.30319] [2 vulns] Quick-check each host first. If the redistributable/runtime is not present, or is already at or above the minimum version to reach for that major version, stop and escalate to Security as a false positive - include the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (usual path when keeping the major version) Install the updated package for the same major version, to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only after dependency testing proves the major version is unused (test machine; uninstall one major version at a time). C. Vulnerable major version is required - escalate to Security for suppression Use this when dependency testing shows apps need this major version and it remains (or will remain) vulnerable. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk stays until a real fix. The client must accept or be notified; record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance (do this): Visual C++ redistributables are side-by-side - do not upgrade everything to the latest year. An app built on one major version is tied to that version - removing it will break the app. Only remove a year if no app is using it. Patch each major version seen below with the matching vc_redist or Windows Update package. If this host is a VM, take a pre-update snapshot so you can revert if there are issues. Verify the update was successful. 2010 (10.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused. 2013 (12.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused. Source material: Full scan exports and Top N reports are in the Client Folder under the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - Corporate Headquarters) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft Visual C++ (all versions) (Agility Retail - Corporate Headquarters) - Update Required - 3rd party application Product/System: Microsoft Visual C++ (all versions) Location: Agility Retail - Corporate Headquarters Affected Systems Count: 2 Finding summary: Microsoft Visual C++ (all versions) is outdated on the listed hosts. These runtimes update within the same major version. An app built on one major version is tied to that version - removing it will break the app. Affected Systems: - JoshDesktop - 192.168.2.54 [11.0.61030] [6 vulns] - JoshDesktop - 192.168.2.54 [12.0.40664] [6 vulns] Quick-check each host first. Stop and escalate to Security as a false positive if the redistributable/runtime is not present, or if it is already at/above the minimum version to reach for that major version. Include hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (usual path when keeping the major version) Install the updated package for the same major version to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only after dependency testing proves the major version is unused (test machine; uninstall one major version at a time). C. Vulnerable major version is required - escalate to Security for suppression Dependency testing showed apps need this major version, and it remains (or will remain) vulnerable. Suppression only stops tracking; it does not patch or remove the vulnerability, and residual risk stays until a real fix. Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Visual C++ redistributables are side-by-side - do not upgrade everything to the latest year. An app built on one major version is tied to that version, so removing it will break the app. Only remove a year if no app is using it. Patch each major version seen below with the matching vc_redist or Windows Update package. If this host is a VM, take a pre-update snapshot so you can revert if there are issues. Verify the update was successful. - 2012 (11.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused - 2013 (12.x): patch via https://aka.ms/vcredist or Windows Update - do not remove unless unused Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Speculative Store Bypass (Agility Retail - Milwaukee) - Updates Required - 3rd party application
Vulnerability Remediation - Speculative Store Bypass (Agility Retail - Milwaukee) - Configuration Change Required - 3rd party application Product/System: Speculative Store Bypass Location: Agility Retail - Milwaukee Affected Systems Count: 13 Finding summary: Speculative Store Bypass is a configuration/hardening finding. Correct the listed setting(s) per Technical guidance below. CVE references: CVE-2018-3639 https://nvd.nist.gov/vuln/detail/CVE-2018-3639 Affected Systems: - 10.10.100.110 [1 vulns] - 10.10.100.112 [1 vulns] - Aaron-LPT - 192.168.0.227 [1 vulns] - AR-MGMT-RR-06 - 10.10.100.136 [1 vulns] - LAPTOP-4BQ0Q6F7 - 10.10.100.109 [1 vulns] - LAPTOP-4IAP1Q3R - 10.10.100.105 [1 vulns] - LAPTOP-A0MCMC9H - 10.10.100.101 [1 vulns] - LAPTOP-CT3OBSLV - 10.10.100.107 [1 vulns] - LAPTOP-H189O8CF - 10.10.100.123 [1 vulns] - LAPTOP-HG7ATGBA - 10.10.100.106 [1 vulns] - LAPTOP-N36HPSLT - 10.10.100.119 [1 vulns] - LAPTOP-NQEJAOFU - 10.10.100.108 [1 vulns] - OfficeLPT - 10.10.100.121 [1 vulns] Two entries above (10.10.100.110 and 10.10.100.112) are IP-only, with no hostname. Identify each before remediating: - Ping the IP to confirm it is online. - If you cannot reach it from the usual tools, connect to the site network (VPN, ScreenConnect jump host, or on-site). - Check DHCP (lease, reservation, MAC) for a name. - Look up the IP in RMM, ScreenConnect, Liongard, AD, DNS (reverse lookup), firewall, and switch/ARP. - If still unknown, run a network scan from a trusted site host (do not scan from the internet). - Record the hostname (or device type) on the ticket before remediating. - If the IP is offline, unused, or not this client, document what you checked and escalate to Security as a false positive. Process: Quick-check each host first. Stop and escalate to Security as a false positive if the configuration is already correct or the finding does not apply - include details of what you checked. Otherwise, choose one remediation option below and document your choice on the ticket. Remediation (pick the most appropriate option): A. Correct the configuration (default) - apply the setting change in Technical guidance. B. Finding does not apply - escalate false positive. Document what you checked; Security suppresses if appropriate. C. Client will not or cannot change - escalate to Security for suppression. Record client notification/acceptance in discussion notes (who, what, hosts, and that risk remains). Suppression only stops tracking - it does not patch or remove the vulnerability; residual risk stays until a real fix is applied. Client coordination - read before changing: If this change may affect access, authentication, mail/DNS, or security posture, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must make the change. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Speculative Store Bypass (CVE-2018-3639) is a Windows CPU-mitigation registry setting, not a software install. - Apply the latest Windows quality/security updates first - the registry setting does nothing without those KBs. - Enable the OS mitigation at: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management - If FeatureSettingsOverride is missing, set FeatureSettingsOverride=8 and FeatureSettingsOverrideMask=3. - If Override already has a value, add bit 8 (SSB) per Microsoft KB4072698 - do not wipe other Spectre bits already in use. - Prefer domain GPO (or Intune) over one-off registry edits. - Reboot, then verify with: Install-Module SpeculationControl; Get-SpeculationControlSettings - If the system is already patched and mitigations show enabled, escalate to Security as a false positive with hostname, build, and the cmdlet output, then stop. - These mitigations can slow a busy server - discuss with the client if users will notice. - Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-3639 Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - unquoted service path (Agility Retail - Chicago - Cicero) - Configuration Change Required
Vulnerability Remediation - unquoted service path (Agility Retail - Chicago - Cicero) - Configuration Change Required
Product/System: unquoted service path
Location: Agility Retail - Chicago - Cicero
Affected Systems Count: 13
Finding summary:
Unquoted service path is a Windows service ImagePath issue on the listed hosts (CWE-428), not a software install. ConnectSecure names the hosts, not the service. On each listed host, list unquoted services, then quote the full binary path.
Affected Systems:
- AR-Cicero-03 - 192.168.2.51 [1 vulns]
- AR-Cicero-05 - 192.168.2.72 [1 vulns]
- AR-Cicero-06 - 192.168.72.37 [1 vulns]
- AR-Cicero-07 - 192.168.2.87 [1 vulns]
- AR-Cicero-09 - 192.168.2.84 [1 vulns]
- AR-MGMT-RR-03 - 192.168.2.85 [1 vulns]
- BrianP - 192.168.60.117 [1 vulns]
- DESKTOP-A17DOU5 - 192.168.2.80 [1 vulns]
- DESKTOP-OBI4EA8 - 192.168.2.63 [1 vulns]
- DGSRAFA - 192.168.72.27 [1 vulns]
- LAPTOP-1ON9DL5T - 192.168.2.52 [1 vulns]
- LAPTOP-67TGIKRE - 10.0.0.168 [1 vulns]
- LAPTOP-EPL7RODK - 10.14.101.121 [1 vulns]
Quick-check each host first. Stop and escalate to Security as a false positive if the configuration is already correct or the finding does not apply, and include details of what you checked. Otherwise choose change, false positive, or suppress below and document it in the ticket.
Remediation (pick the most appropriate option):
A. Correct the configuration (default)
- Apply the setting change in Technical guidance.
B. Finding does not apply - escalate false positive
- Document what you checked; Security suppresses if appropriate.
C. Client will not change / cannot change - escalate to Security for suppression
- Record client notification/acceptance in discussion notes to the client.
- Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix.
- Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains).
Client coordination - READ BEFORE CHANGING:
If this change may affect access, authentication, mail/DNS, or security posture: schedule after hours or contact the client first.
If another vendor manages this application, device, workstation, or server: that vendor or the service owner must make the change. If they are unable or unwilling, escalate to Security for suppression.
===== TECHNICAL GUIDANCE (do this) =====
- Unquoted service path is Windows service hardening (CWE-428), not a software install.
- ConnectSecure names the hosts only; it does not name the service or ImagePath.
- On each listed host, use RMM or ScreenConnect Backstage PowerShell and run:
Get-CimInstance Win32_Service | Where-Object { $_.PathName -and $_.PathName -notlike '"*' -and $_.PathName -match ' ' } | Select-Object Name, PathName, State
- If no rows return, the path is already quoted or has no spaces: stop and escalate to Security as a false positive with the hostname and note that the check returned none.
- For each returned service, quote the full binary path (example: "C:\Program Files\Vendor\app.exe") via sc config <Name> binPath= or HKLM\SYSTEM\CurrentControlSet\Services\<Name>\ImagePath.
- Prefer the vendor's quoted path when they ship a fix.
- Restart the service if safe; coordinate if it is user-facing.
- Do not uninstall the application unless it is unused.
- Verify ImagePath is quoted after the change.
===== END TECHNICAL GUIDANCE =====
Source material:
Full scan exports and Top N reports are in the Client Folder under the Reports location below.
Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3
Ticket created by Chris Knospe.Vulnerability Remediation - Microsoft Teams (Agility Retail - Corporate Headquarters) - Application Update Required
Vulnerability Remediation - Microsoft Teams (Agility Retail - Corporate Headquarters) - Application Update Required Product/System: Microsoft Teams Location: Agility Retail - Corporate Headquarters Affected Systems Count: 1 Finding summary: Microsoft Teams is outdated on the listed host. Update via RMM or a silent installer in a Backstage CMD/PS session. Use a live user session only if those methods fail. CVE references: CVE-2023-4863 https://nvd.nist.gov/vuln/detail/CVE-2023-4863 Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863 Additional CVEs (6 more) are listed in the Client Folder report. Minimum version to reach: Update to version 26225.1806.5074.1452 (or the latest available). Affected Systems: - JoshDesktop - 192.168.2.54 [7 vulns] Quick-check the host first. Escalate to Security as a false positive if the product is not installed or is already at/above the minimum version, and include the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove. Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression. Use this if you verified the product exists at a vulnerable version and install/update/uninstall is not viable after preferred methods. If the product is EOL, check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk stays until a real fix. The client must accept or be notified; record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Confirm the flagged Teams version - Classic is not always the source. Classic Teams is sometimes a per-user install, so a user who has not logged into this workstation in a while, or who is not the primary user, can still have a Classic leftover. Run the RMM Teams Classic cleanup script for those leftover per-user installs. If Classic or a duplicate is suspected, use R-Security - Teams Classic Cleanup Remediation (Scripts > RR Custom > RR Custom - R-Security Remediation > R-Security - Teams Classic Cleanup Remediation). If current Teams is behind, use automated patching/RMM first. Use a live user session only if needed, via the three-dot menu > Settings > About Teams. In Backstage, use the RMM script/installer only - not the Teams UI. Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - unquoted service path (Agility Retail - Boston) - Configuration Change Required
Vulnerability Remediation - unquoted service path (Agility Retail - Boston) - Configuration Change Required
Product/System: unquoted service path
Location: Agility Retail - Boston
Affected Systems Count: 11
Finding summary:
Unquoted service path is a Windows service ImagePath issue on the listed hosts (CWE-428), not a software install. ConnectSecure names the hosts, not the service. On each listed host, list unquoted services, then quote the full binary path.
Affected Systems:
- Agility-H7-3261 - 10.0.1.93 [1 vulns]
- Agility-H7-3262 - 10.0.1.78 [1 vulns]
- Agility-H7-3266 - 10.0.1.90 [1 vulns]
- Agility-H7-3268 - 10.0.1.95 [1 vulns]
- Agility-H7-3304 - 10.0.1.84 [1 vulns]
- Agility-H7-3306 - 10.0.1.63 [1 vulns]
- Agility-R5-0253 - 10.0.1.74 [1 vulns]
- Agility-TC-00CX - 10.0.1.60 [1 vulns]
- CUSTSERV1-CBPC - 10.0.1.62 [1 vulns]
- DESKTOP-HLD5C2T - 10.0.5.4 [1 vulns]
- Tom - 192.168.1.121 [1 vulns]
Quick-check each host first. Stop and escalate to Security as a false positive if the configuration is already correct or the finding does not apply, and include details of what you checked. Otherwise, choose change, false positive, or suppress below and document your choice in the ticket.
Remediation (pick the most appropriate option):
A. Correct the configuration (default)
- Apply the setting change in Technical guidance.
B. Finding does not apply - escalate false positive
- Document what you checked; Security suppresses if appropriate.
C. Client will not change / cannot change - escalate to Security for suppression
- Record client notification/acceptance in discussion notes to the client.
- Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix.
- Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains).
Client coordination - READ BEFORE CHANGING:
If this change may affect access, authentication, mail/DNS, or security posture, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must make the change. If they are unable or unwilling, escalate to Security for suppression.
===== TECHNICAL GUIDANCE (do this) =====
Unquoted service path is Windows service hardening (CWE-428), not a software install. ConnectSecure names the hosts only; it does not name the service or ImagePath.
On each listed host, use RMM or ScreenConnect Backstage PowerShell and run:
Get-CimInstance Win32_Service | Where-Object { $_.PathName -and $_.PathName -notlike '"*' -and $_.PathName -match ' ' } | Select-Object Name, PathName, State
If no rows return, the path is already quoted or has no spaces - stop and escalate to Security as a false positive with the hostname and note that the check returned none.
For each returned service, quote the full binary path (example: "C:\Program Files\Vendor\app.exe") via sc config <Name> binPath= or HKLM\SYSTEM\CurrentControlSet\Services\<Name>\ImagePath. Prefer the vendor quoted path when they ship a fix.
Restart the service if safe; coordinate if it is user-facing. Do not uninstall the application unless it is unused. Verify ImagePath is quoted after the change.
===== END TECHNICAL GUIDANCE =====
Source material:
Full scan exports and Top N reports are in the Client Folder under Reports location below.
Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3
Ticket created by Chris Knospe.Vulnerability Remediation - Git (Agility Retail - Chicago North) - Update Required - 3rd party application
Vulnerability Remediation - Git (Agility Retail - Chicago North) - Update Required - 3rd party application Product/System: Git Location: Agility Retail - Chicago North Affected Systems Count: 1 Finding summary: Git is outdated on the listed host. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. CVE references: CVE-2025-48384 https://nvd.nist.gov/vuln/detail/CVE-2025-48384 Additional CVEs (8 more) are listed in the Client Folder report. Minimum version to reach: Update to version 2.55.0.5 (or the latest available). Affected Systems: - Pluto1 - 192.168.9.36 [9 vulns] Before updating, quick-check the host. If Git is not installed or is already at or above 2.55.0.5, stop and escalate to Security as a false positive, noting the hostname and what was found. Otherwise, proceed with remediation and document the choice below (update, remove, or suppress). Remediation (pick the most appropriate option): A. Update (default when still needed) Install the updated Git package to version 2.55.0.5, or the latest available, via wizard or RMM. B. Not needed / not in use - uninstall or remove Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression Use only after confirming the software exists at a vulnerable version and update/uninstall is not viable through the preferred methods. If the product is EOL, apply the latest available final build first; if it must be kept, notify the client, then escalate to Security. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. The client must accept or be notified; record discussion notes (who, what, hosts, and that risk remains). Client coordination - read before updating: If the update may interrupt a user, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Attempt updates in this order: 1) RMM automated patching or software deployment (preferred), 2) ScreenConnect Backstage CMD/PS or a silent installer script, 3) only if both fail, a live remote session with the end user for in-app UI updates. If the host is a VM, take a pre-update snapshot so you can revert if issues arise. Confirm Git is installed on the host before making changes. Update to the version listed above. If an installer or firmware update indicates a reboot or service restart is needed, coordinate with the client first. Verify the update was successful once complete. Source material: Full scan exports and Top N reports are in the Client Folder under the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - FortiClient VPN (Agility Retail - Corporate Headquarters) - Update Required
Vulnerability Remediation - FortiClient VPN (Agility Retail - Corporate Headquarters) - Update Required Product/System: FortiClient VPN Location: Agility Retail - Corporate Headquarters Affected Systems Count: 1 Finding summary: FortiClient VPN is a VPN client on the listed host. If the site has a FortiGate / Fortinet firewall, this VPN is expected - update it. If the site does not have that firewall, confirm with the client that they still use this VPN before updating or removing it. Use the vendor installer from support.fortinet.com. Automated / RMM updates have failed for FortiClient VPN in the past. CVE references: CVE-2026-70465 https://nvd.nist.gov/vuln/detail/CVE-2026-70465 Vendor security center: https://fortiguard.fortinet.com/psirt Additional CVEs (7 more) are listed in the Client Folder report. Minimum version to reach: Update to version 7.4.3.4726 (or the latest available). Affected Systems: - JoshDesktop - 192.168.2.54 [8 vulns] Instructions: Quick-check the host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version to reach - include the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Matching firewall, or client confirms they use this VPN - update (default) If the site has a FortiGate / Fortinet firewall: download from support.fortinet.com and run the vendor installer to reach the version listed under Minimum version to reach (or the latest available). Do not rely on RMM for FortiClient VPN. Coordinate the FortiClient version with site FortiGate firmware before upgrading. If the site does not have a FortiGate / Fortinet firewall: confirm with the client that they still use this VPN before updating. B. No matching firewall and client confirms they do not use this VPN - uninstall Confirm with the client first, then uninstall and remove leftover VPN adapters/services. C. Cannot update or uninstall - escalate to Security for suppression Use this only after confirming the VPN is in use (matching firewall or client confirmation) and it is still behind after attempting the update path. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. The client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance (do this): FortiClient VPN: manual vendor installer recommended. This VPN is expected if the site has a FortiGate / Fortinet firewall. If it does not, confirm with the client that they still use this VPN before updating or removing it. - Automated / RMM updates have failed for FortiClient VPN in the past - do not rely on them until a better path exists. - Do not use winget or automated patching for this product. - Download the updated installer from support.fortinet.com. - Transfer via ScreenConnect file transfer. - CMD console (SYSTEM OK): FortiClientVPNSetup_x.x.x.exe /quiet /norestart - Coordinate the version with site FortiGate firmware before upgrading. - Verify the version after install. Source material: Full scan exports and Top N reports are in the Client Folder at the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - WinVerifyTrust Signature Validation Vulnerability (Agility Retail - Corporate Headquarters) - Configuration Change Required
Vulnerability Remediation - WinVerifyTrust Signature Validation Vulnerability (Agility Retail - Corporate Headquarters) - Configuration Change Required Product/System: WinVerifyTrust Signature Validation Vulnerability Location: Agility Retail - Corporate Headquarters Affected Systems Count: 5 Finding summary: WinVerifyTrust Signature Validation Vulnerability is a configuration/hardening finding. Correct the listed setting(s) per Technical guidance. CVE references: CVE-2013-3900 https://nvd.nist.gov/vuln/detail/CVE-2013-3900 Affected Systems: - JoshDesktop - 192.168.2.54 [1 vulns] - LAPTOP-0VDGBMFV - 192.168.0.122 [1 vulns] - LAPTOP-AFI2HPRP - 192.168.1.217 [1 vulns] - LAPTOP-QHV00HJC - 10.0.1.69 [1 vulns] - Work-Laptop - 10.0.0.99 [1 vulns] Quick-check each host first. If the configuration is already correct or the finding does not apply, stop and escalate to Security as a false positive, including details of what was checked. Otherwise, choose change, false positive, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Correct the configuration (default) - Apply the setting change in Technical guidance. B. Finding does not apply - escalate false positive. Document what you checked; Security suppresses if appropriate. C. Client will not change/cannot change - escalate to Security for suppression. Record client notification/acceptance in discussion notes to the client. Suppression only stops tracking; it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. The client must accept or be notified, with discussion notes recording who, what, hosts, and that risk remains. Client coordination - read before changing: If this change may affect access, authentication, mail/DNS, or security posture, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must make the change. If they are unable or unwilling, escalate to Security for suppression. Technical guidance (do this): WinVerifyTrust/CVE-2013-3900 is Authenticode hardening, not a software install or Windows Update. - Set EnableCertPaddingCheck=1 under HKLM\Software\Microsoft\Cryptography\Wintrust\Config - On 64-bit hosts, also set the Wow6432Node\...\Wintrust\Config copy - Prefer domain GPO (or Intune) over one-off registry edits - Verify signed installers and vendor tools still launch after the change - Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900 Source material: Full scan exports and Top N reports are in the Client Folder under the Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Speculative Store Bypass (Agility Retail - Corporate Headquarters) - Updates Required - 3rd party application
Vulnerability Remediation - Speculative Store Bypass (Agility Retail - Corporate Headquarters) - Configuration Change Required - 3rd party application Product/System: Speculative Store Bypass Location: Agility Retail - Corporate Headquarters Affected Systems Count: 5 Finding summary: Speculative Store Bypass is a configuration/hardening finding. Correct the listed setting(s) per the technical guidance below. CVE references: CVE-2018-3639 https://nvd.nist.gov/vuln/detail/CVE-2018-3639 Affected Systems: - JoshDesktop - 192.168.2.54 [1 vulns] - LAPTOP-0VDGBMFV - 192.168.0.122 [1 vulns] - LAPTOP-AFI2HPRP - 192.168.1.217 [1 vulns] - LAPTOP-QHV00HJC - 10.0.1.69 [1 vulns] - Work-Laptop - 10.0.0.99 [1 vulns] Quick-check each host first. If the configuration is already correct or the finding does not apply, stop and escalate to Security as a false positive, including details of what was checked. Otherwise, select change, false positive, or suppress below and document the choice in the ticket. Remediation (pick the most appropriate option): A. Correct the configuration (default) - Apply the setting change per the technical guidance below. B. Finding does not apply - escalate false positive - Document what you checked; Security suppresses if appropriate. C. Client will not change or cannot change - escalate to Security for suppression - Record client notification/acceptance in discussion notes to the client (who, what, hosts, and that risk remains). - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix is applied. Client coordination - read before changing: If this change may affect access, authentication, mail/DNS, or security posture, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must make the change. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Speculative Store Bypass (CVE-2018-3639) is a Windows CPU-mitigation registry setting, not a software install. - Apply the latest Windows quality/security updates first - the registry setting does nothing without those KBs. - Enable the OS mitigation at HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management. - If FeatureSettingsOverride is missing, set FeatureSettingsOverride=8 and FeatureSettingsOverrideMask=3. - If Override already has a value, add bit 8 (SSB) per Microsoft KB4072698. Do not wipe other Spectre bits already in use. - Prefer domain GPO (or Intune) over one-off registry edits. - Reboot, then verify with: Install-Module SpeculationControl; Get-SpeculationControlSettings. - If already patched and mitigations show enabled, escalate to Security as a false positive with hostname, build, and the cmdlet output, then stop. - These mitigations can slow a busy server - discuss with the client if users will notice. - Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-3639 Source material: Full scan exports and Top N reports are in the Client Folder under the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - OpenVPN Connect (Agility Retail - Corporate Headquarters) - Update Required - 3rd party application
Vulnerability Remediation - OpenVPN Connect (Agility Retail - Corporate Headquarters) - Update Required - 3rd party application Product/System: OpenVPN Connect Location: Agility Retail - Corporate Headquarters Affected Systems Count: 1 Finding summary: OpenVPN Connect is a VPN client on the listed host. If the site has the matching firewall/VPN concentrator, this VPN is expected - update it. If the site does not have that firewall, confirm with the client that they still use this VPN before updating or removing it. CVE references: CVE-2024-8474 https://nvd.nist.gov/vuln/detail/CVE-2024-8474 Additional CVEs (2 more) are listed in the Client Folder report. Minimum version to reach: - Update to version 3.4.4 (or the latest available). Affected Systems: - JoshDesktop - 192.168.2.54 [3 vulns] Steps: 1. Quick-check the host first. Document the hostname and what you found. 2. If the product is not installed, or is already at/above 3.4.4, stop and escalate to Security as a false positive. 3. Otherwise, choose one of the remediation options below and document it in the ticket. Remediation options (pick the most appropriate): A. Matching firewall, or client confirms they use this VPN - update (default) - If the site has the matching firewall/VPN concentrator: update to 3.4.4 (or the latest available) via RMM or the vendor installer. - If the site does not have the matching firewall/VPN concentrator: confirm with the client that they still use this VPN before updating. B. No matching firewall and client confirms they do not use this VPN - uninstall - Confirm with the client first, then uninstall and remove any leftover VPN adapters/services. C. Cannot update or uninstall - escalate to Security for suppression - Use this only if you've confirmed the VPN is in use (matching firewall or client confirmation) and it is still behind after attempting the update path. - Suppression only stops tracking; it does not patch or remove the vulnerability. Residual risk remains until a real fix is applied. - The client must accept or be notified. Record discussion notes (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: - Try updates in this order: 1) RMM automated patching or software deployment (preferred); 2) ScreenConnect Backstage CMD/PS or command/script (silent installer); 3) only if 1 and 2 fail, a live remote session with the end user for in-app UI updates. - If the host is a VM, take a pre-update snapshot so you can revert if there are issues. - Confirm the product is installed on the host before making any changes. - Update to 3.4.4 (or the latest available), as listed under Minimum version to reach. - Verify the update was successful. - If the installer indicates a reboot or service restart is needed, coordinate with the client first. Source material: Full scan exports and Top N reports are in the Client Folder at the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Adobe Illustrator 2026 (Agility Retail - Corporate Headquarters) - Update Required - 3rd party application
Vulnerability Remediation - Adobe Illustrator 2026 (Agility Retail - Corporate Headquarters) - Update Required - 3rd party application Product/System: Adobe Illustrator 2026 Location: Agility Retail - Corporate Headquarters Affected Systems Count: 1 Finding summary: Adobe Illustrator 2026 is outdated on the listed host. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those methods fail. CVE references: CVE-2026-75990 https://nvd.nist.gov/vuln/detail/CVE-2026-75990 Vendor security center: https://helpx.adobe.com/security.html Additional CVEs (2 more) are listed in the Client Folder report. Minimum version to reach: Update to version 30.8 (or the latest available). Affected Systems: - JoshDesktop - 192.168.2.54 [3 vulns] Instructions: Quick-check the host first. If the product is not installed or is already at/above the minimum version to reach, stop and escalate to Security as a false positive, including the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression Use only if you verified the product exists at a vulnerable version and update/uninstall is not viable after trying the preferred methods. If the product is EOL, check for and apply the latest available final build first; if keeping it, notify the client, then escalate to Security. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. The client must accept or be notified; record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If the update may interrupt a user, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance: Try updates in this order: 1) RMM automated patching or software deployment (preferred), 2) ScreenConnect Backstage CMD/PS or command/script (silent installer), 3) only if 1 and 2 fail, a live remote session with the end user for in-app UI updates. If this host is a VM, take a pre-update snapshot so you can revert if there are issues. Confirm the product is installed on the host before making any changes. Update to the version listed under Minimum version to reach. If no minimum version is listed, use the CVE/product from this ticket plus the vendor security advisory, and document the version applied. Verify the update was successful. If the installer or firmware indicates a reboot or service restart, coordinate with the client first. Source material: Full scan exports and Top N reports are in the Client Folder under the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - unquoted service path (Agility Retail - Milwaukee) - Configuration Change Required
Vulnerability Remediation - Unquoted Service Path (Agility Retail - Milwaukee) - Configuration Change Required
Product/System: Unquoted service path
Location: Agility Retail - Milwaukee
Affected Systems Count: 3
Finding summary:
Unquoted service path is a Windows service ImagePath issue on the listed hosts (CWE-428), not a software install. ConnectSecure names the hosts, not the service. On each listed host, list unquoted services, then quote the full binary path.
Affected Systems:
- AR-MGMT-RR-06 - 10.10.100.136 [1 vulns]
- LAPTOP-CT3OBSLV - 10.10.100.107 [1 vulns]
- LAPTOP-HG7ATGBA - 10.10.100.106 [1 vulns]
Quick-check each host first. If the configuration is already correct or the finding does not apply, stop and escalate to Security as a false positive, including details of what was checked. Otherwise, choose change, false positive, or suppress below and document it in the ticket.
Remediation (pick the most appropriate option):
A. Correct the configuration (default)
Apply the setting change in Technical guidance.
B. Finding does not apply - escalate false positive
Document what you checked; Security suppresses if appropriate.
C. Client will not change / cannot change - escalate to Security for suppression
Record client notification/acceptance in discussion notes to the client. Suppression only stops tracking; it does not patch or remove the vulnerability, and residual risk stays until a real fix. The client must accept or be notified - record who, what, hosts, and that risk remains.
Client coordination - read before changing:
If this change may affect access, authentication, mail/DNS, or security posture, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must make the change. If they are unable or unwilling, escalate to Security for suppression.
===== TECHNICAL GUIDANCE (do this) =====
Unquoted service path is Windows service hardening (CWE-428), not a software install. ConnectSecure names the hosts only - it does not name the service or ImagePath.
On each listed host, use RMM or ScreenConnect Backstage PowerShell and run:
Get-CimInstance Win32_Service | Where-Object { $_.PathName -and $_.PathName -notlike '"*' -and $_.PathName -match ' ' } | Select-Object Name, PathName, State
If no rows return, the path is already quoted or has no spaces - stop and escalate to Security as a false positive with the hostname and note that the check returned none.
For each returned service, quote the full binary path (example: "C:\Program Files\Vendor\app.exe") via sc config <Name> binPath= or HKLM\SYSTEM\CurrentControlSet\Services\<Name>\ImagePath. Prefer the vendor's quoted path when they ship a fix.
Restart the service if safe; coordinate if it is user-facing. Do not uninstall the application unless it is unused. Verify ImagePath is quoted after the change.
===== END TECHNICAL GUIDANCE =====
Source material:
Full scan exports and Top N reports are in the Client Folder under the Reports location below.
Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3
Ticket created by Chris Knospe.Vulnerability Remediation - Microsoft SQL Server 2012 Native Client (Agility Retail - Boston) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft SQL Server 2012 Native Client (Agility Retail - Boston) - Update Required - 3rd party application
Product/System: Microsoft SQL Server 2012 Native Client
Location: Agility Retail - Boston
Affected Systems Count: 2
Finding summary:
Microsoft SQL Server 2012 Native Client is outdated on the listed hosts. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those methods fail.
Minimum version to reach:
Multiple bundled scanner entries report end-of-life components. Patch within each runtime line per remediation guidance, or to the latest available version.
Affected Systems:
- Agility-TC-00S3 - 10.0.1.75 [1 vulns]
- Agility-TC-000N - 10.0.1.81 [1 vulns]
Quick-check each host first. If the product is not installed or is already at/above the minimum version to reach, stop and escalate to Security as a false positive, including hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket.
Remediation (pick the most appropriate option):
A. Update (default when still needed)
- Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach, or the latest available version.
B. Not needed / not in use - uninstall or remove
- Only if the software should not exist on the host.
C. Cannot update or uninstall - escalate to Security for suppression
- Use if you verified the product exists at a vulnerable version and update/uninstall is not viable after preferred methods.
- If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security.
- Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk remains until a real fix is applied.
- The client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains).
Client coordination - READ BEFORE UPDATING:
If this update may interrupt a user, schedule it after hours or contact the client first.
If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression.
===== TECHNICAL GUIDANCE (do this) =====
- SQL Server is a database engine, not a desktop app or winget package.
- Confirm instance name, edition, and current CU/SP on each host.
- Apply the matching Cumulative Update / service pack for that major version.
- A maintenance window is required; coordinate with the DBA or app owner before stopping SQL services.
- SSMS, ODBC, and Native Client are different products - do not apply an engine CU to those.
- Verify @@VERSION / instance build after the update.
===== END TECHNICAL GUIDANCE =====
Source material:
Full scan exports and Top N reports are in the Client Folder under the Reports location below.
Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3
Ticket created by Chris Knospe.Vulnerability Remediation - Microsoft SQL Server 2012 Native Client (Agility Retail - Milwaukee) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft SQL Server 2012 Native Client (Agility Retail - Milwaukee) - Update Required - 3rd party application Product/System: Microsoft SQL Server 2012 Native Client Location: Agility Retail - Milwaukee Affected Systems Count: 2 Finding summary: Microsoft SQL Server 2012 Native Client is outdated on the listed hosts. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. Minimum version to reach: Multiple bundled scanner entries report end-of-life components. Patch within each runtime line per remediation guidance (or the latest available). Affected Systems: - LAPTOP-NQEJAOFU - 10.10.100.108 [1 vulns] - 10.10.100.112 [1 vulns] IP-only host (no hostname) - identify it before remediating: - Ping the IP to confirm it is online - Connect to the site network (VPN, ScreenConnect jump host, or on-site) if you cannot reach it from the usual tools - Check DHCP (lease, reservation, MAC) for a name - Look up the IP in RMM, ScreenConnect, Liongard, AD, DNS (reverse lookup), firewall, and switch/ARP - If still unknown: run a network scan from a trusted site host (do not scan from the internet) - Record the hostname (or device type) on the ticket before remediating - If the IP is offline, unused, or not this client: document what you checked and escalate to Security as a false positive Quick-check each host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version to reach. Include hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) - Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove - Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression - You verified it exists at a vulnerable version, and install/update/uninstall is not viable after preferred methods. - If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance (do this): SQL Server is a database engine, not a desktop app or winget package. - Confirm instance name, edition, and current CU/SP on each host - Apply the matching Cumulative Update / service pack for that major version - Maintenance window required; coordinate with the DBA or app owner before stopping SQL services - SSMS / ODBC / Native Client are different products - do not apply an engine CU to those - Verify @@VERSION / instance build after the update Source material: Full scan exports and Top N reports are in the Client Folder under Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - Microsoft SQL Server 2014 Express LocalDB (Agility Retail - Milwaukee) - Update Required - 3rd party application
Vulnerability Remediation - Microsoft SQL Server 2014 Express LocalDB (Agility Retail - Milwaukee) - Update Required - 3rd party application Product/System: Microsoft SQL Server 2014 Express LocalDB Location: Agility Retail - Milwaukee Affected Systems Count: 2 Finding summary: Microsoft SQL Server 2014 Express LocalDB is a database engine on the listed hosts. Confirm the instance or cluster, then apply the matching engine update in a maintenance window with the DBA or app owner. Minimum version to reach: Multiple bundled scanner entries report end-of-life components; patch within each runtime line per remediation guidance (or the latest available). Affected Systems: - LAPTOP-NQEJAOFU - 10.10.100.108 [1 vulns] - 10.10.100.112 [1 vulns] IP-only host (no hostname) - identify it before remediating: - Ping the IP to confirm it is online - Connect to the site network (VPN, ScreenConnect jump host, or on-site) if you cannot reach it from the usual tools - Check DHCP (lease, reservation, MAC) for a name - Look up the IP in RMM, ScreenConnect, Liongard, AD, DNS (reverse lookup), firewall, and switch/ARP - If still unknown: run a network scan from a trusted site host (do not scan from the internet) - Record the hostname (or device type) on the ticket before remediating - If the IP is offline, unused, or not this client: document what you checked and escalate to Security as a false positive Quick-check each host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version to reach. Include hostnames and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression You verified it exists at a vulnerable version, and install/update/uninstall is not viable after preferred methods. If the product is EOL: check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - READ BEFORE UPDATING: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. ===== TECHNICAL GUIDANCE (do this) ===== - SQL Server is a database engine - not a desktop app or winget package - Confirm instance name, edition, and current CU/SP on each host - Apply the matching Cumulative Update / service pack for that major version - Maintenance window required; coordinate with the DBA or app owner before stopping SQL services - SSMS / ODBC / Native Client are different products - do not apply an engine CU to those - Verify @@VERSION / instance build after the update ===== END TECHNICAL GUIDANCE ===== Source material: Full scan exports and Top N reports are in the Client Folder under Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - FortiClient VPN (Agility Retail - Milwaukee) - Update Required
Vulnerability Remediation - FortiClient VPN (Agility Retail - Milwaukee) - Update Required Product/System: FortiClient VPN Location: Agility Retail - Milwaukee Affected Systems Count: 1 Finding summary: FortiClient VPN is a VPN client on the listed host. If the site has a FortiGate / Fortinet firewall, this VPN is expected - update it. If the site does not have that firewall, confirm with the client that they still use this VPN before updating or removing it. Use the vendor installer from support.fortinet.com. Automated / RMM updates have failed for FortiClient VPN in the past. CVE references: CVE-2025-62676 https://nvd.nist.gov/vuln/detail/CVE-2025-62676 Vendor security center: https://fortiguard.fortinet.com/psirt Additional CVEs (1 more) are listed in the Client Folder report. Minimum version to reach: - Update to version 7.4.3.4726 (or the latest available). Affected Systems: - Aaron-LPT - 192.168.0.227 [2 vulns] Quick-check each host first. Stop and escalate to Security as a false positive if the product is not installed or is already at/above the minimum version to reach. Include hostnames and what you found. Otherwise choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Matching firewall, or client confirms they use this VPN - update (default) - If the site has a FortiGate / Fortinet firewall: download from support.fortinet.com and run the vendor installer to the version listed under Minimum version to reach (or the latest available). Do not rely on RMM for FortiClient VPN. - Coordinate the FortiClient version with site FortiGate firmware before upgrading. - If the site does not have a FortiGate / Fortinet firewall: confirm with the client that they still use this VPN before updating. B. No matching firewall and client confirms they do not use this VPN - uninstall - Confirm with the client first. Then uninstall and remove leftover VPN adapters/services. C. Cannot update or uninstall - escalate to Security for suppression - You confirmed it is in use (matching firewall or client confirmation) and still behind after the update path. - Suppression only stops tracking. It does not patch or remove the vulnerability. Residual risk stays until a real fix. - Client must accept or be notified. Record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - READ BEFORE UPDATING: If this update may interrupt a user, schedule after hours or contact the client first. If another vendor manages this application, device, workstation, or server: that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. ===== TECHNICAL GUIDANCE (do this) ===== - FortiClient VPN: manual vendor installer recommended - Automated / RMM updates have failed for FortiClient VPN in the past - do not rely on them until a better path exists - Do not use winget or automated patching for this product - Download updated installer from support.fortinet.com - Transfer via ScreenConnect file transfer - CMD console (SYSTEM OK): FortiClientVPNSetup_x.x.x.exe /quiet /norestart - Coordinate version with site FortiGate firmware before upgrading - Verify version after install ===== END TECHNICAL GUIDANCE ===== Source material: Full scan exports and Top N reports are in the Client Folder under Reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Vulnerability Remediation - powershellv2 (Agility Retail - Milwaukee) - Update Required
Vulnerability Remediation - powershellv2 (Agility Retail - Milwaukee) - Update Required Product/System: powershellv2 Location: Agility Retail - Milwaukee Affected Systems Count: 1 Finding summary: powershellv2 is outdated on the listed host. Update via RMM or a silent installer in Backstage CMD/PS. Use a live user session only if those fail. Minimum version to reach: Disable Windows PowerShell 2.0 on the system (or update to the latest available). Affected Systems: - Aaron-LPT - 192.168.0.227 [1 vulns] Quick-check the host first. If the product is not installed or is already at/above the minimum version to reach, stop and escalate to Security as a false positive, including the hostname and what you found. Otherwise, choose update, remove, or suppress below and document it in the ticket. Remediation (pick the most appropriate option): A. Update (default when still needed) Install the updated vendor package (wizard/RMM) to the version listed under Minimum version to reach (or the latest available). B. Not needed / not in use - uninstall or remove Only if the software should not exist on the host. C. Cannot update or uninstall - escalate to Security for suppression Use only if you verified the product exists at a vulnerable version and install/update/uninstall is not viable after trying the preferred methods. If the product is EOL, check/apply the latest available final build first; if keeping it, notify the client, then escalate to Security. Suppression only stops tracking - it does not patch or remove the vulnerability, and residual risk remains until a real fix is applied. The client must accept or be notified; record discussion notes to the client (who, what, hosts, and that risk remains). Client coordination - read before updating: If this update may interrupt a user, schedule it after hours or contact the client first. If another vendor manages this application, device, workstation, or server, that vendor or the service owner must perform the update. If they are unable or unwilling, escalate to Security for suppression. Technical guidance (do this): Try updates in this order: 1. RMM automated patching or software deployment (preferred) 2. ScreenConnect Backstage CMD/PS or command/script (silent installer) 3. Only if 1 and 2 fail: live remote session with the end user for in-app UI updates If this host is a VM, take a pre-update snapshot so you can revert if there are issues. Identify the product from the Product and host list, and confirm it is installed on the host before changing anything. Update/configure to the version listed under Minimum version to reach when present. If no minimum version is listed, use the CVE/product from this ticket plus the vendor security advisory, and document the version applied. Verify the update was successful. If the installer or firmware indicates a reboot or service restart is needed, coordinate with the client first. Source material: Full scan exports and Top N reports are in the Client Folder under the reports location below. Reports location (Client Folder): ...\Agility Retail\Network Documentation\Vulnerability Scans\2026 - Q3 Ticket created by Chris Knospe.
Good evening Jennifer,
Your quarterly vulnerability scan covers these locations. Each location has its own report folder.
Reports by location:
Agility Retail - Boston
Open Agility Retail - Boston report folder
Open Agility Retail - Boston Top Ten report
Agility Retail - Chicago - Cicero
Open Agility Retail - Chicago - Cicero report folder
Open Agility Retail - Chicago - Cicero Top Ten report
Agility Retail - Chicago North
Open Agility Retail - Chicago North report folder
Open Agility Retail - Chicago North Top Ten report
Agility Retail - Corporate Headquarters
Open Agility Retail - Corporate Headquarters report folder
Open Agility Retail - Corporate Headquarters Top Ten report
Agility Retail - E-Comm Cumberland
Open Agility Retail - E-Comm Cumberland report folder
Open Agility Retail - E-Comm Cumberland Top Ten report
Agility Retail - Los Angeles
Open Agility Retail - Los Angeles report folder
Agility Retail - Milwaukee
Open Agility Retail - Milwaukee report folder
Open Agility Retail - Milwaukee Top Ten report
Agility Retail - Minneapolis
Open Agility Retail - Minneapolis report folder
Open Agility Retail - Minneapolis Top Ten report
Agility Retail - San Diego
Open Agility Retail - San Diego report folder
Open Agility Retail - San Diego Top Ten report
Each location folder contains:
• Pending Remediation EPSS Score Report - classifies vulnerabilities by Exploit Prediction Scoring System (EPSS), which measures the likelihood of exploitation within 30 days (scale 0-1.0, with 1.0 being most critical).
• All Vulnerabilities Report - agent-detected vulnerabilities on managed assets (applications, OS patches, and related findings), from critical to low severity.
• Executive Summary Report - a high-level overview of your security posture and network information.
• External Scan - detected vulnerabilities and services exposed to the internet.
• Suppressed Vulnerabilities Report - vulnerabilities that have been suppressed (e.g., false positives or accepted risk) and will not appear on future remediation lists.
Not all vulnerabilities may be feasible to remediate depending on business or technical constraints.
Note: Remediation tickets have been generated for items covered under your RMIT+ agreement. Third-party items not covered under the agreement will not be remediated unless we discuss them and a quote has been generated. To schedule a discussion, please use the scheduling link above.
We appreciate your commitment to security. Addressing these vulnerabilities is essential for maintaining the protection of your systems.
Sincerely,
Chris Knospe
Check the findings you want as Manage remediation tickets, then click Create selected Manage tickets.
Each selected finding gets its own Manage ticket.
Review's Ticket column pre-checks likely items; you can change the selection here.
Location tags are included in each ticket body. Expand a finding to edit the subject or body before you create the ticket.
Use Copy subject / Copy section for manual paste instead.
Where should these tickets go?
Default leaves the ticket for reclassification. Send to security opens it on the Security board as Dispatch. Assign to me puts it on you as Scheduled Internal.