Exploited bugs, new critical vulnerabilities, and what defenders should check.
Analysis4 min read
The researcher says the flaw lets a local user reach System by making Windows Defender create a signature file at a path they choose. Microsoft hasn't commented, and there's no sign of exploitation in the wild.
ExploitedCVE-2026-123039CVSS 7.84 min read
CVE-2026-123039 covers a world-writable local socket on Check Point gateways and management servers. CISA added it to its known exploited vulnerabilities list on 13 November 2026, with a remediation due date of 16 November.
CVE-2026-125881CVSS 9.34 min read
N-able says every unauthenticated flaw in the Able2Shell dump is fixed in N-central 2026.4 HF2, and that it has seen scanning but no compromise of hosted servers. The authenticated bugs are still open.
CVE-2026-119618CVSS 8.14 min read
Apache HTTP Server 2.4.71 fixes a race condition in mod_http2 that Red Hat scored 9.8, reported independently by Anthropic's OSS Scanner and Google researchers. Only servers with HTTP/2 enabled are affected.
ExploitedCVE-2026-18577CVSS 8.24 min read
The vendor shut its hosted environments on November 9 and told on-premises customers to do the same, while it works on a hotfix. It says it hasn't seen exploitation in the wild.
ExploitedCVE-2026-116606CVSS 9.34 min read
Barracuda says attackers have chained an ESG authentication bypass with a command injection bug against a small number of organizations. CISA gave federal agencies three days to patch.
CVE-2026-125883CVSS 9.34 min read
N-able released N-central 2026.4 HF2 for seven flaws disclosed publicly on November 8, after taking hosted environments offline and telling on-premises customers to do the same.
Analysis4 min read
A threat actor has been using a critical Xen Orchestra authentication bypass to gain admin access, and a second flaw the same actor used has no fix yet. Vates says unauthorised access isn't logged.
ExploitedCVE-2026-20320CVSS 7.54 min read
Both bugs leak sensitive information rather than hand over code execution, and both have vendor fixes. Federal agencies have until November 24 to patch.
CVE-2026-120017CVSS 10.04 min read
SAP published 42 new and updated notes, nine of them critical. Two of the maximum-severity bugs sit in the kernel, which means the affected release list runs past the versions still in maintenance.
Analysis4 min read
Vates says attackers are using a crafted cookie to log in as existing token owners on Xen Orchestra, with the path leading to root on XCP-ng hosts. Patched xo-server packages are out.
Analysis3 min read
An independent researcher published details and proof-of-concept code for 33 issues in the RMM platform. N-able says it has seen scanning but no successful exploitation, and has no hotfix out yet.
