12 verified findings from 1 run · 8 updates to prior coverage · the settled record for this UTC day, in the classic brief order.
Criticality
Kind
Topic
Region
TL;DR · the day in one read
01Outlook zero-day CVE-2026-124194 exploited: a crafted message file leaks authentication data; install the Office update. Microsoft's November 2026 Patch Tuesday fixes CVE-2026-124194, an Outlook spoofing flaw (CVSS 3.1 6.5) that Microsoft marks as exploited and not publicly disclosed and that CISA added to its Known Exploited Vulnerabilities catalog on 2026-11-10: a user who opens a crafted message file lets Outlook connect to an attacker-controlled location without the usual external-content warning, which can disclose authentication information. The Preview Pane is not an attack vector; BleepingComputer reports that the disclosed credential is the user's NTLMv2 hash, and no source names the actor or the victims. →
02Chrome zero-day CVE-2026-125350 exploited: update Chrome and relaunch; Edge for Android fixed, Edge desktop pending. Google's Stable-channel update of 2026-11-09 says an exploit for CVE-2026-125350, a high-severity use-after-free in Chromium's XML component, exists in the wild; CISA added it to its Known Exploited Vulnerabilities catalog on 2026-11-10 and no source describes the attacks. The fix is in Stable 157.0.8103.50 (Linux) and 157.0.8103.50 or .51 (Windows, macOS) and in Extended Stable 156.0.8078.96, all of 2026-11-09, later Stable and Extended Stable builds of 2026-11-11 include it, and Microsoft's notes list the fix in Edge for Android 157.0.4341.53 while no Edge desktop release names it yet. →
03Stolen Qubole vendor credentials assumed customers' idle AWS integration roles; a source-IP condition stops it. Wiz, working with Sentra and Mandiant, reports that between 2026-10-14 and 2026-10-26 an actor used IAM credentials from an AWS account associated with the data platform Qubole to assume customers' cross-account integration roles, each call carrying the correct External ID; most roles had otherwise been idle. Inside each account the actor listed resources, read Secrets Manager, Parameter Store and Lambda configuration, tested harvested AWS, Entra ID and Okta credentials with TruffleHog and downloaded S3 data, in some cases whole buckets; no victim is named, the counts range from more than a dozen to dozens, and how the vendor identities were compromised is not known. →
Insikt Group describes GhostFrame, a previously undocumented command-and-control and post-exploitation framework for compromised VMware ESXi hosts, which it saw used by TAG-218, a group "whose operations overlap with Settra ransomware" (Recorded Future, 2026-11-10). Operators must already hold root on the host: the implant, an ELF named vmhostd-core generated from a web operator panel, does not exploit a vulnerability to gain access (Recorded Future, 2026-11-10). It copies itself to /opt/vmhostd-core, edits the ESXi boot script /etc/rc.local.d/local.sh and runs /sbin/auto-backup.sh to keep the change across reboots, masquerades as vmhostd (resembling VMware's vmware-hostd), and about every five seconds disables the ESXi firewall and the execInstalledOnly control that restricts execution of unsigned binaries, so an administrator who re-enables them is undone (Recorded Future, 2026-11-10). Its command channel opens simultaneous TCP connections to one address on ports 53, 2222, 3389, 4444, 8443 and 9443, keeps the first that succeeds and retries after a random delay of 5 to 12 seconds, which Insikt notes is a network detection opportunity; the implant is mainly an in-memory shellcode loader with a reverse-shell fallback.
From the hypervisor the panel can list registered VMs, change power state, create or delete snapshots, enable VNC on a guest, run a SOCKS5 proxy for pivoting, intercept ESXi logins, and run the open-source VMkatz against VM memory snapshots, virtual disks or whole datastores to recover NTLM hashes, Kerberos tickets, SAM and LSA secrets and NTDS.dit data without running anything inside the guest (Recorded Future, 2026-11-10). Insikt ties TAG-218's victim-facing servers to VPN-appliance targeting across the US and Europe between late August and October 2026, "predominantly SonicWall, Palo Alto Networks, and Fortinet devices", and says four of those organisations later appeared on the Settra leak site; it assesses that other financially motivated actors are highly likely to adopt the framework, which is an assessment, not an observation (Recorded Future, 2026-11-10). Unit 42 independently reports that after CVE-2026-0257 exploitation attackers pivot from the VPN gateway directly to the virtualization layer (Palo Alto Networks Unit 42, 2026-10-20).
Triage: administrators legitimately edit local.sh, create snapshots and use VNC; the discriminators are a firewall-off and execInstalledOnly loop, a binary under /opt named vmhostd where the genuine daemon is vmware-hostd, and snapshot-file reads by a non-backup account.
Insikt Group identified GhostFrame being used by TAG-218, a threat activity group whose operations overlap with Settra ransomware.
Operators must already have root-level access to the ESXi host to deploy and execute the implant, as the implant does not exploit a vulnerability to gain access.
These commands run approximately every five seconds, allowing the implant to disable the controls again if an administrator attempts to restore them.
targeting virtual private network (VPN) appliances across the US and Europe between late August and October 2026, predominantly SonicWall, Palo Alto Networks, and Fortinet devices.
The most significant evolution in tactics, techniques and procedures (TTPs) following successful exploitation of CVE-2026-0257 is the direct pivot to the virtualization layer.
ESET found a previously undocumented .NET toolset, Cereal, on a Kazakh government organisation's Exchange server on 2025-11-28 and, after tuning its detections, on a Romanian government organisation's Exchange server compromised from 2025-12-23; in Romania the mail-collection module was configured to identify messages to or from NATO and EU institutional addresses (ESET Research, 2026-11-10). ESET attributes Cereal to Turla with high confidence, on the concurrent use of another component publicly linked to Turla and conceptual similarity to older Turla malware, and could not determine the initial access method, although it considers a vulnerability exploit possible because the servers are reachable from the internet (ESET Research, 2026-11-10).
The command channel is the victim's own Exchange server. CerealNeuron runs on the compromised server and passively waits for requests on web paths made to look like Outlook Web Access, Autodiscover and ActiveSync traffic; a correctly encrypted request is treated as a command and a bad one gets a normal-looking Exchange error page, and ESET found no operator-controlled server and could not identify ingress addresses (ESET Research, 2026-11-10). CerealHermit is a network-less variant that reads encrypted command files from disk, and each task runs as a small .NET assembly inside a CerealRunner (mailbox retrieval, Active Directory and WMI queries, LSA secrets extraction, file operations) (ESET Research, 2026-11-10). CerealLoader, the only component written to disk in recognisable .NET form, abuses .NET VTable fixups so native code runs before managed code and is placed where trusted processes load it: the System32 wbem directory (ncobjapi.dll, wbemcomn.dll, loaded by WMI) and the .NET native image cache (ESET Research, 2026-11-10). CerealBox, injected into EdgeTransport.exe, wraps the handlers of transport agents already loaded, so "no new agent appears anywhere in Exchange's configuration"; it keeps messages with .doc, .docx or .pdf attachments that match hard-coded sender, recipient, subject or attachment-name lists and stages them compressed and encrypted on disk for exfiltration through CerealNeuron (ESET Research, 2026-11-10).
Triage: third-party anti-spam, data-loss-prevention and archiving products also inject into the transport service, but they are vendor-signed and appear in the transport-agent configuration, which CerealBox does not; the native image cache regenerates legitimately after .NET updates, so a changed timestamp alone is weak, while a file that does not match the Microsoft binary is the signal.
Instead – adding insult to injury – the victim’s compromised Exchange server is co-opted to act as the C&C infrastructure.
We attribute Cereal, with high confidence, to the Russia-aligned APT group Turla, based on the concurrent use of another component publicly linked to Turla and conceptual similarities to older Turla malware.
Once inside, CerealBox accesses Exchange’s internal structures, finds the existing transport agents, and wraps their handlers with malicious code.
No new agent appears anywhere in Exchange’s configuration.
it was configured to identify emails sent to, or received from, The North Atlantic Treaty Organization (NATO) and European Union (EU).
Check Point Research's year-long investigation groups three intrusion sets under one malware-supply entity it calls CopperDragon, a possible "digital quartermaster" for China-nexus actors that use the cross-platform Sparrow framework (FamousSparrow and Earth Estries among them); Check Point itself cautions that the use of the same backdoor or C2 infrastructure "does not necessarily mean" the same actor ran two intrusions, so this is a hypothesis (Check Point Research, 2026-11-10).
SilentDelivery, active since early 2026 against Europe and Asia, is the set nearest the constituency. Compromised government, shipping, IT and research websites, one through cross-site scripting in an unsanitised input field, carry obfuscated JavaScript that fingerprints the visitor and replaces the page with a language-localised fake Google Chrome SSL warning urging a "Certificate Fix" utility; the MSI, served from compromised cloud storage buckets, installs the new SquadC backdoor or a SparrowDoor variant (Check Point Research, 2026-11-10). SquadC can be set to run only while a browser process is alive, persists through a Run key named WindowsUpdateAssist, and offers file operations, command execution and screenshots. A second route is a spear-phishing RAR whose LNK abuses ftp.exe, with the same C2 (Check Point Research, 2026-11-10). Positive Technologies independently documented the same fake-certificate chain, with victims in Taiwan, Germany, Indonesia and the Czech Republic (Positive Technologies, 2026-08-21).
The other two sets show what follows an intrusion. OceanGate in Asia starts from an exploited internet-facing Linux server and moves through trojanised ssh and sshd binaries that log passwords, a Linux backdoor that can load a kernel rootkit, FRP and Chisel tunnels, a hidden local administrator account and an LSA security-package credential interceptor; recent SparrowDoor builds embed the WinDivert driver to share a service port such as 443. DarkWire against Latin American telecom and government bodies uses DLL sideloading of uncommon executables, SoftEther VPN renamed to system-process names, DNS MX tunnelling and WMI lateral movement (Check Point Research, 2026-11-10). No Swiss victim is named.
Triage: WinDivert is legitimate in VPN and firewall products, so the signal is a parent that is a sideloaded DLL or backdoor rather than the vendor's signed service; SoftEther is legitimate software, but not under a system-process name in a non-system path; a genuine Chrome SSL warning is never cleared by installing an MSI.
The fake warning blocked access to the website and instructed the user to install a “Certificate Fix” utility.
All the compromised websites we confirmed were related to the government, shipping, and IT and research sectors.
Based on Check Point telemetry, the operations primarily targeted organizations in countries such as the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia.
However, the use of the same backdoor or C2 infrastructure does not necessarily mean that two intrusions were conducted by the same actor.
Based on the samples we identified, we determined that the threat actor used an infection chain involving compromised websites and fake certificates in at least four locations: Taiwan, Germany, Indonesia, and the Czech Republic.
Wiz, working with Sentra and Mandiant, observed a threat actor using IAM credentials from an AWS account associated with Qubole, a big-data platform, between 2026-10-14 and 2026-10-26 (Wiz, 2026-11-09). The actor used two Qubole IAM users to call sts:AssumeRole on the cross-account integration roles that customers had created to trust Qubole's account; "every AssumeRole request we attributed to the threat actor included an External ID, and every one succeeded", most of the roles were otherwise not in use, and the traffic came from a rented hosting server and commercial VPN exits, not the AWS infrastructure where legitimate platform traffic originates (Wiz, 2026-11-09; Sentra, 2026-11-09).
Inside each account the actor enumerated resources, read Lambda function configuration, Secrets Manager and Systems Manager Parameter Store, ran TruffleHog to test AWS access keys, Entra ID service-principal client secrets and Okta client credentials it found, and then downloaded S3 data opportunistically, in some cases whole buckets in one session (Wiz, 2026-11-09). Wiz found no tie to other reported activity and judges the targeting opportunistic; how the Qubole IAM users were compromised is not stated. Sentra writes that dozens of Qubole customers were impacted, and BleepingComputer could not find a public Qubole announcement (Sentra, 2026-11-09; BleepingComputer, 2026-11-10). No Swiss or public-sector victim is named, but the exposure is shared by any account that gave a data or analytics vendor a cross-account role and left it in place.
Triage: legitimate vendor traffic comes from the vendor's own AWS infrastructure; the correct External ID does not discriminate, because it is logged in plaintext and often stored by the vendor, while a vendor role assumed from a consumer VPN or a hosting provider the vendor has never used is the high-signal case.
Working with Sentra and Mandiant, Wiz observed a threat actor using IAM credentials from an AWS account associated with Qubole between October 14 and October 26, 2026.
Every AssumeRole request we attributed to the threat actor included an External ID, and every one succeeded.
In this activity, a source IP condition alone would have blocked every role assumption we observed.
Microsoft's November 2026 Patch Tuesday fixes CVE-2026-124194, an Outlook spoofing flaw (CWE-356, the product does not warn the user of an unsafe action) scored CVSS 3.1 6.5, which the Security Update Guide marks as exploited and not publicly disclosed (Microsoft, 2026-11-10). Microsoft's FAQ says an unauthenticated attacker sends a crafted message file and convinces the user to open it, whereupon Outlook may connect to an attacker-controlled network location without showing the usual external-content warning, "potentially disclosing authentication information that could be used to impersonate the user"; the Preview Pane is not an attack vector, so the file has to be opened (Microsoft, 2026-11-10). CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-11-10 (CISA, 2026-11-10), and BleepingComputer counts it as the one actively exploited zero-day of this Patch Tuesday (BleepingComputer, 2026-11-10). The affected products are Outlook in Microsoft 365 Apps for Enterprise, Office LTSC 2024 (fixed in 16.0.17932.21140) and Office LTSC 2021 (fixed in 16.0.14334.21048); Microsoft 365 Apps take the fix through the Office security-update channel (ENISA EUVD, 2026-11-10). BleepingComputer calls it an NTLM credential disclosure flaw: opening the attachment makes Windows connect to an attacker-controlled share and expose the user's NTLMv2 hash, which can be captured and cracked offline (BleepingComputer, 2026-11-10). No source names the actor or the victims.
Triage: Outlook legitimately contacts SharePoint, OneDrive and corporate file servers; the discriminator is an external, non-corporate destination preceded by the opening of a message file.
Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user.
Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector.
Microsoft
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Google's Stable-channel update of 2026-11-09 moves Chrome to 157.0.8103.50 on Linux and 157.0.8103.50/.51 on Windows and macOS and states "Google is aware that an exploit for CVE-2026-125350 exists in the wild" (Google, 2026-11-09). CVE-2026-125350 is a high-severity use-after-free in the XML component, reported by Arni Hardarson (Neonix Security) on 2026-10-12 and by an anonymous reporter on 2026-11-06 (Google, 2026-11-09). The Extended Stable update of the same day, 156.0.8078.96, lists the CVE as well (Google, 2026-11-09). CISA added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog on 2026-11-10 (CISA, 2026-11-10) and describes it as a flaw that could let a remote attacker execute arbitrary code inside the sandbox through a specially crafted webpage (CISA, 2026-11-10). No source describes the attacks: SecurityWeek, which counts it as the eighth Chrome zero-day of the year, writes that no information appears to be available on them (SecurityWeek, 2026-11-10). NCSC Switzerland rates the flaw as actively exploited (NCSC Switzerland, 2026-11-10). Microsoft's Edge release notes state that Edge for Android 157.0.4341.53 contains the fix, list no Edge desktop release that names the CVE and still say Microsoft is working on a security fix (Microsoft, 2026-11-11).
Triage: renderer crashes are common and benign; the discriminator is what follows them on the same host.
Google is aware that an exploit for CVE-2026-125350 exists in the wild.
High CVE-2026-125350: Use after free in XML. Reported by Arni Hardarson (Neonix Security) on 2026-10-12 and anonymous on 2026-11-06
Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage.
Google released Stable 157.0.8103.78/.79 on 2026-11-11 with 83 security fixes, five of them Critical use-after-free bugs (Google, 2026-11-11), and Extended Stable 156.0.8078.100 the same day with 72 fixes, four of them Critical (Google, 2026-11-11); neither post lists the XML use-after-free again, and both builds are later than the fixed ones. Microsoft's Edge release notes of the same day list Edge for Android 157.0.4341.53 as containing the fix, while the newest Edge desktop release on the page is 157.0.4341.42 of 2026-11-05 and names no CVE (Microsoft, 2026-11-11). Google's Stable page for 157.0.8103.50 files Chromium bug 572578603 inside the row for the exploited flaw (Google, 2026-11-09). Its Extended Stable page of the same day lists the same bug as a separate High row under its own CVE id (Google, 2026-11-09); both pages list it as fixed and differ only on its CVE id.
Atlassian's advisory of 2026-11-09 says Confluence uses the third-party library Apache Axis in its XML-RPC and SOAP APIs and that Apache Axis has published a critical vulnerability, CVE-2026-90436, that allows remote code execution (Atlassian, 2026-11-09). A Confluence Data Center instance is vulnerable only if the "Remote API (XML-RPC & SOAP)" setting is enabled; the setting has been off by default for new installations since Confluence 3.0 and the feature was removed in Confluence 10.0, so 10.x is not affected, nor is Confluence Cloud (Atlassian, 2026-11-09). Atlassian scores the flaw 9.3 (CVSS 4.0, network vector, no privileges, no user interaction), lists Confluence Data Center 1.x to 9.x as affected and 9.2.28 as the fixed version (Atlassian, 2026-11-09). If patching must wait, clearing the Remote API checkbox needs no restart, and a request to the soap-axis1 confluenceservice-v2 servlet path should then answer HTTP 403. Atlassian says it "cannot confirm if your instances have been affected" and asks teams to check affected instances for compromise (Atlassian, 2026-11-09); no source reports exploitation, and BSI CERT-Bund's bulletin rates the issue high (BSI CERT-Bund, 2026-11-10).
Apache Axis has published a critical vulnerability (CVE-2026-90436) that allows remote code execution.
Atlassian cannot confirm if your instances have been affected by this vulnerability.
Synology's advisory SA-26:19 of 2026-11-10, severity Critical, fixes two DiskStation Manager flaws that need no credentials and lists no mitigation (Synology, 2026-11-10). CVE-2026-76954 (CVSS 9.8) is an SQL injection in the Auth API that lets remote attackers read or write arbitrary files and cause denial of service; CVE-2026-85101 (8.6) is an authentication bypass in the rsync service that lets remote attackers read specific files, write arbitrary files and cause limited denial of service (Synology, 2026-11-10). DSM is fixed in 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10 and 7.2.1-69057-13 (Synology, 2026-11-10; CERT-FR, 2026-11-10). The sources mention neither exploitation nor a public proof of concept.
An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
Ivanti's CNA records of 2026-11-10 describe CVE-2026-121653 as an SQL injection in the Core of Ivanti Endpoint Manager before 2024 SU8 that "allows a remote unauthenticated attacker to achieve remote code execution", scored CVSS 3.1 9.8 with a network vector, low complexity, no privileges and no user interaction (Ivanti via ENISA EUVD, 2026-11-10). A second record, CVE-2026-121683, describes missing authentication in Ivanti Cloud Services Application version 5.0.8 that lets a remote unauthenticated attacker add and delete arbitrary trusted EPM Core certificate entries, scored 9.4 (Ivanti via ENISA EUVD, 2026-11-10). The first is fixed in 2024 SU8; the second record names 5.0.8 as the affected version in its text and again in its patch field, so it does not settle which build fixes it. Neither record states exploitation, and Ivanti's advisory pages, which would carry the exploitation statement and mitigations, could not be read, so the whole account rests on the two CNA records.
SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.
Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.
Adobe's priority 2 bulletin APSB26-191, published on 2026-11-10, fixes 24 CVEs in Adobe Connect on Windows 12.12 and earlier (Adobe, 2026-11-10). Five of them are scored CVSS 3.1 10.0 with the vector AV:N/AC:L/PR:N/UI:N/S:C, so an attacker needs no account and no user interaction: two server-side request forgeries (CVE-2026-121356, CVE-2026-121889), a path traversal (CVE-2026-121351), an incorrect-authorization flaw (CVE-2026-121352) and a CRLF injection (CVE-2026-121353); Adobe describes the impact of all five as privilege escalation (Adobe, 2026-11-10). Two more rows need no privileges either: an SQL injection leading to code execution (CVE-2026-121902, 9.4) and an incorrect-authorization flaw (CVE-2026-121355, 9.1), and a further group of authenticated rows is fixed in the same release (Adobe, 2026-11-10). The fixed builds are 12.12.a, 12.11.i, 12.10.f, 12.9.a and 12.8.a (Adobe, 2026-11-10). The bulletin gives no root-cause detail, names no workaround, and Adobe says it is not aware of exploitation.
Adobe has released a priority 2 security update for Adobe Connect.
Microsoft's November 2026 Patch Tuesday fixes seven flaws in domain infrastructure and server roles scored CVSS 3.1 9.8 that need no credentials over the network (the release carries further 9.8 rows, DirectMusic among them, that are not covered here (Microsoft, 2026-11-10)); the only record Microsoft marks as exploited in this release is the Outlook zero-day, which is a separate item, and none of these rows is marked exploited or publicly disclosed (Microsoft, 2026-11-10; BleepingComputer, 2026-11-10). Two have mechanics that make the timeline short. CVE-2026-85844 is an authentication bypass in Windows Kerberos: an unauthenticated attacker sends crafted Kerberos authentication traffic and relays the resulting authentication to an affected domain controller, with no user interaction (Microsoft, 2026-11-10). CVE-2026-116928 is an out-of-bounds write in the Windows Search component that Exchange Server uses: an attacker emails a crafted attachment, Exchange indexes it automatically, so "the recipient does not need to open the email or attachment", and the code runs with the permissions of the processing service (Microsoft, 2026-11-10).
The other five are described more thinly: a double free in Windows DNS (CVE-2026-88218) (Microsoft, 2026-11-10), an out-of-bounds read in Windows DHCP Server (CVE-2026-88243) (Microsoft, 2026-11-10) and a release of an invalid pointer in Windows iSCSI (CVE-2026-88234) (Microsoft, 2026-11-10), each reachable by an in-network attacker calling arbitrary endpoints; an out-of-bounds write in the Windows LDAP service that gives code execution in its context through crafted LDAP calls (CVE-2026-119958) (Microsoft, 2026-11-10); and a heap overflow in SQL Server (CVE-2026-116945) that needs an attacker who controls a network endpoint an integration package connects to, with no credentials or user interaction when the package runs automatically (Microsoft, 2026-11-10). The fixes are the November cumulative updates per release, for example KB5131291 (Windows Server 2016), KB5131085 (Server 2019), KB5131090 (Server 2022) and KB5131080 or KB5131077 (Server 2025), and the November SQL Server updates, for example KB5129299 (2025 CU10) and KB5129300 (2022 CU27).
An unauthenticated attacker could send specially crafted Kerberos authentication traffic and relay the resulting authentication to an affected domain controller.
Exchange automatically processes the attachment for indexing, so the recipient does not need to open the email or attachment.
Double free in Windows DNS allows an unauthorized attacker to execute code over a network.
An unauthenticated attacker who successfully exploited this vulnerability could gain code execution through a specially crafted set of LDAP calls to execute arbitrary code within the context of the LDAP service.
The attacker does not need SQL Server credentials or additional user interaction when the package runs automatically.
Vates published advisory VSA-2026-062 on 2026-11-10, rated Critical, for Xen Orchestra and the Xen Orchestra Appliance (XOA), the web management plane for XCP-ng pools; no CVE id or CVSS score has been assigned (Vates, 2026-11-10; BleepingComputer, 2026-11-10). Vates says a threat actor is actively exploiting the flaw, that an adversary can bypass authentication and act with Admin privilege, and that a compromise can lead to arbitrary code execution on managed pools and a full takeover of XCP-ng nodes as root (Vates, 2026-11-10). The mechanism, per Vates: the REST cookie parser turns an authenticationToken cookie of j:%7B%7D into an empty object, the REST authentication path hands that object to the token provider without requiring a string, the token lookup treats it as unfiltered and returns the first token, and the provider authenticates as that token's owner if the token has not expired; the authenticated token-listing route then returns reusable login token ids (Vates, 2026-11-10). The attacker needs network reach to the interface and an unexpired first token in the Xen Orchestra token store, and no credentials or user interaction.
Xen Orchestra before 6.9.2 (stable) and before 6.10.1 (latest) is affected, and the fixes are xo-server 5.211.2 on the stable channel and 5.213.1 on the latest channel; a source install must move to the latest master (Vates, 2026-11-10). BleepingComputer gives different release numbers, so check the installed xo-server version rather than the release label (BleepingComputer, 2026-11-10).
This vulnerability is actively exploited by a threat actor
An adversary can bypass authentication and perform actions with 'Admin' privilege.
In the case of a successful exploitation, there is no log to detect unauthenticated access.
Vates
A CVE identifier and CVSS score have not been assigned yet.
Veeam's KB4966 of 2026-11-10 adds the Veeam Software and Infrastructure Appliances, workers, Linux-based helper appliances and recovery media to the affected products, with the fixed CIQ kernel delivered through Veeam Updater since 2026-11-02 and a private fix for helper appliances managed from Windows servers; Ubuntu's tracker now lists the generic 22.04, 24.04 and 26.04 LTS kernels as fixed while 20.04 and older and some variant kernels remain in progress, and the body states again that the CNA and upstream score the flaw differently.
Veeam's impact statement KB4966, last modified on 2026-11-10, says that every Veeam component that includes a Linux kernel is affected until the kernel is updated: Veeam Software Appliance 13.1, Veeam Infrastructure Appliance 13.1 in any role (backup proxies, repositories including hardened repositories, gateways, mount servers, WAN accelerators and others), workers deployed by the hypervisor plug-ins, the Linux-based helper appliances of Veeam Backup & Replication 13.1 and 12.3, Veeam Recovery Media for the Agent for Linux created before the update, and the public-cloud plug-in appliances; Kasten for Kubernetes is not affected (Veeam, 2026-11-10). The fixed kernel, a CIQ build 5.14.0-570.60.1+27.2.el9_6_ciq, has been in the Veeam repository since 2026-11-02; Veeam Updater checks every 12 hours and, with the default configuration, installs mandatory updates on the nearest Sunday at 14:00 in the backup server's time zone, a restart may be required, Windows-based Backup & Replication servers need a private fix for their helper appliances, and virtual labs and helper appliances that stay deployed must be redeployed (Veeam, 2026-11-10).
Ubuntu's tracker, updated on 2026-11-10, now lists 26.04 LTS (linux 7.0.0-43.43), 24.04 LTS (6.8.0-149.149) and 22.04 LTS (5.15.0-203.213) as fixed alongside 26.10 for the generic linux package, with 20.04, 18.04 and 16.04 and some HWE, FIPS, NVIDIA, Azure and Raspberry Pi variant kernels still in progress (Canonical, 2026-11-10).
SonicWall's advisory of 2026-11-10 says SonicOS firewalls with Client DPI-SSL enabled kept trusting the compromised eMudhra chains and re-signed them for clients; fixed in SonicOS 7.3.4-7015 (Gen7) and 8.2.3-8015 (Gen8), so a Gen7 unit on 7.3.4-7013 is still affected. Apple's macOS 27.2.1, 26.7.3 and 15.8.3 now block the certificates in the command-line tools, Microsoft removes the remaining eMudhra roots from Windows, Edge and WebView2 from 2026-11-16, and Cisco's advisory is at version 1.9.
SonicWall's informational advisory SNWLID-2026-0021 of 2026-11-10, which has no CVE and no workaround, says SonicOS appliances with Client DPI-SSL enabled continued to trust certificate chains issued by the compromised eMudhra intermediate CAs because the firewall's local certificate store trusted the underlying roots, and that the firewall then re-signed traffic from the impacted servers with its local DPI-SSL CA certificate, preventing client browsers from rejecting connections signed by the untrusted intermediates (SonicWall, 2026-11-10; SonicWall advisory data, 2026-11-10). SonicWall removed the affected root certificates from the SonicOS certificate store and added blocking logic for the compromised chain. Affected are Gen7 hardware firewalls (TZ 270 to TZ 670, NSa 2700 to 6700, NSsp 10700 to 15700) and Gen7 NSv up to 7.3.4-7013, fixed in 7.3.4-7015 and higher, and Gen8 hardware (TZ 80 to TZ 680, NSa 2800 to 5800) and Gen8 NSv up to 8.2.2-8015, fixed in 8.2.3-8015 and higher; a Gen7 firewall that took only 7.3.4-7013 is therefore still affected (SonicWall, 2026-11-10).
Apple revised its support page on 2026-11-10: from macOS 27.2.1 the command-line tools no longer accept the twelve intermediate certificates, and the two roots they chain to, with three more eMudhra roots, leave /etc/ssl/cert.pem; macOS 26.7.3 and 15.8.3 carry the same protection, and after updating the manual removal need not be repeated (Apple, 2026-11-10). The revised page no longer carries the block dates of its 2026-10-30 version, so the 2026-10-22 date of the tracker and BleepingComputer stands for Apple's block.
Microsoft's post carries an update of 2026-11-10: the remaining eMudhra roots leave Microsoft products starting 2026-11-16, the ten remaining roots leave the Windows trusted root list through the automatic certificate-trust update, Edge and WebView2 drop default trust for emSign Root CA - G1, C1, ECC Root CA and Root TLS CA - G1 on the same date, Azure Linux images follow that day, and the .NET container images and the Microsoft Build of OpenJDK follow upstream releases (Microsoft, 2026-11-10). Cisco's advisory is at version 1.9 of 2026-11-10, which updates the products under investigation, impacted and not impacted (Cisco PSIRT, 2026-11-10).
PK Softech and the State Secretariat for Security Policy said on 2026-11-10 that no concrete ransom demand reached the supplier or the federal bodies, that the supplier never contacted the attackers, that the Confederation paid nothing and that there is still no indication of publication on the darkweb, which qualifies the press report that Akira demands ransom.
PK Softech said on its homepage on 2026-11-10, "because of media speculation", that no concrete ransom demand has reached it and that it has at no time contacted the attackers; its investigation continues (PK Softech, 2026-11-10). A spokeswoman of the State Secretariat for Security Policy told Keystone-SDA the same day that the federal bodies handling the incident know of no concrete ransom demand addressed to them and that the Confederation paid no ransom, that, as she put it, a demand to the supplier was "not made concrete with an amount or deadline" (translated from German), and that the Secretariat still has no indication that data from the attack was published on the darkweb; Publica said it also received no demand, is not in contact with the hackers and does not know whether other organisations or individuals are being extorted, which the Federal Prosecutor's Office is investigating (watson.ch, 2026-11-10). This qualifies the press report that Akira demands ransom: watson.ch's headline and lead say no demand reached the supplier or the Confederation, while the spokeswoman's wording leaves a non-specific demand to the supplier open, and neither the supplier nor the federal authorities confirm a concrete demand, and the Akira attribution and the data volume remain press-sourced.
BACS published its own public warning on 2026-11-10: it says Switzerland is affected and that the controllers also run in butchers, restaurants, pharmacies, doctors' practices, laboratories, logistics, industry and farms, many of whose operators do not know their plants are reachable from the internet, and it repeats that security updates for the AK-SM 800A and 8xxA family exist and that newer firmware enforces HTTPS.
BACS published a public warning on 2026-11-10, which repeats the earlier warning of the Cyber Security Hub advisory cited above; it says the attacks of recent weeks show that Switzerland is affected too and that it is repeating its warning because the systems are widespread among small and medium-sized businesses (translated from German) (BACS, 2026-11-10). Per BACS, attackers reach management interfaces that are directly reachable from the internet and then change temperatures, defrost cycles, alarm thresholds or notification settings remotely, which can spoil food, medicines and other temperature-sensitive goods; it names the end-of-life AK-SM 800 and AK-SC 355, the current AK-SM 800A and 8xxA family when it runs outdated firmware, and Copeland and Dixell XWEB.
What is new is the wider population: BACS lists butchers and food producers, restaurants and hotels, pharmacies, doctors' practices and laboratories, logistics and warehouses, industry and farms among the users, many of which do not know their cooling plants are reachable from the internet or run by an external provider, and it repeats what the Hub advisory already said, that security updates fixing the known flaws are available for the AK-SM 800A and 8xxA family and that newer firmware activates additional protections and enforces encrypted HTTPS communication (translated from German) (BACS, 2026-11-10). It recommends identifying the controllers, those run by contractors included, installing vendor updates, restricting unsupported systems to trusted networks or a VPN, reaching them remotely only through one centrally managed access point with default passwords replaced, and replacing end-of-life products; it names no attacker, no exploited CVE and no count of Swiss victims.
Fortinet's withheld advisories were published on 2026-11-10 and name unauthenticated FortiMail code-execution, SQL-injection and IBE account-takeover flaws (CVSS up to 9.8), two FortiAuthenticator authentication bypasses (9.0 and 9.1), a FortiOS OSPF flaw reachable from the adjacent network and unauthenticated code execution through the FortiManager FGFM port; the fixed versions are unchanged and no exploitation is stated.
Fortinet published the advisories it had withheld from the October hardening release on 2026-11-10. They name unauthenticated FortiMail flaws that may allow code or command execution through crafted requests (CVE-2026-126147, CVSS 9.8) (Fortinet PSIRT, 2026-11-10) and through HA join-request packets (CVE-2026-126148, 9.8) (Fortinet PSIRT, 2026-11-10), an unauthenticated SQL injection (CVE-2026-126164, 9.4) that Fortinet remediated in FortiMail Cloud on 2026-10-05 (Fortinet PSIRT, 2026-11-10), and two IBE webmail flaws that let an attacker take over an IBE recipient account (CVE-2026-126156, 9.1) (Fortinet PSIRT, 2026-11-10) or obtain an authenticated session as one (CVE-2026-126155, 9.1) (Fortinet PSIRT, 2026-11-10). Two FortiAuthenticator flaws, a hard-coded-password bypass (CVE-2026-126257, 9.0) (Fortinet PSIRT, 2026-11-10) and an incorrect-authorization authentication bypass (CVE-2026-126251, 9.1) (Fortinet PSIRT, 2026-11-10), a FortiOS and FortiSASE OSPF flaw that lets an unauthenticated attacker on the adjacent network broadcast link-state advertisements (CVE-2026-126253, 9.3) (Fortinet PSIRT, 2026-11-10) and unauthenticated code execution through the FortiManager FGFM port (CVE-2026-126261, 9.0) (Fortinet PSIRT, 2026-11-10) are the other rows that page named. The October builds fix most of them but not on every branch (FortiMail 7.2 and FortiOS 7.0 are told to migrate for some rows, as the update below sets out), FG-IR-26-275 lists lower minimum FortiManager builds (8.0.1, 7.6.8, 7.4.6 and 7.2.9) for the FGFM flaw, and none of the 2026-11-10 advisories states exploitation.
N-able released N-central 2026.4 Hotfix 2 (build 2026.4.1.26) on 2026-11-10 with seven CVE ids, which replaces the entry's statements that no fix, no CVE ids and no affected or fixed builds existed, and reports scanning activity associated with the public proof-of-concept code but no evidence of successful exploitation; on-premises servers must be upgraded and every Agent and Probe upgraded too.
N-able released N-central 2026.4 Hotfix 2, build 2026.4.1.26, on 2026-11-10 as a critical security update; hosted servers are already upgraded, on-premises customers must upgrade their own servers, and every customer must upgrade Agents first and then Probes (N-able, 2026-11-10). Huntress lists seven CVE ids for the fixed flaws and relays N-able's status-page statement that it observed "scanning activity associated with the published proof-of-concept code" but no evidence that any customer environment was successfully exploited; Huntress has seen no exploitation in its partners' environments, and N-able's guidance is to keep on-premises servers offline until the upgrade is complete (Huntress, 2026-11-10). After the hotfix the built-in remote control is temporarily disabled and Take Control still works (N-able, 2026-11-10).
SAP's Patch Day page of 2026-11-10 is published and Onapsis, which found the Web Dispatcher, ICM and Gateway flaws, supplies the fixed kernel patch levels, the Gateway parameter gw/acl_mode_proxy = 1 and the statement that it gave SAP a working unauthenticated exploit for the Web Dispatcher and ICM pair and has seen no attacks, replacing the entry's earlier statement that fixed releases were not public.
SAP's Security Patch Day page of 2026-11-10 lists 35 new notes and four GitHub security advisories and carries the four CVSS 10.0 notes above (SAP, 2026-11-10). Onapsis published threat advisories for the Web Dispatcher and ICM pair, which it names ICM2SHELL, and for the Gateway flaw, which it names ProxyGate, with the fixed kernel patch levels, the Gateway parameter gw/acl_mode_proxy = 1 and the statement that it gave SAP a working unauthenticated exploit for ICM2SHELL and has seen no attacks (Onapsis, 2026-11-10; Onapsis, 2026-11-10). Five further notes on the page are rated Critical at CVSS 9.1 to 9.9, among them an ABAP application server OS command injection for low-privileged users (CVE-2026-76965, note 3792735) and a code injection in NetWeaver Knowledge Management XML Forms (CVE-2026-109803, note 3809153); they are not covered here (SAP, 2026-11-10).
CISA added both Barracuda flaws, CVE-2026-116606 and CVE-2026-111560, to its Known Exploited Vulnerabilities catalog on 2026-11-10, so the exploitation Barracuda reported without naming a flaw is now tied to both and CVE-2026-111560 moves to exploited; CISA marks both for forensic triage.
CISA added both CVE-2026-116606 and CVE-2026-111560 to its Known Exploited Vulnerabilities catalog on 2026-11-10 "based on evidence of active exploitation" (CISA, 2026-11-10). The catalog describes the two as chainable, the first letting an unauthenticated remote attacker restore a crafted backup archive and the second letting an authenticated administrator run commands as root through a crafted timezone value, and marks both for forensic triage (CISA, 2026-11-10). The listing makes CVE-2026-111560 exploited as well; Barracuda's own statement of 2026-11-09 still names no flaw, and no source says how many organizations were hit or what the attacker did afterwards.
On every ESXi host that sits behind a SonicWall, Palo Alto Networks or Fortinet VPN appliance that was compromised or unpatched since late August, check for an unexpected executable under /opt, a process masquerading as the ESXi host daemon, changes to /etc/rc.local.d/local.sh, and an ESXi firewall or execInstalledOnly setting that switches itself back off, because Insikt reports the implant resets both controls about every five seconds and re-enabling them without removing its persistence is futile.
On every internet-facing Exchange server, compare ncobjapi.dll and wbemcomn.dll in C:\\Windows\\System32\\wbem\\ and the Microsoft.Exchange .ni.dll files in the .NET native image cache with the Microsoft originals and list the non-Microsoft assemblies loaded into EdgeTransport.exe, because ESET places the Cereal loader at those locations and Get-TransportAgent shows nothing new.
Install the November 2026 Office updates on every Outlook installation now (Office LTSC 2024 to 16.0.17932.21140, Office LTSC 2021 to 16.0.14334.21048, Microsoft 365 Apps through its update channel), then check proxy and firewall logs back to the earliest message-file delivery you can find for Outlook connections to external SMB, WebDAV or HTTP destinations, and reset the accounts of any user whose session authenticated to one.
Update Chrome to the current Stable build, 157.0.8103.78 or later (157.0.8103.50 is the first fixed build), and Extended Stable to 156.0.8078.100 or later on every managed endpoint, force the browser relaunch now, update Edge for Android to 157.0.4341.53, and install the Edge desktop and other Chromium-browser updates as soon as each vendor lists CVE-2026-125350 as fixed.
Upgrade every on-premises N-central server to 2026.4 Hotfix 2 (build 2026.4.1.26), keeping it offline until the upgrade is complete as N-able advises, then upgrade every Agent and, after the Agents, every Probe, hosted or not; ask each IT provider that manages your endpoints through N-central whether it runs a server on premises and has done this, because the researcher's proof-of-concept code is public and N-able has seen scanning for it.
Restrict the administrative interface of every Barracuda Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway to trusted internal networks now, update every Email Security Gateway to firmware 9.4.0.029 or later, the build Barracuda names (the CVE record lists builds before 9.4.0.030 as affected), and apply Barracuda's patch to each of the other products (BNADC-16586 for the Load Balancer ADC and the Web Application Firewall, BNMA-32468, BNWF-60060, BNYF-24789), confirming that automatic patching is on.
On every Email Security Gateway whose interface was reachable before the patch, check its configuration for a restore nobody made and its timezone setting for anything other than a timezone name, because watchTowr's single unauthenticated request can reach both and CISA lists both flaws as exploited and requires forensic triage.
Upgrade every FortiMail to 8.0.2, 7.6.7 or 7.4.9 (a 7.2 unit moves to a fixed release; 7.2.10 for CVE-2026-126150 is not released), every FortiAuthenticator to 8.0.4 or 6.6.11, every FortiOS to 8.0.2, 7.6.8, 7.4.13 or 7.2.14 (a 7.0 unit migrates), and every FortiManager and FortiAnalyzer on 7.6 or 7.4 to 7.6.8 or 7.4.12 (7.2 and 7.0 migrate), internet-facing units and FortiMail first, because the advisories describe unauthenticated code execution and account takeover and Fortinet warns that patch differences show attackers where the weakness sits; keep the FGFM and oftp ports and every administrative interface off untrusted networks.
On every FortiAnalyzer and FortiManager (Cloud variants included) on 8.0.0 through 8.0.2, set rpc-permit none on every administrator profile that has the JSON API enabled until Fortinet releases 8.0.3, because no 8.0 build fixes the unauthenticated 9.8 flaw CVE-2026-126170 and 8.0.2 is affected.
In every AWS account, list the IAM roles whose trust policy names an external vendor account, delete those of finished integrations, pin the rest to the vendor's specific principal with an aws:SourceIp or aws:SourceVpce condition, and search CloudTrail from 2026-10-01 for AssumeRole calls into them from non-vendor network addresses, using the account identifier and session-name prefix Wiz publishes, because the actor's calls carried the correct External ID and succeeded on roles nobody was using.
On every Confluence Data Center instance, open General Configuration, Further Configuration and clear the Remote API (XML-RPC & SOAP) checkbox now (no restart), confirm the soap-axis1 confluenceservice-v2 servlet path answers HTTP 403, and upgrade to 9.2.28, because Atlassian cannot confirm whether instances were affected and asks teams to check them for compromise.
Update every Synology DSM to 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10 or 7.2.1-69057-13, taking the management interface and rsync of any NAS that is reachable from the internet offline until it is updated, because Synology lists no mitigation for either flaw.
Upgrade every Ivanti Endpoint Manager Core server to 2024 SU8 or later, and read Ivanti's advisory for the fixed Cloud Services Application build before treating 5.0.8 as patched, because the CNA record gives an unauthenticated path to code execution on the server that distributes software to the managed endpoints.
Update every Adobe Connect server on Windows to the fixed build of its train (12.12.a, 12.11.i, 12.10.f, 12.9.a or 12.8.a), those reachable from the internet first, because five flaws need no privileges and no user interaction and Adobe names no mitigation.
Install the November 2026 cumulative update on every domain controller and every Exchange server first, then on DNS, DHCP and SQL Server hosts, because the Kerberos relay ends in SYSTEM on a domain controller and the Exchange flaw runs code from an inbound mail attachment that nobody has to open.
Update every Xen Orchestra and Xen Orchestra Appliance to xo-server 5.213.1 (latest channel) or 5.211.2 (stable channel) now, and until then keep its web and REST interface off every network but a dedicated management one.
On every Xen Orchestra instance that was reachable from an untrusted network, search the XCP-ng hosts for the artefacts Vates lists (a VM whose platform parameter binds a file to the serial port, an unexpected VM, cron files written by the actor and the dynamic-linker preload file Vates lists), and where compromise is confirmed reinstall from scratch and rotate every secret the Vates stack held, because Vates says cleanup alone cannot guarantee the removal of backdoors.
Apply SAP Security Notes 3778556 and 3778530 to every Web Dispatcher and every ABAP application server (kernel 7.40 or higher, including the Web Dispatcher embedded in SAP HANA XS) to at least the fixed patch levels Onapsis lists, internet-facing Web Dispatchers and Internet Communication Managers first, and apply note 3849308 on systems that use the SAML2 service provider, because Onapsis gave SAP a working unauthenticated code-execution exploit.
On every SAP Gateway apply note 3798345 together with gw/acl_mode_proxy = 1 and a restrictive prxyinfo file, because Onapsis says a version check or the kernel patch alone does not show whether the Gateway is safe.
On every internet-facing Linux server and every XenServer or XCP-ng host with its Workload Balancing and Conversion Manager appliances, install the vendor's fix and reboot as soon as it ships, then confirm the running version; Red Hat, Debian, CIQ, Amazon Linux, Ubuntu's generic kernels for 22.04 to 26.10, XCP-ng, MikroTik, Citrix and Sophos (Firewall hotfix HF110626.1, SD-RED firmware 3.0.012) updates are out, and XCP-ng says that a host which cannot reboot at once should take its iptables-based mitigation first and the update later; on Veeam appliances run Veeam Updater for kernel 5.14.0-570.60.1+27.2.el9_6_ciq, redeploy the virtual labs and Azure helper appliances that stay deployed and replace recovery media made before the update.
On hosts that cannot reboot yet, drop IPv4 TCP packets that carry IP options ahead of the TCP stack as CIQ, AWS and Vates describe, after testing on one non-production host because it also drops legitimate option-bearing traffic; disabling MPTCP alone does not close the path.
Update every non-browser TLS client that keeps its own CA bundle or does not check revocation to a fixed version: standalone Java runtimes, including those already updated on 2026-10-21, to the update of Oracle's Security Alert CVE-2026-114820 or OpenJDK (Oracle Database Server, Autonomous Health Framework and OPatch installations too), Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 or 3.11.18 together with pip 26.2.2 or later, Go 1.27.3 or 1.26.10, self-managed GitLab to a fixed patch release together with GitLab Runner 19.5.1, and SonicWall Gen7 firewalls with Client DPI-SSL enabled to SonicOS 7.3.4-7015 or later and Gen8 to 8.2.3-8015 or later; then confirm with curl against the incident tracker's test host that the client rejects the certificate; on managed Macs update to macOS 27.2.1, 26.7.3 or 15.8.3, or where that is not possible remove emSign ECC Root CA - G3 from /etc/ssl/cert.pem as Apple describes (AAA Certificate Services is optional and can stop tools that read only that file from verifying some unaffected sites).
Replace, by hand where the ACME client does not support ACME Renewal Information, every TLS certificate your organisation holds that chains to emSign ECC Root CA - G3 or to another of the seven certificates Microsoft removed from the Windows and Edge trust lists, or that was issued by one of the eight RSA G2B and G2C issuing CAs eMudhra revoked on 2026-11-07, because Chrome's removal of the G3 root was due on 2026-10-27 and the Windows change takes effect when the trust-list update reaches a device; deliver the updated Disallowed Certificate Trust List and the trust-list changes Microsoft describes, including its out-of-band update of 2026-10-26, to Windows devices that do not receive automatic certificate-trust updates; do not renew or reissue under emSign Root CA - G1 after 2026-11-16, because Chrome 153 and higher will not trust by default a certificate under it whose earliest SCT is later, and Windows, Edge and WebView2 stop trusting the remaining eMudhra roots on 2026-11-16 as Microsoft's update of 2026-11-10 describes.
Apply Cisco's remediation now for the products its eMudhra advisory (version 1.9) lists with a fix or a procedure available: the CA-trust distrust guide for IOS XE and the guidance for Secure Firewall ASA, FTD and FMC, Secure Email Gateway and Secure Email and Web Manager (run the updatenow command where updates are manual), Duo Access Gateway 3.2.0, Duo Network Gateway 3.4.1, Duo Agentic Authorization Connector 1.0.1 and ThousandEyes Enterprise Agent (Application-hosting Agent 5.2.2).
2026-11-11T0256Z-intel· Sonnet 5.5 · window 26 h · 12 entries published
Verification & coverage notes
Coverage window: standard, 26 h (gap 24.0 h to 2026-11-10T0255Z-intel). Twelve new entries and eight changelog records; no deep dive, no critical. A heavy Patch Tuesday day (Microsoft, SAP, Adobe, Fortinet, Ivanti, Synology) plus six KEV additions drove most of it.
KEV sweep (kev-window.txt): CVE-2026-125350 (Chromium) and CVE-2026-124194 (Outlook) became new entries; CVE-2026-111560 (Barracuda, COVERED-STALE) moved to exploited through an update record on the existing entry; CVE-2026-116606 already covered. borderline-drop: CVE-2026-20320 Cisco BroadWorks XXE; carrier and UC-supplier product with no stated constituency footprint, fix since 2026-08-19. borderline-drop: CVE-2026-111793 Openwave Webtop Media Transcoder; niche authenticated telecom webmail component, vendor CVSS 4.3, no European public-sector footprint. No RANSOMWARE rows.
Microsoft November Patch Tuesday: one entry for seven unauthenticated CVSS 9.8 rows in domain infrastructure and server roles (Kerberos relay to a DC and zero-click Exchange attachment indexing are the two whose mechanics force the timeline). borderline-drop: SharePoint CVE-2026-120002 (9.9, authenticated), Azure DevOps Server, VS Code, ASP.NET Core and the Edge Chromium rows (authenticated or user-driven), and further unauthenticated 9.8 rows in client-side or non-server components (DirectMusic, Media Foundation, Color Management, Xbox Live Networking Service) and cloud services (Entra Device Registration, Azure OpenAI, Azure Managed Grafana), which carry no mechanism beyond an in-network or crafted-packet prerequisite and are not server roles an on-premises estate patches; the entry says they exist.
borderline-drop: Roundcube 1.6.21 and 1.7.6 (17 fixes, no CVE ids, scores or exploitation); AXIS Camera Station CVE-2026-13312 (low-privilege prerequisite, no detail); Adobe Experience Manager APSB26-189 (authenticated 9.9); Red Hat Ruby errata and the Metasploit module for GitLab CVE-2026-97229 (no delta on a complete KEV-listed entry); Apple, Siemens WinCC and Cisco 1.11 inventory additions to the Brotli flaw (no exploitation against those products); React Server Components CVE-2026-126187, Rails Active Storage CVE-2026-126082, MongoDB, Arista EOS, rConfig, mailcow, GPUStack, the Polish CMS flaws, OpenSSL (all Low), Apache httpd 2.4.70, Firefox 160, Cisco ISE CVSS 4.3 and Exchange authenticated rows.
borderline-drop (S2, S3, S4): Vaud Grand Council interpellation 26_INT_155 (questions only; revisit after the Conseil d'Etat answers); CNIL ten sanctions on local authorities (French enforcement, generic control list); ENISA State of Cybersecurity in the Union 2026 (policy index, Switzerland not covered); Chur medical centre Gleis D and Medi Porta with Cloak's 87 GB claim (private provider, no vector, below the incident floor); Erowa (Büron LU) with Akira's claim (private manufacturer, no vector); UZ Brussel shared patient-record outage (hospital reports no indication of a cyberattack); five Japanese bulk-email SaaS breaches (no Swiss nexus, one secondary compile); Push Security AI-event lures with Kali365 and VoidProxy (delta on covered device-code themes, vendor pitch); iVerify Advanced Mobile Threat Report 2026 and Kaspersky Q3 statistics (vendor population statistics, no new technique); NoName057(16) doxing bounty portal (no Swiss nexus); iOS worse_query sandbox escape (no CVE, sideload precondition, no exploitation).
Backlog state/coverage_backlog.md: the single open row (ChimeraZ claim against the Belgian rescue zone Hainaut-Est) stays held, unchanged: S2 searched in French and English again and found no zone statement, Belgian press report or CCB notice; expiry 2026-11-17 stands.
Single-source items: Xen Orchestra VSA-2026-062 (Vates, first-hand for its own product; BleepingComputer is a restatement), Adobe Connect APSB26-191 (vendor bulletin), Ivanti EPM and Cloud Services Application (CNA records only, confidence medium), Turla Cereal (ESET) and GhostFrame (Insikt Group) as telemetry holders. Included with reduced confidence: Ivanti, because Ivanti's advisory pages are a script-built application that no transport read and the jina pool is empty; the entry says so.
Contradiction: BleepingComputer names Xen Orchestra releases 6.9.1 and 6.10.0 where Vates names 6.9.2 and 6.10.1; the entry uses Vates' numbers and the xo-server package numbers, which agree.
Registry: Check Point lists UAT-9244 as an actor separate from FamousSparrow while the registry carries it as an alias of actor:famoussparrow, and ESET's SparroWocky is Check Point's CopperDoor; no alias was merged or added, left for the audit. CopperDragon, SquadC and SilentDelivery are registered, SparrowDoor, SparrowShell and Melofee are not.
Candidate sources added: vates-security-advisories, vrt-nws, watson-ch-digital (each with its reason in sources_changed); S3's Cofense and Positive Technologies leads are not added (Positive Technologies publishes on Medium, vendor-site home to be found), and S1's Onapsis lead already exists as onapsis. Promoted to active: censys-advisories, cert-fr-cti (three contributing runs each).
Audit lead (S2): the ENISA Threat Landscape 2026 of 2026-09-22 has no matching entry in the store.
Essential-coverage: all 21 essential records were attempted. Coverage gaps: connectwise-trust-center (403 on every transport), sygnia (403), ico-uk (403, ninth fire in a row), Ivanti and N-able advisory pages (script-built, read through ENISA EUVD and N-able's status release notes), Fortinet's RSS is capped at 50 items so more 2026-11-10 advisories may exist.
Mid-run stop-hook nudges to commit were acknowledged and ignored per the prompt: nothing was committed before Phase 6.
Verification loop: six independent cold passes (iteration 1 full ledger, 2 to 6 post-fix passes), findings falling from 32 (16 truth, 13 editorial) to 4 (0 truth, 1 editorial, 3 advisory); the loop ended on rule 5 (final truth + editorial ≤ 2 without F1 or F4), so the final NEEDS_FIXES verdict is an early exit, not a confirmed CLEAN, and its one editorial finding (an uncited console clause on the Adobe Connect entry) was fixed after the pass. Every finding and its remediation is in verification.iterations[]; per-iteration deltas are in work/<run-id>/deltas.iter*.md.
Follow-up research (iteration 1, F10): a scoped cti-research sub-agent (F10, 325 s) resolved the Cisco lead: the SD-WAN Controller and Secure Email Gateway advisories are revisions of advisories existing entries cover, and the Meraki advisory (first published 2026-10-07, revised 2026-11-09) is below the bar; no entry, findings in work/<run-id>/findings.F10.yaml. Recipe note for the audit: Cisco PSIRT's feed date is the last-updated date, so revisions of old advisories surface as new rows; read "First Published" on the advisory page.
Declined verifier suggestions, each with its reason in the iteration findings: priority high for the Vates and SAP entries (no CVE record and unconfirmed constituency exposure; unexploited), dropping the Confluence, Adobe Connect and Patch Tuesday entries, product keys on the Vates and Chrome entries (they would overlap other entries and raise the dedup warning), and removal of vendor-published implant, registry and file names from mechanism prose (Detection lines and actions describe behaviour).
Corrections made through verification: the Outlook entry now states the NTLMv2 hash disclosure; the Patch Tuesday entry scopes its seven rows to domain infrastructure and server roles and names the further 9.8 rows; eight updated entries were corrected in place with their records re-declared, among them eMudhra (Apple macOS 27.2.1 / 26.7.3 / 15.8.3, Microsoft's 2026-11-16 root removal, Cisco 1.9), the Linux kernel entry (Ubuntu fixed builds, scoped to the generic kernels) and Fortinet (FG-IR-26-265, CVE-2026-126251, added).