Three-day deadlines don't leave room
for a missed email.
CyberComply monitors the CISA KEV catalog 24/7 and alerts you within minutes of every new listing, so the clock never starts without you.
KEV Intelligence Brief: Authentication Failures Dominate the Latest Additions
Date: Tuesday, November 10, 2026
Seven of the eight newest KEV entries are authentication or authorization failures. The exception is a WordPress race condition that still ends in unauthenticated code execution. Three of the eight carry short deadlines tied to November 9 additions. Two others are already past due. Treat the overdue items first.
Deadline Watch: Three Due Thursday, Two Already Overdue
CISA gave three-day windows to four entries, and the clock has run out on two of them.
- CVE-2026-111357 (Ivanti Connect Secure): Deadline was November 2, so it is more than a week overdue. This is a missing-authentication flaw allowing local privilege escalation. It is documented as chainable with CVE-2026-104935 and CVE-2026-118527. If you patched only the newest bug in that set, you may still be exposed. Confirm all three are remediated, and run Ivanti's integrity checker. Because the chain implies earlier-stage access, assume compromise is possible on any unpatched appliance and apply the CISA Forensics Triage Requirements.
- CVE-2026-119977 (WordPress Core): Deadline was November 6, so it is four days overdue. This TOCTOU race lets unauthenticated attackers execute code during full-package core upgrades, abusing predictable, web-accessible staging paths. Sites with auto-updates enabled are exposed on every upgrade cycle. Update to the fixed release, then audit web roots for unexpected PHP files and review recent upgrade timestamps against access logs. Managed hosts and agencies running client fleets should verify rather than assume that auto-update completed.
The three November 12 deadlines, two days out, are covered below: CVE-2026-102895, CVE-2026-116779, and CVE-2026-123158, plus CVE-2026-123218.
Unauthenticated Control of Infrastructure Services
Four entries share the November 12 deadline. Three of them give attackers remote control with no valid credentials, and the fourth is a privilege escalation flaw.
- CVE-2026-102895 (GPUStack): An improper authentication flaw gives unauthenticated administrative access. Attackers can alter users and models, create persistent admin API keys, pull worker and cloud-provider secrets, and execute code via
POST /v2/inference-backends/from-yaml. AI/ML clusters often hold cloud credentials and expensive GPU capacity, so the blast radius extends past the host. Patch, then rotate every admin API key, worker token, and cloud credential the platform could reach. Deleting attacker-created keys is not enough. Review the model registry for tampered artifacts. Keep GPUStack off the public internet and behind an authenticated proxy. - CVE-2026-116779 (SignalWire FreeSwitch): A code injection flaw allows configuration and credential disclosure, arbitrary call control, and command execution. Exposed SIP/event interfaces are the likely path. Beyond patching, restrict the event socket and management ports, rotate SIP trunk and gateway credentials, and check call detail records for toll-fraud patterns.
- CVE-2026-123158 (OpenBSD OpenSSH on Linux): An unexpected return value leads to authentication bypass. Details are thin, but SSH is a pervasive, usually internet-reachable service, so this is the highest-priority patch in the group for most estates. Inventory distribution-packaged builds, since Linux vendors backport fixes without changing upstream version strings. Restrict SSH exposure to management networks or bastions, and review auth logs for anomalous successful logins.
- CVE-2026-123218 (IBM Aspera Faspex): An incorrect authorization flaw lets an authenticated user craft a message to escalate privileges. It requires a login, but Faspex is a file-exchange platform where external partners often hold accounts. Review recently created or modified accounts and admin role assignments, and check transfer logs for unexpected package access.
Per BOD 26-04, assess each asset's internet exposure. Where mitigations are unavailable, discontinue use rather than leave a vulnerable service reachable.
Defeating the Second Factor and the Hardware Mitigation
Two further entries show attackers getting around the protections meant to contain compromise.
- CVE-2026-19868 (SonicWall SonicOS SSLVPN): Due November 20. A user with valid credentials for an alternate authentication method can bypass SAML controls, including SAML-enforced MFA. Stolen or leaked credentials thus become full VPN access without the second factor. After patching, disable unused authentication methods on SSLVPN, force session resets, and hunt for VPN logins that did not pass through your identity provider. Two weeks is generous, but this is an edge device, so do not use all of it.
- CVE-2024-27834 (Apple iOS, iPadOS, macOS, Safari, tvOS, watchOS): Due November 18. This 2024 pointer authentication bypass requires an attacker who already has arbitrary read/write, so it is a post-exploitation component in exploit chains, typically paired with a WebKit memory-corruption bug. Its KEV listing suggests real-world chaining. Enforce current OS and Safari versions through MDM, prioritize executives and high-risk users, and use Lockdown Mode where appropriate. Older, unsupported Apple hardware that cannot update is a gap to flag for replacement.
Prioritization Summary
- Today: Ivanti Connect Secure (all three chained CVEs) and WordPress Core. Both are overdue. Run forensic triage.
- By Thursday, November 12: OpenSSH, GPUStack, FreeSwitch, and Aspera Faspex. Rotate credentials after patching.
- By November 18–20: Apple fleet updates and SonicWall SSLVPN, with SAML bypass hunting.
Patch status alone will not establish safety for the unauthenticated entries. Where exposure preceded patching, the CISA forensics triage requirements apply.
Sources: CISA KEV Catalog · CISA Binding Operational Directives · Ivanti Security Advisories · WordPress Releases · SonicWall PSIRT · Apple Security Releases · OpenSSH Security · IBM Product Security · GPUStack GitHub Security · FreeSWITCH Security
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — November 10, 2026
CISA Adds Four Vulnerabilities to Known Exploited Catalog, N-able Takes N-central Offline Following Zero-Day Disclosure
CISA added four security flaws affecting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation, according to The Hacker News. The agency did not disclose the scale of exploitation, specific victim organizations, or whether the active exploitation represents coordinated campaigns. Separately, N-able took its hosted N-central remote monitoring and management environments offline globally on November 9 after an independent researcher published details of 33 alleged zero-day vulnerabilities and exploit code. The company has not confirmed which vulnerabilities are valid, whether exploitation occurred prior to disclosure, or when services will be restored. Google also patched CVE-2026-125350, a high-severity use-after-free vulnerability in Chrome's XML component being actively exploited—marking the eighth Chrome zero-day this year, researchers report.
France Attributes Supermarket Refrigeration Cyberattacks to Iranian Revolutionary Guards Unit
France's Foreign Ministry officially attributed October's supermarket refrigeration cyberattacks to Iran's Revolutionary Guards, summoning Tehran's envoy and warning of a forthcoming response, according to Reuters. Foreign Minister Jean-Noel Barrot stated the attacks affected 700 commercial sites, raised freezer temperatures to 50°C, and caused at least 15 fires requiring mass food disposal. France reports the campaign used Persian-language tooling and Iranian IP addresses consistent with IRGC tradecraft, though Tehran has not responded to the attribution. French authorities also disclosed that hackers reached cold storage systems at three blood banks, requiring emergency relocation of blood supplies. The attacks represent a shift from data theft to direct infrastructure sabotage, though France has not detailed the initial compromise vector or disclosed whether other European nations experienced similar intrusions.
Additional Reported Activity: Hackers compromised Ethersphere's bee-js npm package and Swarm Desktop, injecting wallet-stealing malware into version 13.3.0 before it was removed from the registry. The n0n hacking group claims to have stolen hundreds of millions of traveler records from Expedia, though the claim has not been independently verified. Fireworks AI disclosed that attackers accessed development machines through a third-party cloud provider breach, exposing customer billing information and model weights. The BYOD ransomware group claimed responsibility for an attack on Vanderbilt University that encrypted databases and affected multiple campus services.
Sources: The Hacker News · Cybersecurity News · Reuters · Iran International · Bleeping Computer · Bleeping Computer
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
CISA added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilitie...
N-able Takes N-central Servers Offline Worldwide After 33 0-Day Vulnerabilities and Able2Shell Exploits
N-able took its hosted N-central environments offline on November 9, 2026, after an independent researcher published details of 33 alleged zero-day vu...
GhostAction Supply Chain Attack Hits Tens of Thousands of GitHub Repositories
The GhostAction supply chain campaign pushed credential-stealing GitHub Actions workflows into tens of thousands of repositories to steal cloud and AI...
Chinese-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach
Chinese-linked hackers breached ConnectWise and used the ARTEX AI framework to compromise over 2,250 Microsoft 365 tenants globally.
Russian State Statistics Agency Rosstat Suffers Major Data Breach
Rosstat, Russia's state statistics agency, was breached by Belarusian CyberPartisans and Silent Crow, who exfiltrated 23TB of data including military ...
Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch Records
The most serious confirmed harm there involved emergency-services data. Cybersecurity. The dispatch records came from a city's system for 119, ...
CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known ...
How AI is enabling faster, more dangerous cyber war
State-backed Chinese hackers are using AI-powered tools like Artex to automate attacks at unprecedented speed, with one group gaining deep network acc...
Updated daily