Skip to content

Threats & vulnerabilities this week: 17 changes (6 November 2026)

Seventeen confirmed threat and vulnerability items from the week to 6 November 2026: four already have their own briefs, seven are new here and six are logged. The nearest date is today: CISA's due date for WordPress core CVE-2026-119977 is 6 November 2026.

This is our weekly Threats & vulnerabilities roundup. The seven new items were re-read on their primary source on 6 November 2026; the CISA KEV entry for WordPress is as Research read it on 4 November. Of the six logged items, Node-RED was re-read today; the other five are as Research read them at the source earlier this week.

Already briefed

  1. KEV catch-up: SharePoint Server CVE-2026-65660, ScreenConnect CVE-2026-84869, PAN-OS CVE-2026-0322, plus the Zyxel GS1900 update. The GS1900 attacks used CVE-2026-107441, and the June firmware for CVE-2026-7273 does not stop them: install 2.90(xxxx.3)C0. Brief: KEV catch-up: SharePoint, ScreenConnect, PAN-OS.
  2. KEV catch-up: FortiOS CVE-2025-61624, FortiMail CVE-2026-104286, NetScaler CVE-2026-88779, N-central CVE-2026-86218. Network and MSP tooling admins. Brief: KEV catch-up: FortiOS, FortiMail, NetScaler, N-central.
  3. BeyondTrust Remote Support CVE-2026-102764, exploited since late August. Patch, then hunt. Brief: BeyondTrust Remote Support CVE-2026-102764.
  4. Windows Shell CVE-2026-96951, the October zero-day. Endpoint admins. Brief: Windows Shell CVE-2026-96951.

New this week

TeamViewer TV-2026-1010 and TV-2026-1011: update clients to 15.83 (27 October 2026)

Two bulletins, one action. TV-2026-1010 (29 September 2026, "Important", "Up to 8.8 (High)") fixed five CVEs in 15.82, including CVE-2026-92370 (8.8), improper access control during session establishment that lets a remote attacker bypass configured permissions. TV-2026-1011 (issued 27 October, updated 28 October 2026, "Up to 8.8 (High)") fixes three more in 15.83. One of them, CVE-2026-111585 (8.8), is an integer overflow in screen processing: a malicious remote host can, depending on the platform, run code with the privileges of the viewer process once a user connects to it. Version 15.82 does not fix it. Both bulletins: "TeamViewer is not aware of any active exploitation in the wild."

  • Who acts: MSPs and helpdesks whose technicians connect out to customer machines with the TeamViewer Full Client, Portable or the Android Remote Control app.
  • Check: Intune admin center > Apps > Monitor > Discovered apps, search "TeamViewer", and list anything below 15.83. On a single Windows machine: Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like 'TeamViewer*' | Select-Object DisplayName, DisplayVersion. Legacy fixed builds for TV-2026-1011: 15.64.10 (Windows 7 and 8), 14.7.48868, 13.2.36231 (Windows), 13.2.154008 (Linux), 13.2.154007 (macOS). Until updated, technicians should not accept unsolicited session requests or open .tvs recordings from people they don't know.
  • Source: TeamViewer TV-2026-1011 and TV-2026-1010. Related: BeyondTrust Remote Support CVE-2026-102764.

Cisco Talos: UAT-11473 used Catalyst SD-WAN CVE-2026-20127 to plant KeyDrift (28 October 2026)

Cisco Talos reports that a group it tracks as UAT-11473 exploited "CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances" (in CISA KEV since February 2026) to install KeyDrift, malware that pulls IPsec data-plane keys out of the vdaemon process. Talos says the group's infrastructure "overlaps considerably" with the "Silent Train" covert network it links to Volt Typhoon, and that the group has targeted space and satellite services, defence and aerospace technology, and policy research. "Cisco has released patches for CVE-2026-20127."

  • Who acts: anyone running Catalyst SD-WAN Controller, Manager or Validator.
  • Check: confirm each control component is on a fixed release listed in Cisco advisory cisco-sa-sdwan-rpa-EHchtZk. On each, look for the Talos file paths: ls -la /tmp/system-vdaemon /var/tmp/vdaemon.bin /var/tmp/vdaemon.conf /etc/sv/aaamgr/, and review grep "Accepted publickey for vmanage-admin" /var/log/auth.log for unknown source addresses. An upgrade will not tell you whether something was planted before it. Snort SIDs: 65938 and 65958 (CVE), 67387 to 67416 (Snort 2) and 7:44 to 7:73 (Snort 3) for the artefacts. Run request admin-tech before you open a TAC case.
  • Source: Cisco Talos: Inside KeyDrift.

SonicWall SMA1000 CVE-2026-102255: fixed builds out since 5 October 2026

SonicWall notice SNWLID-2026-0017 (published 5 October, updated 6 October 2026) lists a server-side request forgery, CVE-2026-102255 (CVSS 10.0), and three more CVEs in SMA 1000 models 6210, 7210 and 8200v. Affected: "12.4.3-03526 and older" and "12.5.0-02952 and older". There is no workaround. SonicWall says "There is no evidence that these vulnerabilities are being exploited in the wild"; Canada's Cyber Centre (AV26-1017 Update 1) cites open-source reporting of exploitation. It is not in CISA KEV as of Research's last catalogue read. SMA 100 and firewall SSL VPN are not affected.

Barracuda ESG CVE-2026-116606 chains to root (2 November 2026)

Barracuda's advisory (published and updated 2 November 2026) pairs a pre-authentication authorisation bypass, CVE-2026-116606 (9.3), with command injection, CVE-2026-111560 (8.6). Chained, they give root on the Email Security Gateway; the command injection alone also affects Load Balancer ADC, WAF, Message Archiver, WAF Control Center and Web Security Gateway. Barracuda says successful exploitation requires an attacker to have access to the administrative interface. The advisory says nothing about exploitation, and it is not in CISA KEV.

  • Who acts: mail and network admins with Barracuda appliances, often MSPs for SMB customers.
  • Check: confirm the patch is installed: ESG BNSF-40425 (9.4.017 and later) or BNSF-40430 (earlier); ADC and WAF BNADC-16586; Message Archiver BNMA-32468; WAF Control Center BNWF-60060; Web Security Gateway BNYF-24789. If automatic patching is off, turn it back on. Make sure the admin interface is reachable only from trusted internal networks.
  • Source: Barracuda advisory.

WordPress core CVE-2026-119977 in CISA KEV, due 6 November 2026

CISA added "WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability" to KEV on 3 November 2026, with a due date of 6 November 2026 for US federal agencies. WordPress 7.1.4 (28 October 2026) fixes "A race condition during core updates that could lead to remote code execution", among 22 fixes, with backport releases from 7.0.8 down to 4.7.39. "WordPress 4.6 and earlier no longer receive security updates." 7.1.4 also updates the bundled root certificates after the eMudhra revocation.

  • Who acts: anyone hosting WordPress sites, including the marketing sites MSPs run for customers.
  • Check: wp core version on each site (WP-CLI, read-only) must show 7.1.4 or the fixed release for its branch. While you are there, list stray PHP files with find wp-content/upgrade -name '*.php' and review wp user list --role=administrator for accounts you don't recognise.
  • Source: WordPress 7.1.4 and the CISA KEV catalogue. Guide: Microsoft 365 security deadlines.

Airbyte before 2.2.0: Connector Builder RCE exploited, JVN 4 November 2026

Airbyte's advisory GHSA-g35w-6r6v-h4r7 (17 October 2026, "No known CVE", CVSS 3.1 9.9) covers "Remote code execution via Connector Builder custom components when unsafe code is disabled" in "Airbyte < 2.2.0"; "Successful exploitation may expose data, credentials and secrets available to the affected container". JPCERT/CC's JVN#12040144 (4 November 2026) says "the vulnerability has been confirmed to be exploited in the wild"; its Japanese page lists 1.7.0 through 2.1.0 as affected. It is not in CISA KEV as of Research's last catalogue read.

  • Who acts: anyone running self-managed Airbyte.
  • Check: list the running image tags, for example kubectl get pods -n <airbyte namespace> -o jsonpath='{..image}', and note anything below 2.2.0.
  • Do this: upgrade to 2.2.0. Until then, Airbyte's workarounds: restrict network access to the Connector Builder / Manifest Server so only the Airbyte server can reach it, and limit Workspace Reader and Organization Reader access to trusted users. If the instance was reachable, rotate the source and destination credentials it held.
  • Source: GHSA-g35w-6r6v-h4r7 and JVN#12040144.

OpenSSH on Alpine: password authentication bypass CVE-2026-123158 (5 November 2026)

OpenSSH 10.6p2 fixes a "password authentication bypass in sshd(8)" that is "exploitable through sshd on some Linux systems built and run with PAM support disabled". Alpine's advisory (5 November 2026) lists the conditions: sshd without PAM (or UsePAM no), PasswordAuthentication on (the default), an account with * in its password field, and at least one local account with a $5$ or $6$ hash. The CVE record (CVSS 3.1 8.1) came after Alpine's post. OpenSSH's Damien Miller told The Hacker News "No attacks using the flaw have been reported."

  • Who acts: admins of Alpine hosts, containers that run sshd, and musl-based appliances.
  • Check: sshd -T | grep -i -E 'passwordauthentication|usepam' and apk version openssh (both read-only). Fixed packages: edge 10.6_p2-r0, 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11, 3.21 9.9_p2-r1 (older branches are in the advisory).
  • Do this: after apk upgrade, restart sshd: "Upgrading the package alone does not replace the running daemon." If you can't update yet, Alpine's fallback is PasswordAuthentication no; confirm key login works first.
  • Source: Alpine security advisory and OpenSSH 10.6p2 release notes.

Also logged

  • Synology: C3RB3R ransomware uses a DSM flaw patched in December 2024. Synology (29 October) says "threat actors exploiting a vulnerability patched in December 2024" and links Synology-SA-24:20; it does not say which CVE. Fixed DSM: 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7. Encrypted files end in ".L0CK3D". Who acts: NAS owners. Check: DSM > Control Panel > Update & Restore shows the version. Do this: turn on automatic updates and keep DSM off the internet. Source: Synology.
  • Node-RED CVE-2026-58115 exploited from 30 October. VulnCheck (2 November) saw instances without adminAuth exploited with a single POST /flows, dropping a Linux bot from 85.215.73.250:8080; "not in CISA's KEV at the time of writing". Siemens SSA-834709 lists V4.3.4.1 for SIMATIC IoT2050. Who acts: OT and automation teams. Check: grep -n adminAuth settings.js in the Node-RED user directory, confirm the editor is not reachable from outside, and review flows for unexpected exec nodes. Source: VulnCheck.
  • Cisco's 4 November bundle. UCS Central RCE CVE-2026-76506 (High, 7.6; Canada's Cyber Centre: fixed in 2.1(2c)), Unified CM XSS CVE-2026-76419 (6.1), ISE CVE-2026-20241 (5.3); no exploitation stated. Cisco's next bundled publication is "January 20, 2027". Who acts: Cisco data centre and collaboration admins. Check: UCS Central version against 2.1(2c). Source: Cisco notice.
  • DigiCert: a business system was accessed from 27 June to 2 July 2026. DigiCert's report on Mozilla Bugzilla: self-registration accounts had read-only access to archived data; business contact data was exposed, and ID documents for a "small minority". "No certificate operations were impacted." Who acts: whoever holds your DigiCert account. Check: expect targeted phishing aimed at DigiCert account contacts and tell them. Source: Bugzilla 2084460.
  • CWPdoor backdoor replaces Control Web Panel's cwpsrv. XLab (5 November) found it in cwpsrv 1.15.10 and 1.24.0; "We do not yet know which vulnerability cwpdoor uses to spread." Who acts: hosting providers and MSPs running CWP. Check: ss -axp | grep integrity and strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity; search logs for C2 136.0.141.71. Do this: block 136.0.141.71. Source: XLab.
  • Rails Active Storage with ImageMagick: arbitrary file write, GHSA-f3w6-w445-fwh9. No CVE yet. Fixed in Rails 8.1.4.1 and 8.0.5.2, with mini_magick 5.1 or later. Who acts: Rails app owners using Active Storage variants. Check: bundle exec rails -v and bundle list | grep mini_magick. Source: GHSA-f3w6-w445-fwh9.

More: all Threats & vulnerabilities news · Microsoft 365 security deadlines.

Last reviewed: 6 November 2026. Runbook Lab is not affiliated with Microsoft.