Skip to content
Tuesday, November 10, 2026Nov 10, 2026
Previous issue

Vol. 1, No. 53Composed Nov 10 · 12:53 UTC

SitRep

Cybersecurity, in perspective.

4 elevated4 stories on the wire

Scale multiplies mistakes; attention is the cost of growth.
— Marcus Andreelius
ⓘMarcus Andreelius is a fictional AI editorial voice. This reflection is original editorial prose, not a quotation.

You are reading a previous issue. Go to the latest edition →

The situation

N-able Takes Hosted N-central Offline

A researcher disclosed more than 30 zero-days; N-able took hosted N-central offline, with patches in progress and a midday rollout planned.

3 sources

SecurityWeek, BleepingComputer, Palo Alto Networks Security Advisories

SecurityWeek reports that N-able took hosted N-central offline after researcher Sean Bales disclosed more than 30 zero-days dubbed Able2Shell on GitHub. Patches are in progress, with remediation and a midday rollout planned for November 10, 2026.

Context

The flaws could enable remote code execution, credential theft, or admin account creation. SecurityWeek reports no evidence of exploitation.

“Patches are in progress, with a midday remediation rollout planned for November 10, 2026.”
From Senecowitz · Analysis
The move

One thing to do today

Epictim Draper

  1. Patch IBM Aspera Faspex to 5.0.19 PL1 and SignalWire FreeSwitch to 1.11.3; the KEV timeline calls for patching within three days.

On the wire

  • 0critical
  • 4elevated
  • 0moderate
  • 0low
P1News

N-able Takes Hosted N-central Offline

More than 30 zero-days · Midday remediation rollout planned for November 10 · No exploitation evidence reported

Researcher Sean Bales disclosed more than 30 zero-day vulnerabilities dubbed Able2Shell on GitHub, and N-able took hosted N-central offline.1 Patches are in progress, with remediation and a midday rollout planned for November 10, 2026.1 SecurityWeek reports no evidence of exploitation.1

  1. 1SECURITYWEEK · N-able Takes N-central Offline After Zero-Day Disclosure

Copy link to “N-able Takes Hosted N-central Offline”

P1Exploit

Attackers Exploit Faspex and FreeSwitch Flaws

CVE-2026-123218 (Faspex) · CVE-2026-116779 (FreeSwitch) · CISA warns of in-the-wild exploitation

CISA warns that threat actors are exploiting vulnerabilities in IBM Aspera Faspex and SignalWire FreeSwitch in the wild.1 IBM patched Faspex to 5.0.19 PL1, and SignalWire patched FreeSwitch to 1.11.3; the KEV timeline calls for patching within three days.1

Previously in SitRep Nov 9: CISA Adds Vulnerabilities to KEV Catalog · CVE-2026-123218, CVE-2026-116779, CVE-2026-102895, CVE-2026-123158

Timeline

  1. Nov 6OpenSSH Flaw Allows Oversized Password Logins
  2. Nov 9CISA Adds Vulnerabilities to KEV Catalog
  3. This edition

Added to CISA KEV: CVE-2026-102895 on 9 Nov 2026; CVE-2026-116779 on 9 Nov 2026; CVE-2026-123158 on 9 Nov 2026 and 1 more · CVE-2026-123218: CVSS 9.8, EPSS <0.01 (FIRST); CVE-2026-116779: CVSS 9.8, EPSS 0.02 (FIRST) and 2 more

  1. 1SECURITYWEEK · IBM Aspera Faspex and SignalWire FreeSwitch Vulnerabilities Exploited

Copy link to “Attackers Exploit Faspex and FreeSwitch Flaws”

P1News

Google Patches Exploited Chrome Zero-day

CVE-2026-125350 · Use-after-free in Chrome's XML component · Updates for Windows, macOS, and Linux

Google released emergency Chrome updates for a new zero-day, CVE-2026-125350, which BleepingComputer reports is exploited in the wild.1 The flaw is a use-after-free in Chrome's XML component; updates cover Windows, macOS, and Linux, and may take days or weeks to reach all users.1

Added to CISA KEV on 10 Nov 2026 (CVE-2026-125350) · CVE-2026-125350: CVSS 8.8

  1. 1BLEEPINGCOMPUTER · Google Patches Eighth Chrome Zero-Day Exploit This Year

Copy link to “Google Patches Exploited Chrome Zero-day”

P1Exploit

Palo Alto Describes GlobalProtect Buffer Overflow

CVE-2026-0250 · Potential SYSTEM-level code execution · No known exploitation reported

Palo Alto Networks says a buffer overflow in GlobalProtect App during Portal/Gateway processing could let a man-in-the-middle attacker disrupt system processes and potentially execute arbitrary code with SYSTEM privileges.1 Palo Alto Networks reports no known exploitation.1

CVE-2026-0250: EPSS <0.01 (FIRST)

  1. 1PALO ALTO NETWORKS SECURITY ADVISORIES · CVE-2026-0250 GlobalProtect App Buffer Overflow Vulnerability Explained

Copy link to “Palo Alto Describes GlobalProtect Buffer Overflow”

Known exploited

Added 10 NovAt least 6 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-111560Barracuda Networks Multiple Products10 Nov13 Nov
CVE-2026-111793Openwave Messaging Limited Webtop Media Transcoder10 Nov24 Nov
CVE-2026-116606Barracuda Networks Barracuda Email Security Gateway (ESG)10 Nov13 Nov
CVE-2026-124194Microsoft Office10 Nov24 Nov
CVE-2026-125350Google Chromium10 Nov24 Nov
CVE-2026-20320Cisco BroadWorks10 Nov24 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

SitRep last read the catalogue on 10 Nov 2026, before this window was complete; additions may be missing.

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 4 stories rated critical or elevated (P0 or P1); the 25 daily editions from 12 Oct to 9 Nov averaged 3.4. 4 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
10 Nov (this edition)0400
9 Nov1110
8 Nov0310
7 Nov0300
6 Nov1310
5 Nov0320
4 Nov2200
3 Nov0310
2 Nov0211
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Windows Remote Desktop Client Information Disclosure Vulnerability CVE-2026-108419

Microsoft Security Response Center notes a Windows Remote Desktop Client information disclosure vulnerability,, with a Security Update Guide page. The article links to the Microsoft update guide.

5 reports

Outlook Zero-Day Among 1,094 Microsoft Patch Tuesday Fixes

Microsoft patched 1,094 vulnerabilities in November 2026 Patch Tuesday, including an exploited Outlook zero-day (CVE-2026-124194). The flaw is a spoofing vulnerability where an unauthenticated user can persuade a target to open a malicious file, potentially exposing NTLMv2 hashes. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024.

5 reports

Hackers Exploit Critical Xen Orchestra Auth Bypass for Admin Access

French vendor Vates VMS warns of a critical Xen Orchestra authentication bypass (VSA-2026-062) being actively exploited, enabling admin access and potential arbitrary code execution on managed pools and XCP-ng, with indicators including crafted cookies and compromised hosts.

2 reports

Three China-Nexus Espionage Campaigns Linked via Sparrow Malware

Check Point Research ties three China-nexus espionage clusters—SilentDelivery, OceanGate, and DarkWire—through Sparrow malware ecosystem. CopperDragon allegedly powers tools for campaigns targeting telecoms, government, and research sectors across Latin America, Asia, and Europe, with backdoors like SparrowDoor, CopperDoor, and SparrowShell observed.

2 reports

Also reported

End of the Tuesday, November 10, 2026 edition.

Colophon

SitRep · Vol. 1, No. 53

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.