Skip to content
Tuesday, November 10, 2026Nov 10, 2026
Previous issue

Vol. 1, No. 53Composed Nov 10 · 16:52 UTC

SitRep

Cybersecurity, in perspective.

3 elevated4 stories on the wire

Scale amplifies error; deliberate limits preserve resilience.
— Marcus Andreelius
ⓘMarcus Andreelius is a fictional AI editorial voice. This reflection is original editorial prose, not a quotation.

You are reading a previous issue. Go to the latest edition →

The situation

N-able Shuts Hosted N-central Offline

N-able shut Hosted N-central after 33 zero-days with PoCs; no active exploitation was observed, and a hot fix is in progress.

3 sources

The Hacker News, Malwarebytes Labs, Cisco Talos Vulnerability Reports

N-able temporarily shut down Hosted N-central environments after public disclosure of 33 zero-days with proof-of-concept exploits. The report says affected services include hosted and on-prem N-central environments; Ecoverse services remain online. N-able reported no active exploitation was observed, and a hot fix is in progress.

Context

The disclosed vulnerabilities include credential disclosure, arbitrary file writes, directory traversal, XSS, XXE, and remote code execution. The report says affected services include hosted and on-prem N-central environments, while Ecoverse services remain online.

The move

2 things to do today

Epictim Draper

  1. Update Chrome to 157.0.8103.50/51 on Windows and macOS, or 157.0.8103.50 on Linux, automatically or manually through About Chrome.
  2. Apply vendor fixes for the four KEV-listed flaws by Nov. 12, 2026.

On the wire

  • 0critical
  • 3elevated
  • 1moderate
  • 0low
P1Vendor outage

N-able Shuts Hosted N-central Offline

33 disclosed zero-days · PoC exploits published · hosted and on-prem environments

N-able temporarily shut down Hosted N-central environments following public disclosure of 33 zero-days with proof-of-concept exploits.1 The disclosed vulnerabilities include credential disclosure, arbitrary file writes, directory traversal, XSS, XXE, and remote code execution; a hot fix is in progress.1 N-able reported no active exploitation was observed; Ecoverse services remain online.1

  1. 1THE HACKER NEWS · N-able Puts N-central Cloud Offline After 33 Zero-Days Disclosure

Copy link to “N-able Shuts Hosted N-central Offline”

P1KEV

CISA Adds Four Flaws to KEV Catalog

22 reported events from 14 IPs · post-exploitation activity and botnet/C2 tool use observed

CISA added four flaws to its KEV catalog, with evidence of active exploitation targeting GPUStack, SignalWire FreeSwitch, OpenSSH, and IBM Aspera Faspex.1 Reported exploitation attempts reached 22 events from 14 IPs; post-exploitation activity and botnet and command-and-control tool use were observed.1 The report says agencies were urged to apply fixes by Nov. 12, 2026.1

Previously in SitRep Nov 9: CISA Adds Vulnerabilities to KEV Catalog · CVE-2026-123218, CVE-2026-116779, CVE-2026-123158, CVE-2026-102895

Timeline

  1. Nov 6OpenSSH Flaw Allows Oversized Password Logins
  2. Nov 9CISA Adds Vulnerabilities to KEV Catalog
  3. This edition

Added to CISA KEV: CVE-2026-102895 on 9 Nov 2026; CVE-2026-116779 on 9 Nov 2026; CVE-2026-123158 on 9 Nov 2026 and 1 more · CVE-2026-123218: CVSS 9.8, EPSS <0.01 (FIRST); CVE-2026-116779: CVSS 9.8, EPSS 0.02 (FIRST) and 2 more

  1. 1THE HACKER NEWS · CISA Warns of Active Exploitation of OpenSSH and GPUStack Flaws

Copy link to “CISA Adds Four Flaws to KEV Catalog”

P1Browser

Google Releases Chrome Updates for Exploited Zero-day

Nine fixes · CVE-2026-125350 · Windows/macOS 157.0.8103.50/51 · Linux 157.0.8103.50

Google released Chrome security updates on Nov. 9, 2026, covering nine fixes, including a high-severity use-after-free in the XML component tracked as CVE-2026-125350 and reportedly exploited in the wild.1 The updates set Chrome to 157.0.8103.50/51 on Windows and macOS and 157.0.8103.50 on Linux; Android also received fixes.1 HKCERT rated the risk as Extremely High.1

Added to CISA KEV on 10 Nov 2026 (CVE-2026-125350) · CVE-2026-125350: CVSS 8.8

  1. 1MALWAREBYTES LABS · Chrome Update Fixes Actively Exploited Zero-Day CVE-2026-125350

Copy link to “Google Releases Chrome Updates for Exploited Zero-day”

P2Privilege escalation

Talos Reports Windows Cloud Files Driver Flaw

Use-after-free in Cloud Files Mini Filter Driver · CVE-2026-58613

Talos reported a use-after-free in the Windows Cloud Files Mini Filter Driver (cldflt.sys) that enables privilege escalation via CldiStreamCompleteRequest; the report links it to CVE-2026-58613.1 Talos said the issue stems from orphaned provider progress requests after a cloud sync provider terminates and a 60-second timer cleanup.1

Updated Since Nov 8: Cloud Files Driver Has Type Confusion Flaw · New: helpnetsecurity.com, bleepingcomputer.com

Timeline

  1. Oct 31Windows Cloud Files Driver Permits Local Privilege Escalation
  2. Nov 6Windows Cloud Files Driver Has Use-after-free
  3. Nov 8Cloud Files Driver Has Type Confusion Flaw
  4. This edition

CVE-2026-58613: EPSS <0.01 (FIRST); CVE-2023-29361: EPSS 0.04 (FIRST)

  1. 1CISCO TALOS VULNERABILITY REPORTS · Microsoft Windows Cloud Files Mini Filter Driver Use-After-Free Privilege Escalation

Copy link to “Talos Reports Windows Cloud Files Driver Flaw”

Known exploited

Added 10 NovAt least 6 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-111560Barracuda Networks Multiple Products10 Nov13 Nov
CVE-2026-111793Openwave Messaging Limited Webtop Media Transcoder10 Nov24 Nov
CVE-2026-116606Barracuda Networks Barracuda Email Security Gateway (ESG)10 Nov13 Nov
CVE-2026-124194Microsoft Office10 Nov24 Nov
CVE-2026-125350Google Chromium10 Nov24 Nov
CVE-2026-20320Cisco BroadWorks10 Nov24 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

SitRep last read the catalogue on 10 Nov 2026, before this window was complete; additions may be missing.

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 3 stories rated critical or elevated (P0 or P1); the 25 daily editions from 12 Oct to 9 Nov averaged 3.4. 4 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
10 Nov (this edition)0310
9 Nov1110
8 Nov0310
7 Nov0300
6 Nov1310
5 Nov0320
4 Nov2200
3 Nov0310
2 Nov0211
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Windows Remote Desktop Client Information Disclosure Vulnerability CVE-2026-108419

Microsoft Security Response Center notes a Windows Remote Desktop Client information disclosure vulnerability,, with a Security Update Guide page. The article links to the Microsoft update guide.

5 reports

Outlook Zero-Day Among 1,094 Microsoft Patch Tuesday Fixes

Microsoft patched 1,094 vulnerabilities in November 2026 Patch Tuesday, including an exploited Outlook zero-day (CVE-2026-124194). The flaw is a spoofing vulnerability where an unauthenticated user can persuade a target to open a malicious file, potentially exposing NTLMv2 hashes. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024.

5 reports

Hackers Exploit Critical Xen Orchestra Auth Bypass for Admin Access

French vendor Vates VMS warns of a critical Xen Orchestra authentication bypass (VSA-2026-062) being actively exploited, enabling admin access and potential arbitrary code execution on managed pools and XCP-ng, with indicators including crafted cookies and compromised hosts.

2 reports

Three China-Nexus Espionage Campaigns Linked via Sparrow Malware

Check Point Research ties three China-nexus espionage clusters—SilentDelivery, OceanGate, and DarkWire—through Sparrow malware ecosystem. CopperDragon allegedly powers tools for campaigns targeting telecoms, government, and research sectors across Latin America, Asia, and Europe, with backdoors like SparrowDoor, CopperDoor, and SparrowShell observed.

2 reports

Also reported

End of the Tuesday, November 10, 2026 edition.

Colophon

SitRep · Vol. 1, No. 53

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.