You are reading a previous issue. Go to the latest edition →

The situation

CISA Flags Actively Exploited BroadWorks Flaw

CISA says an unauthenticated BroadWorks XML flaw is actively exploited; FCEB agencies have a Nov. 24 patch deadline.

4 sources

BleepingComputer, Palo Alto Networks Security Advisories, SecurityWeek, Unit 42

CISA flags an unauthenticated XXE flaw in the OCI XML Parser in Cisco BroadWorks as actively exploited. The flaw can allow an attacker to read sensitive files via crafted OCI-P XML. Cisco patched it in August; CISA lists a Nov. 24 patch deadline for FCEB agencies under BOD 26-04.

Context

The flaw is listed in the KEV Catalog. CISA's Nov. 24 deadline applies to FCEB agencies under BOD 26-04.

The move

3 things to do today

Epictim Draper

Change the authentication profile on affected PAN-OS GlobalProtect gateways as a workaround for CVE-2026-0327.
Upgrade affected PAN-OS versions and Prisma Access builds using Palo Alto's listed paths to fixed versions.
Meet CISA's Nov. 24 BroadWorks patching deadline if your organization is in the FCEB.

On the wire

1critical
2elevated
2moderate
0low

P0News

CISA Flags Actively Exploited BroadWorks Flaw

Cisco BroadWorks · CVE-2026-20320 · KEV entry · FCEB deadline Nov. 24

CISA flags CVE-2026-20320 in Cisco BroadWorks as actively exploited and added it to the KEV Catalog.¹ The vulnerability is an unauthenticated XXE flaw in the OCI XML Parser that can read sensitive files via crafted OCI-P XML.¹ Cisco patched the flaw in August; CISA lists an FCEB patching deadline of Nov. 24 under BOD 26-04.¹

Added to CISA KEV on 10 Nov 2026 (CVE-2026-20320) · CVE-2026-20320: EPSS <0.01 (FIRST)

1BLEEPINGCOMPUTER · CISA Flags Cisco BroadWorks Flaw Actively Exploited

Copy link to “CISA Flags Actively Exploited BroadWorks Flaw”

P1Exploit

GlobalProtect Gateway Allows Privilege Escalation

CVE-2026-0327 · No known exploitation reported

An authenticated, lower-privileged user can escalate to higher privileges in the GlobalProtect gateway on PAN-OS.¹ Palo Alto says Cloud NGFW and Panorama are not affected; the advisory lists affected PAN-OS versions and Prisma Access builds, upgrade paths to fixed versions, and a workaround to change the authentication profile.¹ Palo Alto reports no known exploitation.¹

CVE-2026-0327: CVSS 2.3

1PALO ALTO NETWORKS SECURITY ADVISORIES · CVE-2026-0327 Privilege Escalation in GlobalProtect on PAN-OS

Copy link to “GlobalProtect Gateway Allows Privilege Escalation”

P1Patch

N-able Issues N-central Hotfixes

Six CVEs · 148 exposed servers online, down from 1,338

N-able released hotfixes addressing six CVEs in N-central 2026.4 HF2, and all hosted NCODs have been upgraded.¹ Defused said attackers are scanning for the zero-days; Shadowserver reports 148 exposed N-central servers online, down from 1,338.¹ BleepingComputer reports that on-premises N-central customers should upgrade as soon as possible.¹

1BLEEPINGCOMPUTER · N-able patches N-central zero-day vulnerabilities with hotfixes

Copy link to “N-able Issues N-central Hotfixes”

P2Patch

Fortinet Publishes Broad Security Fixes

89 advisories · Nearly 100 vulnerabilities · About 17 critical

Fortinet published 89 advisories addressing nearly 100 vulnerabilities across its products.¹ SecurityWeek reports that about 17 flaws are critical, with fixes across FortiMail, FortiAuthenticator, FortiOS, FortiManager, FortiAnalyzer, and other products.¹

Single sourceSecurityWeek

1SECURITYWEEK · Fortinet patches nearly 100 vulnerabilities across products

Copy link to “Fortinet Publishes Broad Security Fixes”

P2Intelligence

Falcon C2 Uses Browser-based Compromise

Targets in five countries · OneDrive C2 channel

Unit 42 ties Falcon C2, also known as XG, to browser-based command and control that injects malicious JavaScript into webmail and government portals and steals passwords, emails, cookies, and communications.¹ The framework sideloads Chrome extensions and uses Antino via Microsoft OneDrive as a C2 channel; targets included ministries and law enforcement in one Middle Eastern country and four Southeast Asian countries from March through May 2026.¹

1UNIT 42 · Falcon C2 Browser-Based Command and Control Framework

Copy link to “Falcon C2 Uses Browser-based Compromise”

The wire, last 30 days

This edition has 3 stories rated critical or elevated (P0 or P1); the 25 daily editions from 13 Oct to 10 Nov averaged 3.3. 4 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table

Edition	P0	P1	P2	P3
11 Nov (this edition)	1	2	2	0
10 Nov	0	2	1	0
9 Nov	1	1	1	0
8 Nov	0	3	1	0
7 Nov	0	3	0	0
6 Nov	1	3	1	0
5 Nov	0	3	2	0
4 Nov	2	2	0	0
3 Nov	0	3	1	0
2 Nov	0	2	1	1
1 Nov	0	3	0	0
31 Oct	1	2	1	0
30 Oct	1	4	0	0
29 Oct	1	1	1	0
28 Oct	1	2	1	1
27 Oct	1	3	1	0
26 Oct	1	1	1	1
23 Oct	0	3	2	0
22 Oct	1	4	0	0
21 Oct	2	2	0	0
20 Oct	2	2	1	0
19 Oct	2	3	0	0
16 Oct	1	2	1	0
15 Oct	1	3	1	0
14 Oct	2	1	1	1
13 Oct	1	3	0	0

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Microsoft Patch Tuesday November 2026: 1,260 Vulnerabilities

Microsoft Patch Tuesday November 2026 addresses 1,260 vulnerabilities, with 68 rated critical. 167 Chromium issues affect Microsoft Edge. CVE-2026-124194 in Outlook is already being exploited. Notable items include CVE-2026-119958 (LDAP RCE) and multiple CVEs in Microsoft Queuing, Windows TCP/IP RCE, and ASP.NET Core flaws.

4 reports

SANS INTERNET STORM CENTERMicrosoft Patch Tuesday November 2026: 1,260 Vulnerabilities
THE HACKER NEWSMicrosoft Patches 1,259 Flaws, Outlook Exploit Exposes NTLMv2 Hashes
MALWAREBYTES LABSMicrosoft Patch Tuesday fixes Outlook flaw already under attack
NEWSAPI CYBER INSIGHTSMicrosoft Fixes 1235 Flaws in Record Patch Tuesday

Vanderbilt Restores Systems After Cyberattack as BYOD Claims Data Theft

Vanderbilt University is restoring systems after a cyberattack claimed by the BYOD ransomware group, which reportedly encrypted databases and obtained more than one million Social Security numbers plus names and contact details. The attackers allegedly gained a domain controller and backups; how access occurred remains undisclosed.

3 reports

MALWAREBYTES LABSVanderbilt Restores Systems After Cyberattack as BYOD Claims Data Theft
NEWSAPI CYBER INSIGHTSVanderbilt University Hit by BYOD Ransomware Attack and Data Theft
NEWSAPI CYBER INSIGHTSAttackers Claim Data Stolen From Vanderbilt Over 1 Million

eMudhra Revokes 8 More CA Certificates After Private-Key Mishap

eMudhra revoked eight additional intermediate CA certificates, bringing total affected to 16 due to a buggy Python script that moved private keys between HSMs in April 2025. The script weakened eight ECDSA keys and raised concerns over eight RSA keys. Some RSA intermediates issued since May 2026; last issued Nov 3. eMudhra plans to exit publicly trusted TLS and awaits KPMG findings.

2 reports

BLEEPINGCOMPUTEReMudhra Revokes 8 More CA Certificates After Private-Key Mishap
THE HACKER NEWSeMudhra Revokes Eight More CAs After Key Compromise

Maersk Data Breach: WhiteArmor Demands $5 Million

Maersk confirms a data breach after WhiteArmor ransomware claims an intrusion. WhiteArmor demands USD 5,000,000 in bitcoin. The threat actor claims to hold about 100 GB of data exfiltrated from Maersk's LF Logistics platform, including nearly 30,000 driver records, plaintext passwords, 33 SUPER_ADMIN accounts, and 27,842 mobile device logs.

2 reports

BLEEPINGCOMPUTERMaersk Data Breach: WhiteArmor Demands $5 Million
BREACHES.NETMaersk Faces WhiteArmor Demand Over Data Theft Claim

Critical Zoom Workplace Flaws Permit Unauthenticated Privilege Escalation

Zoom Workplace for Windows patches two critical flaws (CVE-2026-108186, CVE-2026-108187) enabling unauthenticated remote privilege escalation via network access. CVE-2026-108186 affects 7.1.0–7.1.7/8, CVE-2026-108187 affects prior to 7.1.5. A prior fix for CVE-2026-53412 was issued in July. Users urged to apply latest patches; no exploitation in the wild confirmed.

2 reports

THE HACKER NEWSCritical Zoom Workplace Flaws Permit Unauthenticated Privilege Escalation
SECURITYWEEKAsus and Zoom Patch Critical Security Vulnerabilities

AntiFox AI Pentesting Platform Linked to AWS Secrets Access

Cybersecurity researchers say AntiFox, an AI-driven pentesting platform, was used to steal AWS credentials and pivot into production environments. Activity linked to Alibaba Cloud hosting AntiFox interfaces with confirmed actions against AWS. Initial access came via a compromised IIS web app using a w3wp.exe ASPX shell.

2 reports

THE HACKER NEWSAntiFox AI Pentesting Platform Linked to AWS Secrets Access
BLEEPINGCOMPUTERHackers Use AntiFox AI Agents in AWS Credential-Theft Attacks

Grok-Built Apps Exposed Online: 35,578 Open

Claroc found 37,571 Grok-built apps online; 35,578 were openly accessible without sign-in. Twenty-four staff apps from SpaceXSI and X were exposed. About 1 in 10 open apps contained internal data. Of open apps, roughly 2% held high or critical material, including a hospital staff list and an ICU briefing. SpaceXSI removed the 24 staff apps; researchers urged stricter defaults and access controls.

2 reports

THE HACKER NEWSGrok-Built Apps Exposed Online: 35,578 Open
BREACHES.NETGrok Security Blind Spot Exposed Users and Musk Secrets

Railway Breach: Stolen AI Keys Led to $740K Unauthorized Charges

Railway says attackers stole customer AI keys in an October breach, driving an estimated $740,000 in unauthorized spend. Decrypted data included about 100,000 workspaces and 1,852 linked-account tokens; no customer databases were reportedly accessed. Refunds vary by provider; Railway advised revoking keys and isolating credentials. FBI IC3 complaint filed, investigation ongoing.

2 reports

THE HACKER NEWSRailway Breach: Stolen AI Keys Led to $740K Unauthorized Charges
NEWSAPI CYBER INSIGHTSRailway Breach Leads to $740K Fraudulent AI Charges

Also reported

BLEEPINGCOMPUTERBaker Tilly Data Breach at Third-Party Provider
UNIT 42ARTEX and AI-Powered Red Teaming Tools: What Defenders Need to Know
BLEEPINGCOMPUTERActive ScreenConnect Attacks Breach MSPs, Impact Dozens
BLEEPINGCOMPUTERNotion Breach Exposes Fireworks AI Chat Transcripts in Workspaces
AWS SECURITY BLOGEase of Use and Secure Defaults in the New AWS Experience
MICROSOFT SECUREGSocket: Stealthy C2 via Global Socket Relay Network
AWS SECURITY BLOGPart 4: What I’d Tell My Younger Self in Cybersecurity
PALO ALTO NETWORKS SECURITY ADVISORIESChromium Vulnerabilities Updated in Prisma Browser November 2026
PALO ALTO NETWORKS SECURITY ADVISORIESCVE-2026-0323 Checkov by Prisma Cloud SSRF Vulnerability
PALO ALTO NETWORKS SECURITY ADVISORIESCVE-2026-0324 GlobalProtect App Privilege Escalation in OPSWAT SDK

End of the Wednesday, November 11, 2026 edition.

Get a free cybersecurity brief by email on weekdays. Get the brief →

Colophon

SitRep · Vol. 1, No. 54

Publisher: Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure: SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards: Read our editorial standards.
Corrections: brief@sitrepit.com or the contact page.