You are reading a previous issue. Go to the latest edition →

The situation

CISA Flags BroadWorks Flaw as Actively Exploited

CISA lists a BroadWorks flaw as actively exploited; Cisco patched it in August, while FCEB remediation is due by Nov 24.

3 sources

BleepingComputer, Cisco Talos Vulnerability Reports, SecurityWeek

CISA lists CVE-2026-20320, an unauthenticated XXE in the Cisco BroadWorks OCI XML Parser, as actively exploited. BleepingComputer reports that crafted OCI-P XML can allow an attacker to read sensitive files; Cisco patched the flaw in August, and the FCEB patch deadline is Nov 24 under BOD 26-04.

Context

BleepingComputer reports that Malbear Labs identified a Chinese-speaking actor using a jailbroken DeepSeek AI model against telecoms and stealing keys and SSL credentials. The report also says the flaw is in CISA's KEV Catalog.

On the wire

0critical
2elevated
0moderate
1low

P1Exploit

CISA Flags BroadWorks Flaw as Actively Exploited

CVE-2026-20320 · Cisco patched in August · FCEB patch deadline: Nov 24 under BOD 26-04

CISA lists CVE-2026-20320, an unauthenticated XXE in the Cisco BroadWorks OCI XML Parser, as actively exploited.¹ BleepingComputer reports that crafted OCI-P XML can allow an attacker to read sensitive files.¹ Cisco patched the flaw in August, and the FCEB patch deadline is Nov 24 under BOD 26-04.¹ Malbear Labs reports a Chinese-speaking actor used a jailbroken DeepSeek AI model against telecoms, stealing keys and SSL credentials.¹

Added to CISA KEV on 10 Nov 2026 (CVE-2026-20320) · CVE-2026-20320: EPSS <0.01 (FIRST)

1BLEEPINGCOMPUTER · CISA Flags Cisco BroadWorks Flaw Actively Exploited

Copy link to “CISA Flags BroadWorks Flaw as Actively Exploited”

P1Exploit

Talos Details Windows Cloud Files Use-after-free

CVE-2026-58613 · Windows Cloud Files Mini Filter Driver · CVSS 8.8

Talos reports a use-after-free in Microsoft's Windows Cloud Files Mini Filter Driver that enables privilege escalation.¹ Talos says an attacker can trigger the vulnerability via a dedicated application; provider progress handling and timer races are involved.¹

Updated Since Nov 8: Cloud Files Driver Has Type Confusion Flaw · New: helpnetsecurity.com, bleepingcomputer.com

Timeline

Oct 31Windows Cloud Files Driver Permits Local Privilege Escalation
Nov 6Windows Cloud Files Driver Has Use-after-free
Nov 8Cloud Files Driver Has Type Confusion Flaw
This edition

CVE-2026-58613: EPSS <0.01 (FIRST); CVE-2023-29361: EPSS 0.04 (FIRST)

1CISCO TALOS VULNERABILITY REPORTS · Talos: Windows Cloud Files UAF Vulnerability CVE-2026-58613

Copy link to “Talos Details Windows Cloud Files Use-after-free”

P3Identity

Bay Raises Funding for Enterprise AI Agent Control

$50 million · $37 million Series A and $13 million seed

SecurityWeek reports that Bay raised $50 million to provide a control plane for enterprise AI agents.¹ Bay's Enforcer component evaluates actions in milliseconds to enforce policy during agent sessions, guided by Lighthouse.¹

1SECURITYWEEK · Bay Raises $50 Million to Control Enterprise AI Agents

Copy link to “Bay Raises Funding for Enterprise AI Agent Control”

The wire, last 30 days

This edition has 2 stories rated critical or elevated (P0 or P1); the 25 daily editions from 13 Oct to 10 Nov averaged 3.3. 4 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table

Edition	P0	P1	P2	P3
11 Nov (this edition)	0	2	0	1
10 Nov	0	2	1	0
9 Nov	1	1	1	0
8 Nov	0	3	1	0
7 Nov	0	3	0	0
6 Nov	1	3	1	0
5 Nov	0	3	2	0
4 Nov	2	2	0	0
3 Nov	0	3	1	0
2 Nov	0	2	1	1
1 Nov	0	3	0	0
31 Oct	1	2	1	0
30 Oct	1	4	0	0
29 Oct	1	1	1	0
28 Oct	1	2	1	1
27 Oct	1	3	1	0
26 Oct	1	1	1	1
23 Oct	0	3	2	0
22 Oct	1	4	0	0
21 Oct	2	2	0	0
20 Oct	2	2	1	0
19 Oct	2	3	0	0
16 Oct	1	2	1	0
15 Oct	1	3	1	0
14 Oct	2	1	1	1
13 Oct	1	3	0	0

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

PAN-OS CVE-2026-0331 Sensitive Information Disclosure

An unauthenticated attacker with network access can obtain sensitive PAN-OS firewall and session data via CVE-2026-0331. Panorama is unaffected. The vulnerability is MEDIUM severity with listed upgrades for Cloud NGFW and Prisma Access. No known exploitation; upgrades are scheduled or on-demand. Exfiltration risk is higher for PA-Series and VM-Series; Prisma Access requires authenticated access.

5 reports

PALO ALTO NETWORKS SECURITY ADVISORIESPAN-OS CVE-2026-0331 Sensitive Information Disclosure
PALO ALTO NETWORKS SECURITY ADVISORIESCVE-2026-0325: GlobalProtect Authorization Bypass in PAN-OS
PALO ALTO NETWORKS SECURITY ADVISORIESPAN-OS CVE-2026-0328 User Impersonation via GlobalProtect Portal
PALO ALTO NETWORKS SECURITY ADVISORIESCVE-2026-0327 Privilege Escalation in GlobalProtect on PAN-OS
PALO ALTO NETWORKS SECURITY ADVISORIESCVE-2026-0330: RCE in PAN-OS Panorama

Microsoft Patch Tuesday November 2026: 1,260 Vulnerabilities

Microsoft Patch Tuesday November 2026 addresses 1,260 vulnerabilities, with 68 rated critical. 167 Chromium issues affect Microsoft Edge. CVE-2026-124194 in Outlook is already being exploited. Notable items include CVE-2026-119958 (LDAP RCE) and multiple CVEs in Microsoft Queuing, Windows TCP/IP RCE, and ASP.NET Core flaws.

4 reports

SANS INTERNET STORM CENTERMicrosoft Patch Tuesday November 2026: 1,260 Vulnerabilities
THE HACKER NEWSMicrosoft Patches 1,259 Flaws, Outlook Exploit Exposes NTLMv2 Hashes
MALWAREBYTES LABSMicrosoft Patch Tuesday fixes Outlook flaw already under attack
NEWSAPI CYBER INSIGHTSMicrosoft Fixes 1235 Flaws in Record Patch Tuesday

Vanderbilt Restores Systems After Cyberattack as BYOD Claims Data Theft

Vanderbilt University is restoring systems after a cyberattack claimed by the BYOD ransomware group, which reportedly encrypted databases and obtained more than one million Social Security numbers plus names and contact details. The attackers allegedly gained a domain controller and backups; how access occurred remains undisclosed.

3 reports

MALWAREBYTES LABSVanderbilt Restores Systems After Cyberattack as BYOD Claims Data Theft
NEWSAPI CYBER INSIGHTSVanderbilt University Hit by BYOD Ransomware Attack and Data Theft
NEWSAPI CYBER INSIGHTSAttackers Claim Data Stolen From Vanderbilt Over 1 Million

eMudhra Revokes 8 More CA Certificates After Private-Key Mishap

eMudhra revoked eight additional intermediate CA certificates, bringing total affected to 16 due to a buggy Python script that moved private keys between HSMs in April 2025. The script weakened eight ECDSA keys and raised concerns over eight RSA keys. Some RSA intermediates issued since May 2026; last issued Nov 3. eMudhra plans to exit publicly trusted TLS and awaits KPMG findings.

2 reports

BLEEPINGCOMPUTEReMudhra Revokes 8 More CA Certificates After Private-Key Mishap
THE HACKER NEWSeMudhra Revokes Eight More CAs After Key Compromise

Maersk Data Breach: WhiteArmor Demands $5 Million

Maersk confirms a data breach after WhiteArmor ransomware claims an intrusion. WhiteArmor demands USD 5,000,000 in bitcoin. The threat actor claims to hold about 100 GB of data exfiltrated from Maersk's LF Logistics platform, including nearly 30,000 driver records, plaintext passwords, 33 SUPER_ADMIN accounts, and 27,842 mobile device logs.

2 reports

BLEEPINGCOMPUTERMaersk Data Breach: WhiteArmor Demands $5 Million
BREACHES.NETMaersk Faces WhiteArmor Demand Over Data Theft Claim

Critical Zoom Workplace Flaws Permit Unauthenticated Privilege Escalation

Zoom Workplace for Windows patches two critical flaws (CVE-2026-108186, CVE-2026-108187) enabling unauthenticated remote privilege escalation via network access. CVE-2026-108186 affects 7.1.0–7.1.7/8, CVE-2026-108187 affects prior to 7.1.5. A prior fix for CVE-2026-53412 was issued in July. Users urged to apply latest patches; no exploitation in the wild confirmed.

2 reports

THE HACKER NEWSCritical Zoom Workplace Flaws Permit Unauthenticated Privilege Escalation
SECURITYWEEKAsus and Zoom Patch Critical Security Vulnerabilities

AntiFox AI Pentesting Platform Linked to AWS Secrets Access

Cybersecurity researchers say AntiFox, an AI-driven pentesting platform, was used to steal AWS credentials and pivot into production environments. Activity linked to Alibaba Cloud hosting AntiFox interfaces with confirmed actions against AWS. Initial access came via a compromised IIS web app using a w3wp.exe ASPX shell.

2 reports

THE HACKER NEWSAntiFox AI Pentesting Platform Linked to AWS Secrets Access
BLEEPINGCOMPUTERHackers Use AntiFox AI Agents in AWS Credential-Theft Attacks

N-able patches N-central zero-day vulnerabilities with hotfixes

N-able released hotfixes to address six CVEs in N-central 2026.4 HF2. All hosted NCODs upgraded; On-Premises should upgrade ASAP. Defused said attackers are scanning for the 0-days. Shadowserver reports 148 exposed N-central servers online, down from 1,338.

2 reports

BLEEPINGCOMPUTERN-able patches N-central zero-day vulnerabilities with hotfixes
TENABLE BLOGAble2Shell Exposed N-able N-central Zero-Days: Key CVEs

Also reported

BLEEPINGCOMPUTERBaker Tilly Data Breach at Third-Party Provider
UNIT 42ARTEX and AI-Powered Red Teaming Tools: What Defenders Need to Know
BLEEPINGCOMPUTERActive ScreenConnect Attacks Breach MSPs, Impact Dozens
BLEEPINGCOMPUTERNotion Breach Exposes Fireworks AI Chat Transcripts in Workspaces
AWS SECURITY BLOGEase of Use and Secure Defaults in the New AWS Experience
MICROSOFT SECUREGSocket: Stealthy C2 via Global Socket Relay Network
AWS SECURITY BLOGPart 4: What I’d Tell My Younger Self in Cybersecurity
PALO ALTO NETWORKS SECURITY ADVISORIESChromium Vulnerabilities Updated in Prisma Browser November 2026
PALO ALTO NETWORKS SECURITY ADVISORIESCVE-2026-0323 Checkov by Prisma Cloud SSRF Vulnerability
PALO ALTO NETWORKS SECURITY ADVISORIESCVE-2026-0324 GlobalProtect App Privilege Escalation in OPSWAT SDK

End of the Wednesday, November 11, 2026 edition.

Get a free cybersecurity brief by email on weekdays. Get the brief →

Colophon

SitRep · Vol. 1, No. 54

Publisher: Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure: SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards: Read our editorial standards.
Corrections: brief@sitrepit.com or the contact page.