Skip to content
Wednesday, November 11, 2026Nov 11, 2026
Previous issue

Vol. 1, No. 54Composed Nov 11 · 16:52 UTC

SitRep

Cybersecurity, in perspective.

1 critical · 3 elevated4 stories on the wire

Scale demands pause; attention prevents automated collapse.
— Marcus Andreelius
ⓘMarcus Andreelius is a fictional AI editorial voice. This reflection is original editorial prose, not a quotation.

You are reading a previous issue. Go to the latest edition →

The situation

CISA Flags Cisco BroadWorks Flaw as Actively Exploited

CISA flags an unauthenticated Cisco BroadWorks flaw as actively exploited; federal agencies must patch by Nov 24.

4 sources

BleepingComputer, Tenable Blog, Cisco Talos Vulnerability Reports, Malwarebytes Labs

CISA flags an unauthenticated XXE flaw in Cisco BroadWorks as actively exploited. BleepingComputer reports that crafted OCI-P XML can allow an attacker to read sensitive files; Cisco patched the flaw in August. CISA added it to the KEV catalog, with FCEB agencies required to patch by Nov 24 under BOD 26-04.

Context

The flaw is an unauthenticated XXE in BroadWorks' OCI XML Parser. BleepingComputer reports that crafted OCI-P XML can allow an attacker to read sensitive files.

The move

2 things to do today

Epictim Draper

  1. Cisco BroadWorks: FCEB agencies must patch by Nov 24 under BOD 26-04.
  2. Update Office and Windows promptly.

On the wire

  • 1critical
  • 3elevated
  • 0moderate
  • 0low
P0Exploit

CISA Flags Cisco BroadWorks Flaw as Exploited

Unauthenticated XXE in the OCI XML Parser

BleepingComputer reports that CISA flagged an unauthenticated XXE flaw in Cisco BroadWorks as actively exploited and added it to the KEV catalog.1 Crafted OCI-P XML can allow an attacker to read sensitive files.1 Cisco patched the flaw in August.1

Added to CISA KEV on 10 Nov 2026 (CVE-2026-20320) · CVE-2026-20320: EPSS <0.01 (FIRST)

  1. 1BLEEPINGCOMPUTER · CISA Flags Cisco BroadWorks Flaw Actively Exploited

Copy link to “CISA Flags Cisco BroadWorks Flaw as Exploited”

P1Vulnerability

N-able Fixes N-central Vulnerabilities

33 findings disclosed · 7 CVEs fixed · hosted services upgraded

Tenable reports that a researcher disclosed 33 Able2Shell findings with PoC code.1 N-able fixed seven CVEs in N-central 2026.4 Hotfix 2, and hosted N-central services were taken offline and upgraded by Nov 10.1 Tenable reports that exploitation attempts were observed, but confirmed compromises were not reported.1

  1. 1TENABLE BLOG · Able2Shell Exposed N-able N-central Zero-Days: Key CVEs

Copy link to “N-able Fixes N-central Vulnerabilities”

P1Exploit

Talos Reports Windows Cloud Files Flaw

CVE-2026-58613 · use-after-free enables privilege escalation

Talos reports a use-after-free in Microsoft's Windows Cloud Files Mini Filter Driver, CldiStreamCompleteRequest, tracked as CVE-2026-58613.1 Talos says the flaw enables privilege escalation and can be triggered by a dedicated application via provider progress handling and timer races.1

Updated Since Nov 8: Cloud Files Driver Has Type Confusion Flaw · New: helpnetsecurity.com, bleepingcomputer.com

Timeline

  1. Oct 31Windows Cloud Files Driver Permits Local Privilege Escalation
  2. Nov 6Windows Cloud Files Driver Has Use-after-free
  3. Nov 8Cloud Files Driver Has Type Confusion Flaw
  4. This edition

CVE-2026-58613: EPSS <0.01 (FIRST); CVE-2023-29361: EPSS 0.04 (FIRST)

  1. 1CISCO TALOS VULNERABILITY REPORTS · Talos: Windows Cloud Files UAF Vulnerability CVE-2026-58613

Copy link to “Talos Reports Windows Cloud Files Flaw”

P1Patch

Microsoft Patches Outlook Flaw Under Attack

CVE-2026-124194 exploited · CVE-2026-116928 may allow code execution

Malwarebytes reports that Microsoft patched an exploited Outlook flaw, CVE-2026-124194, that could expose authentication hashes and allow impersonation.1 A second flaw, CVE-2026-116928 in Windows Search, may allow code execution via a malicious email attachment, but was not yet exploited.1 The updates fix 48 critical remote code execution vulnerabilities.1

Added to CISA KEV on 10 Nov 2026 (CVE-2026-124194) · CVE-2026-124194: CVSS 6.5; CVE-2026-116928: CVSS 9.8

  1. 1MALWAREBYTES LABS · Microsoft Patch Tuesday fixes Outlook flaw already under attack

Copy link to “Microsoft Patches Outlook Flaw Under Attack”

The wire, last 30 days

This edition has 4 stories rated critical or elevated (P0 or P1); the 25 daily editions from 13 Oct to 10 Nov averaged 3.3. 4 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
11 Nov (this edition)1300
10 Nov0210
9 Nov1110
8 Nov0310
7 Nov0300
6 Nov1310
5 Nov0320
4 Nov2200
3 Nov0310
2 Nov0211
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

PAN-OS CVE-2026-0331 Sensitive Information Disclosure

An unauthenticated attacker with network access can obtain sensitive PAN-OS firewall and session data via CVE-2026-0331. Panorama is unaffected. The vulnerability is MEDIUM severity with listed upgrades for Cloud NGFW and Prisma Access. No known exploitation; upgrades are scheduled or on-demand. Exfiltration risk is higher for PA-Series and VM-Series; Prisma Access requires authenticated access.

5 reports

Vanderbilt Restores Systems After Cyberattack as BYOD Claims Data Theft

Vanderbilt University is restoring systems after a cyberattack claimed by the BYOD ransomware group, which reportedly encrypted databases and obtained more than one million Social Security numbers plus names and contact details. The attackers allegedly gained a domain controller and backups; how access occurred remains undisclosed.

3 reports

eMudhra Revokes 8 More CA Certificates After Private-Key Mishap

eMudhra revoked eight additional intermediate CA certificates, bringing total affected to 16 due to a buggy Python script that moved private keys between HSMs in April 2025. The script weakened eight ECDSA keys and raised concerns over eight RSA keys. Some RSA intermediates issued since May 2026; last issued Nov 3. eMudhra plans to exit publicly trusted TLS and awaits KPMG findings.

2 reports

Maersk Data Breach: WhiteArmor Demands $5 Million

Maersk confirms a data breach after WhiteArmor ransomware claims an intrusion. WhiteArmor demands USD 5,000,000 in bitcoin. The threat actor claims to hold about 100 GB of data exfiltrated from Maersk's LF Logistics platform, including nearly 30,000 driver records, plaintext passwords, 33 SUPER_ADMIN accounts, and 27,842 mobile device logs.

2 reports

Critical Zoom Workplace Flaws Permit Unauthenticated Privilege Escalation

Zoom Workplace for Windows patches two critical flaws (CVE-2026-108186, CVE-2026-108187) enabling unauthenticated remote privilege escalation via network access. CVE-2026-108186 affects 7.1.0–7.1.7/8, CVE-2026-108187 affects prior to 7.1.5. A prior fix for CVE-2026-53412 was issued in July. Users urged to apply latest patches; no exploitation in the wild confirmed.

2 reports

AntiFox AI Pentesting Platform Linked to AWS Secrets Access

Cybersecurity researchers say AntiFox, an AI-driven pentesting platform, was used to steal AWS credentials and pivot into production environments. Activity linked to Alibaba Cloud hosting AntiFox interfaces with confirmed actions against AWS. Initial access came via a compromised IIS web app using a w3wp.exe ASPX shell.

2 reports

Grok-Built Apps Exposed Online: 35,578 Open

Claroc found 37,571 Grok-built apps online; 35,578 were openly accessible without sign-in. Twenty-four staff apps from SpaceXSI and X were exposed. About 1 in 10 open apps contained internal data. Of open apps, roughly 2% held high or critical material, including a hospital staff list and an ICU briefing. SpaceXSI removed the 24 staff apps; researchers urged stricter defaults and access controls.

2 reports

Railway Breach: Stolen AI Keys Led to $740K Unauthorized Charges

Railway says attackers stole customer AI keys in an October breach, driving an estimated $740,000 in unauthorized spend. Decrypted data included about 100,000 workspaces and 1,852 linked-account tokens; no customer databases were reportedly accessed. Refunds vary by provider; Railway advised revoking keys and isolating credentials. FBI IC3 complaint filed, investigation ongoing.

2 reports

Also reported

End of the Wednesday, November 11, 2026 edition.

Colophon

SitRep · Vol. 1, No. 54

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.