Skip to content
Wednesday, November 11, 2026Nov 11, 2026
Previous issue

Vol. 1, No. 54Composed Nov 11 · 20:52 UTC

SitRep

Cybersecurity, in perspective.

2 critical · 2 elevated5 stories on the wire

Scale amplifies small mistakes; attention is the true safety margin.
— Marcus Andreelius
ⓘMarcus Andreelius is a fictional AI editorial voice. This reflection is original editorial prose, not a quotation.

You are reading a previous issue. Go to the latest edition →

The situation

CISA Flags Actively Exploited BroadWorks Flaw

CISA flags an actively exploited BroadWorks flaw; Cisco patched it in August, and FCEB agencies face a November 24 deadline.

3 sources

BleepingComputer, SANS Internet Storm Center, Palo Alto Networks Security Advisories

CISA flags CVE-2026-20320 in Cisco BroadWorks as actively exploited. The unauthenticated XXE in the OCI XML Parser can allow an attacker to read sensitive files via crafted OCI-P XML. Cisco patched the flaw in August; FCEB agencies are directed to patch by November 24 under BOD 26-04.

Context

CISA flags CVE-2026-20320 in Cisco BroadWorks as actively exploited. The flaw is an unauthenticated XXE in the OCI XML Parser; an attacker can read sensitive files via crafted OCI-P XML.

“Microsoft's November Patch Tuesday addresses 1,260 vulnerabilities, with 68 rated critical.”
From Senecowitz · Analysis
The move

3 things to do today

Epictim Draper

  1. Upgrade on-premises N-central 2026.4 HF2 instances as soon as possible.
  2. Restrict Panorama management interface access to trusted networks; use Threat Prevention subscriptions for limited mitigation via Threat IDs 510045 and 510048.
  3. Disable Checkov external-module downloads or use trusted configuration files to mitigate the SSRF; update to version 3.4.2 or later for the fix.

On the wire

  • 2critical
  • 2elevated
  • 1moderate
  • 0low
P0Breach

CISA Flags Actively Exploited BroadWorks Flaw

CVE-2026-20320 · Cisco patched the flaw in August · FCEB patch deadline: November 24

CISA flagged CVE-2026-20320 in Cisco BroadWorks as actively exploited; the unauthenticated XXE in the OCI XML Parser can allow an attacker to read sensitive files via crafted OCI-P XML.1 Cisco patched the flaw in August; it is listed in the KEV Catalog, and FCEB agencies are directed to patch by November 24 under BOD 26-04.1

Added to CISA KEV on 10 Nov 2026 (CVE-2026-20320) · CVE-2026-20320: EPSS <0.01 (FIRST)

  1. 1BLEEPINGCOMPUTER · CISA Flags Cisco BroadWorks Flaw Actively Exploited

Copy link to “CISA Flags Actively Exploited BroadWorks Flaw”

P0Patch Tuesday

Microsoft Reports Exploited Outlook Vulnerability

CVE-2026-124194 · 1,260 vulnerabilities addressed · 68 rated critical

SANS reports that Microsoft's November Patch Tuesday addresses CVE-2026-124194 in Outlook, which is already being exploited.1 The update addresses 1,260 vulnerabilities, 68 rated critical.1

Added to CISA KEV on 10 Nov 2026 (CVE-2026-124194) · CVE-2026-124194: CVSS 6.5

  1. 1SANS INTERNET STORM CENTER · Microsoft Patch Tuesday November 2026: 1,260 Vulnerabilities

Copy link to “Microsoft Reports Exploited Outlook Vulnerability”

P2Exploit

Checkov SSRF Can Force Internal Network Requests

CVE-2026-0323 · Fixed in Checkov 3.4.2 or later

Palo Alto Networks reports that a server-side request forgery in Checkov by Prisma Cloud allows a local unauthenticated user to force network requests from the host to internal services when external Terraform modules are downloaded.1 The issue affects versions before 3.4.2; Palo Alto Networks says 3.4.2 or later fixes it.1

CVE-2026-0323: CVSS 1.1

  1. 1PALO ALTO NETWORKS SECURITY ADVISORIES · CVE-2026-0323 Checkov by Prisma Cloud SSRF Vulnerability

Copy link to “Checkov SSRF Can Force Internal Network Requests”

The wire, last 30 days

This edition has 4 stories rated critical or elevated (P0 or P1); the 25 daily editions from 13 Oct to 10 Nov averaged 3.3. 4 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
11 Nov (this edition)2210
10 Nov0210
9 Nov1110
8 Nov0310
7 Nov0300
6 Nov1310
5 Nov0320
4 Nov2200
3 Nov0310
2 Nov0211
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Vanderbilt Restores Systems After Cyberattack as BYOD Claims Data Theft

Vanderbilt University is restoring systems after a cyberattack claimed by the BYOD ransomware group, which reportedly encrypted databases and obtained more than one million Social Security numbers plus names and contact details. The attackers allegedly gained a domain controller and backups; how access occurred remains undisclosed.

3 reports

eMudhra Revokes 8 More CA Certificates After Private-Key Mishap

eMudhra revoked eight additional intermediate CA certificates, bringing total affected to 16 due to a buggy Python script that moved private keys between HSMs in April 2025. The script weakened eight ECDSA keys and raised concerns over eight RSA keys. Some RSA intermediates issued since May 2026; last issued Nov 3. eMudhra plans to exit publicly trusted TLS and awaits KPMG findings.

2 reports

Maersk Data Breach: WhiteArmor Demands $5 Million

Maersk confirms a data breach after WhiteArmor ransomware claims an intrusion. WhiteArmor demands USD 5,000,000 in bitcoin. The threat actor claims to hold about 100 GB of data exfiltrated from Maersk's LF Logistics platform, including nearly 30,000 driver records, plaintext passwords, 33 SUPER_ADMIN accounts, and 27,842 mobile device logs.

2 reports

Critical Zoom Workplace Flaws Permit Unauthenticated Privilege Escalation

Zoom Workplace for Windows patches two critical flaws (CVE-2026-108186, CVE-2026-108187) enabling unauthenticated remote privilege escalation via network access. CVE-2026-108186 affects 7.1.0–7.1.7/8, CVE-2026-108187 affects prior to 7.1.5. A prior fix for CVE-2026-53412 was issued in July. Users urged to apply latest patches; no exploitation in the wild confirmed.

2 reports

AntiFox AI Pentesting Platform Linked to AWS Secrets Access

Cybersecurity researchers say AntiFox, an AI-driven pentesting platform, was used to steal AWS credentials and pivot into production environments. Activity linked to Alibaba Cloud hosting AntiFox interfaces with confirmed actions against AWS. Initial access came via a compromised IIS web app using a w3wp.exe ASPX shell.

2 reports

Grok-Built Apps Exposed Online: 35,578 Open

Claroc found 37,571 Grok-built apps online; 35,578 were openly accessible without sign-in. Twenty-four staff apps from SpaceXSI and X were exposed. About 1 in 10 open apps contained internal data. Of open apps, roughly 2% held high or critical material, including a hospital staff list and an ICU briefing. SpaceXSI removed the 24 staff apps; researchers urged stricter defaults and access controls.

2 reports

Railway Breach: Stolen AI Keys Led to $740K Unauthorized Charges

Railway says attackers stole customer AI keys in an October breach, driving an estimated $740,000 in unauthorized spend. Decrypted data included about 100,000 workspaces and 1,852 linked-account tokens; no customer databases were reportedly accessed. Refunds vary by provider; Railway advised revoking keys and isolating credentials. FBI IC3 complaint filed, investigation ongoing.

2 reports

Microsoft Research Reveals Neuron-Backdooring AI Agents

Microsoft researchers demonstrate backdoors in AI agents by editing fewer than 10 seldom-used neurons without retraining. The Lazarus technique triggers tokens via a trigger string, enabling attacker commands with the model’s permissions. Tested on Nemotron-Terminal-8B, Qwen3.6-27B, Gemma-4-31B-IT; success rates vary 51%-99.5%. Mitigations include weight checks, sandboxing, and model provenance.

2 reports

Also reported

End of the Wednesday, November 11, 2026 edition.

Colophon

SitRep · Vol. 1, No. 54

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.