Three-day deadlines don't leave room
for a missed email.
CyberComply monitors the CISA KEV catalog 24/7 and alerts you within minutes of every new listing, so the clock never starts without you.
KEV Intelligence Brief: Auth Failures at the Edge, and Management Planes Exposed
Date: Monday, November 9, 2026
Eight new KEV entries share one theme: authentication and trust boundaries failing on systems that sit at the perimeter or control other systems. Four are unauthenticated or auth-bypass flaws, and one Ivanti chain turns a low-privilege foothold into persistent access. Several deadlines are three days or less, and two have already passed.
Today's Additions: Three-Day Deadlines for Unauthenticated Access
Three entries added today carry a November 12 deadline. Each gives an attacker control without valid credentials, or defeats authentication outright.
- CVE-2026-102895 (GPUStack): An improper authentication flaw grants unauthenticated administrative access. An attacker can modify users and models, create persistent administrator API keys, and read worker and cloud-provider secrets. The
POST /v2/inference-backends/from-yamlendpoint gives code execution. GPU clusters typically hold cloud credentials and sensitive model assets, so a compromise reaches well beyond the host. - CVE-2026-116779 (SignalWire FreeSwitch): A code injection flaw allows configuration and credential disclosure, arbitrary call control, and command execution. Beyond host compromise, expect toll fraud, call interception, and SIP trunk credential theft.
- CVE-2026-123158 (OpenBSD OpenSSH on Linux): An unexpected return value flaw allows authentication bypass. Because it affects Linux builds, check distribution packages and vendor-patched builds rather than relying on upstream version strings. SSH is the universal administrative path, so prioritize bastions and internet-facing hosts.
Remediation notes:
- Treat all three as presumed-compromised if they were internet-exposed. BOD 26-04 and CISA's Forensics Triage Requirements call for evidence preservation alongside patching, so capture logs and images before rebuilding.
- For GPUStack, rotate every secret the platform held: cloud-provider keys, worker tokens, and all API keys. Audit for administrator keys you did not create, since they survive patching.
- For FreeSwitch, restrict the event socket and management interfaces to trusted networks. Rotate SIP and gateway credentials and review call detail records for anomalous destinations.
- For OpenSSH, audit
authorized_keys, review auth logs for successful logins without matching credential events, and restrict SSH exposure to VPN or bastion paths while you patch. - If no mitigation exists for an exposed instance, BOD 26-04 directs you to discontinue use. Pull it offline rather than wait.
VPN and Identity Perimeter: SonicWall and Ivanti
Remote access gateways remain a favored entry point, and these three entries show attackers defeating the identity controls around them.
- CVE-2026-19868 (SonicWall SonicOS SSLVPN): A single-factor authentication flaw lets a user holding valid credentials for an alternate authentication method bypass SAML controls, including SAML-enforced MFA. Organizations that rely on SAML MFA for VPN may have less protection than they assume. Deadline: November 20. Disable unneeded alternate authentication methods on SSLVPN now, then patch. Review VPN logs for logins that skipped the IdP.
- CVE-2026-111357 (Ivanti Connect Secure): A missing authentication flaw allows local privilege escalation. Its deadline of November 2 has passed.
- CVE-2026-118527 (Ivanti Connect Secure): Predictable identifiers let a remote authenticated attacker upload attacker-controlled files to a known disk location. Deadline: November 13, four days out.
CISA notes these two Ivanti entries chain with each other and with CVE-2026-104935, so treat them as one exploit path: authenticated upload to a predictable location, then privilege escalation. The split deadlines (November 2 versus November 13) should not drive your patch order. Apply fixes for the whole chain together.
Remediation notes:
- Run Ivanti's Integrity Checker Tool and treat any anomalies as incident triggers. Appliances with unpatched exposure should be assumed compromised.
- If compromise is suspected, factory reset, rotate all credentials and certificates the appliance handled, and force re-enrollment of sessions.
- Federal contractors with Ivanti appliances past November 2 should document status and compensating controls now.
Overdue and Endpoint-Side: WordPress and Apple
Two entries from earlier this week round out the picture.
- CVE-2026-119977 (WordPress Core): A TOCTOU race condition lets unauthenticated attackers execute code during full-package core upgrades, using predictable, web-accessible staging paths. The deadline of November 6 has passed. Exposure is limited to the upgrade window, but auto-update fleets create that window constantly and at scale. Confirm every site runs the fixed release. Where possible, block web access to staging directories at the web server, and review webroot and upgrade directories for unexpected files or webshells. Check managed hosting and agency-run sites, which often lag.
- CVE-2024-27834 (Apple multiple products): A pointer authentication bypass affects iOS, iPadOS, macOS, Safari, tvOS, and watchOS. It requires an existing arbitrary read/write primitive, so it is almost certainly used as a link in a browser exploit chain, typically targeted spyware. Deadline: November 18. Push OS updates through MDM and verify compliance rather than assuming it. Enable Lockdown Mode for high-risk users.
Priority Order
- Now: Ivanti chain (CVE-2026-111357 is overdue), WordPress (overdue).
- By November 12: GPUStack, FreeSwitch, OpenSSH.
- By November 13: Ivanti CVE-2026-118527.
- By November 18-20: Apple and SonicWall.
Under BOD 26-04, assess each asset's internet exposure yourself. Exposure should set your urgency more than the published deadline.
Sources: CISA KEV Catalog · CISA BOD 26-04 and Forensics Triage Requirements · Ivanti Security Advisories · SonicWall PSIRT · Apple Security Releases · WordPress News and Releases · OpenSSH Security · FreeSWITCH Security Advisories · GPUStack GitHub Advisories
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — November 9, 2026
GitHub Supply Chain Campaign Delivers Credential-Stealing Workflows to Tens of Thousands of Repositories
Researchers have identified a supply chain campaign dubbed GhostAction that pushed malicious GitHub Actions workflows into tens of thousands of repositories to exfiltrate cloud and AI credentials, according to GBHackers. The campaign targeted repositories to inject credential-stealing automation into CI/CD pipelines, though the disclosure does not specify the exact compromise count, which organizations were affected, or whether the threat actors successfully exfiltrated credentials from targeted environments. The attack method represents a supply chain vector focused on developer infrastructure rather than production software dependencies.
Chinese-Linked Intrusion Follows ConnectWise Breach, Researchers Report Over 2,250 Microsoft 365 Tenants Compromised
Chinese-linked threat actors breached ConnectWise infrastructure and subsequently compromised over 2,250 Microsoft 365 tenants using the ARTEX AI framework, security researchers report. The campaign follows yesterday's Microsoft disclosure attributing ARTEX abuse to Storm-3358 targeting Southeast Asian financial organizations. The ConnectWise breach disclosure does not detail the initial compromise vector, the timeline between the infrastructure breach and downstream tenant compromises, or whether the 2,250 figure represents attempted or successful intrusions. ConnectWise has not publicly confirmed the breach or provided incident details.
Belarusian and Russian Opposition Groups Claim 23TB Data Exfiltration from Rosstat Statistics Agency
Belarusian CyberPartisans and Silent Crow claim to have breached Russia's Rosstat state statistics agency and exfiltrated 23 terabytes of data including military casualty figures related to the Ukraine war, according to SC World. The threat actors published differing casualty estimates—Silent Crow claiming nearly 400,000 Russian deaths while CyberPartisans reported lower figures—based on data they assert came from the breach. Russian authorities have not confirmed the intrusion, and the casualty figures have not been independently verified by government or intelligence sources. The reported breach follows a pattern of hacktivist operations targeting Russian government infrastructure since 2022.
Additional Confirmed Activity: CISA and FBI jointly warned of ongoing attacks targeting industrial refrigeration and cold chain monitoring systems globally, following recent incidents affecting European supermarket networks. Researchers documented Anubis ransomware operators using a previously undocumented backdoor called Lindnor against Microsoft SQL servers at a U.S. organization. ModSecurity web application firewall disclosed two high-severity vulnerabilities allowing attackers to bypass file upload restrictions or crash server workers.
Sources: GBHackers · SC World · Pravda · Cybersecurity News
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
GhostAction Supply Chain Attack Hits Tens of Thousands of GitHub Repositories
The GhostAction supply chain campaign pushed credential-stealing GitHub Actions workflows into tens of thousands of repositories to steal cloud and AI...
Chinese-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach
Chinese-linked hackers breached ConnectWise and used the ARTEX AI framework to compromise over 2,250 Microsoft 365 tenants globally.
Russian State Statistics Agency Rosstat Suffers Major Data Breach
Rosstat, Russia's state statistics agency, was breached by Belarusian CyberPartisans and Silent Crow, who exfiltrated 23TB of data including military ...
Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch Records
The most serious confirmed harm there involved emergency-services data. Cybersecurity. The dispatch records came from a city's system for 119, ...
CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known ...
How AI is enabling faster, more dangerous cyber war
State-backed Chinese hackers are using AI-powered tools like Artex to automate attacks at unprecedented speed, with one group gaining deep network acc...
T-Mobile Confirms Data Breach Affecting 47.8 Million People
T-Mobile confirmed a data breach affecting 47.8 million people.
How North Korean Hackers Interviewed Their Way Into Binance
North Korean hackers stole $6.34 billion from Binance by infecting an engineer through a fake job interview, then using his machine and internal AI to...
Updated daily