The Exploit Bulletin — Wednesday, November 11, 2026: 10 issues require action
Wednesday, November 11, 2026 — 10 issues require action. If you run none of the software below, you are done.
Affects: N-able N-central · Barracuda Email Security Gateway / Load Balancer Application Delivery Controller / Web Application Firewall / Web Security Gateway / Message Archiver / WAF Control Center · DbGate · FOSSBilling · Qubole · Microsoft 365 Apps for Enterprise / Office LTSC · Cisco BroadWorks · OpenEMR · Danfoss AK-SM 8xxA Series · Fireworks AI
1. Unauthenticated schema-hint SSRF in N-able N-central service import schema validation (CVE-2026-125881)
DATA EXPOSURE · CRITICAL · CVSS 9.3
A request-level proof of concept for this unauthenticated flaw was published as part of the Able2Shell disclosure on 2026-11-10, N-able has already shipped hotfix 26.4.1 and taken its hosted N-central offline, and credible reports describe active exploitation attempts; any N-central server still below version 26.4.1 and reachable from the internet can be probed with the published requests by anyone who reads the write-up.
N-central's service import schema validation accepts an attacker-controlled schema hint and fetches it server-side, giving an unauthenticated remote attacker a server-side request forgery with high confidentiality and integrity impact against the RMM server and the internal network it can reach. It is one of seven issues N-able fixed in hotfix 26.4.1 after a researcher published proof-of-concept code for 33 alleged N-central flaws ("Able2Shell").
Affected: N-able N-central < 26.4.1
How to Test: In the N-central administration console, confirm the installed version; anything below 26.4.1 is affected. Review the N-central web server access logs for unexpected requests to the service import / schema validation functionality from unfamiliar source addresses, and check egress/firewall logs for outbound connections initiated by the N-central server to internal hosts or external URLs it does not normally contact, which would indicate the SSRF has been used.
How to Patch: Upgrade on-premises N-central to 26.4.1 (the hotfix that addresses this and the six other Able2Shell CVEs). Hosted N-central customers are dependent on N-able, which has taken the hosted service offline while it remediates. Until the upgrade is applied, restrict access to the N-central web interface to trusted networks or a VPN rather than leaving it exposed to the internet.
Evidence: Able2Shell disclosure write-up with request-level PoC for the schema-hint SSRF · Tenable FAQ on the Able2Shell N-central disclosure and the 26.4.1 hotfix · The Hacker News: N-able takes hosted N-central offline after 33 zero-days disclosed with PoC
2. Timezone-field OS command injection gives root on Barracuda ESG, WAF, ADC, WSG, BMA and WCC appliances (CVE-2026-111560)
CISA KEV (due 2026-11-13) · REMOTE CODE EXECUTION · CRITICAL · CVSS 8.6
CISA added the flaw to KEV on 2026-11-10 after Barracuda confirmed on 2026-11-09 that it is being exploited against customers, and a public exploit exists; appliances whose Admin UI is reachable and that have not taken the November patches can be fully taken over as root.
A crafted timezone value submitted through the administrative interface is passed to the OS unsanitized and executes as root. On its own it needs an administrator session, but on Email Security Gateway it chains with the pre-authentication authorization bypass CVE-2026-116606, so anyone who can reach the Admin UI can obtain root on the appliance without credentials.
Affected: Barracuda Email Security Gateway (ESG) <= 9.4.0.27 (also affected by chained CVE-2026-116606); Barracuda Load Balancer Application Delivery Controller (ADC) <= 6.4.0; Barracuda Web Application Firewall (WAF) <= 11.0.1; Barracuda Web Security Gateway (WSG) <= 16.1.100.100; Barracuda Message Archiver (BMA) <= 5.5.4.0; Barracuda WAF Control Center (WCC) <= 2.2.1
How to Test: Check the firmware version and installed security patches on each Barracuda appliance against the list above: ESG at or below 9.4.0.27 without BNSF-40425 (for 9.4.017+) or BNSF-40430 (for <9.4.017), ADC at or below 6.4.0 without BNADC-16586, BMA at or below 5.5.4.0 without BNMA-32468, and WAF <= 11.0.1, WSG <= 16.1.100.100 or WCC <= 2.2.1 without the corresponding Barracuda patch are affected. Determine whether the Admin UI is reachable from untrusted networks, since that is the precondition for exploitation. Review Admin UI access logs for unexpected sessions or requests that modify the timezone setting, inspect the configured timezone value for shell metacharacters or command fragments, and look for unexpected root processes, new accounts, or outbound connections on the appliance; treat any such finding as a compromise and follow CISA's forensics triage guidance before rebuilding.
How to Patch: Apply Barracuda's security patches for each product: ESG BNSF-40425 on firmware 9.4.017 and later or BNSF-40430 on firmware earlier than 9.4.017; ADC BNADC-16586; Message Archiver BNMA-32468; and the corresponding Barracuda-released patches for WAF, WSG and WAF Control Center, ensuring every appliance runs the latest firmware with all security patches applied. Until patched, restrict Admin UI access to trusted management networks only.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · BleepingComputer: attackers exploiting ESG flaws for root · SecurityWeek: Barracuda vulnerabilities exploited in attacks · CISA alert adding CVE-2026-111560 to KEV
3. Unauthenticated code injection via JSON script runner gives remote code execution in DbGate (CVE-2026-47668)
REMOTE CODE EXECUTION · CRITICAL · CVSS 10.0
VulnCheck's canary sensors recorded exploitation attempts on 2026-11-10 and two public exploits plus a Nuclei template exist, so any internet-reachable DbGate below 7.1.9 can be taken over with a single unauthenticated request.
DbGate's JSON script runner (POST /runners/start) concatenates the functionName parameter of assign commands directly into generated JavaScript that is executed in a forked Node.js child process, so an unauthenticated request can run arbitrary code on the host. Versions 7.1.8 and earlier are affected; 7.1.9 fixes it.
Affected: DbGate < 7.1.9 (7.1.8 and all prior versions)
How to Test: Check the DbGate version in the application's about/settings screen or the container image tag; anything below 7.1.9 is vulnerable. Review reverse-proxy or application logs for POST requests to /runners/start, particularly from unknown sources or containing assign commands with unexpected functionName values, and inspect the host for unexpected child processes or outbound connections spawned by the DbGate Node.js process.
How to Patch: Upgrade DbGate to 7.1.9 or later. Until upgraded, remove the DbGate web interface from internet exposure and restrict access to trusted networks or an authenticating reverse proxy.
Evidence: VulnCheck KEV · VulnCheck XDB public exploit · VulnCheck XDB public exploit (second entry)
4. Unauthenticated admin API access through system-role authorization bypass in FOSSBilling (CVE-2026-27604)
AUTHENTICATION BYPASS · CRITICAL · CVSS 10.0
VulnCheck's canary sensors recorded exploitation attempts against this endpoint on 2026-11-10 and 2026-11-11, and an internet-facing FOSSBilling instance below 0.8.0 gives any attacker full admin API control of the billing system and its customer data.
FOSSBilling's API role handling resolves the system role to the cron admin identity, so unauthenticated requests to /api/system/* endpoints invoke admin API methods with no credentials, session or CSRF token. VulnCheck reports the bypass chains with a server-side template injection (CVE-2026-28496) into unauthenticated remote code execution.
Affected: FOSSBilling >= 0.5.4 and < 0.8.0
How to Test: Check the installed FOSSBilling version in the admin panel or install metadata; anything from 0.5.4 up to but not including 0.8.0 is affected. Review web server and reverse-proxy logs for requests to /api/system/* from external addresses, particularly POST calls carrying no authenticated session, and audit admin accounts, API keys, products and client records for changes you did not make; if you find such requests, rotate all admin credentials and API keys.
How to Patch: Upgrade to FOSSBilling 0.8.0. If the upgrade must wait, block external access to /api/system/* at the reverse proxy or WAF and restrict API access to trusted source IPs with the api.allowed_ips setting.
Evidence: VulnCheck KEV
5. Stolen Qubole AWS credentials used to assume customer IAM roles and steal data
SUPPLY-CHAIN COMPROMISE · CRITICAL
Wiz's findings were published this week, and any IAM role that still trusts Qubole's AWS account is an open door until it is removed. Secrets stolen in October can still be used against you right now.
Between October 14 and 26, an attacker used compromised credentials for the AWS account that Qubole (owned by Idera) uses to reach its customers. With them, the attacker assumed the cross-account IAM roles customers had created for Qubole and stole stored secrets and data from more than a dozen organizations, by Wiz's count. Many of these roles were still in place long after the companies had stopped using Qubole, and they could read nearly everything in the account.
Affected: Qubole (Idera) cross-account IAM roles in customer AWS accounts; AWS environments whose IAM role trust policies allow Qubole's AWS account
How to Test: List IAM roles in every AWS account (for example with IAM Access Analyzer, or by checking trust policies for the Qubole account ID and its External ID). Then search CloudTrail for AssumeRole events on those roles between October 14 and 26, 2026, and for later S3 GetObject, Secrets Manager GetSecretValue or SSM parameter reads made from those sessions.
How to Mitigate: Delete Qubole trust roles that are no longer used. Limit any you still need to least privilege with a unique External ID. Rotate every secret, access key and database credential those roles could read.
Evidence: BleepingComputer: Hackers exploit trusted AWS access to breach multiple cloud environments · The Hacker News: Hackers exploit Qubole's trusted AWS access · SecurityWeek: Over a dozen organizations hit in Qubole supply chain attack
6. Outlook message file leaks NTLMv2 hash without external-content warning (CVE-2026-124194)
CISA KEV (due 2026-11-24) · CREDENTIAL EXPOSURE · HIGH · CVSS 6.5
Microsoft confirmed exploitation and shipped the fix in its 2026-11-10 Patch Tuesday release, with CISA adding the flaw to KEV the same day, so organizations that defer this month's Office update leave every Outlook user one opened attachment away from handing an attacker a reusable NTLMv2 hash.
A specially crafted message file opened in an affected Outlook causes the client to connect to an attacker-controlled network location without showing the usual external-content warning, disclosing the user's NTLMv2 hash, which the attacker can use to authenticate as that user. The Preview Pane is not an attack vector; the user must open the file.
Affected: Microsoft 365 Apps for Enterprise (builds prior to the November 2026 security release); Microsoft Office LTSC 2021 before 16.0.14334.21048; Microsoft Office LTSC 2024 before 16.0.17932.21140
How to Test: Check the Outlook build on each endpoint (File > Account > About Outlook, or via your endpoint management inventory) against the fixed builds: LTSC 2021 16.0.14334.21048, LTSC 2024 16.0.17932.21140, and the current November 2026 release for Microsoft 365 Apps. To look for prior abuse, hunt for outbound authentication attempts from workstations to external or unfamiliar network locations that follow a user opening a message-file attachment, and for NTLM authentications for those users from unexpected sources.
How to Patch: Install the November 2026 Office security update: Office LTSC 2021 to 16.0.14334.21048 or later, Office LTSC 2024 to 16.0.17932.21140 or later, and Microsoft 365 Apps for Enterprise to the current build listed at https://aka.ms/OfficeSecurityReleases.
Evidence: CISA KEV · VulnCheck KEV · Vendor confirmed · CISA SSVC: active · Rapid7 Patch Tuesday November 2026: exploited-in-the-wild spoofing vulnerability · ZDI November 2026 review: under active attack
7. Unauthenticated XXE in Cisco BroadWorks OCI-P exposes configuration files (CVE-2026-20320)
CISA KEV (due 2026-11-24) · DATA EXPOSURE · HIGH · CVSS 7.5
CISA added this flaw to KEV on 2026-11-10 with CISA, SecurityWeek and The Hacker News reporting exploitation, and BroadWorks operators who leave an unfixed release with OCI-P reachable risk having platform configuration files — and any credentials they contain — read by attackers.
The Open Client Interface – Provisioning (OCI-P) XML parser in Cisco BroadWorks allows external entity resolution by default. An unauthenticated remote attacker can send a crafted XML message to the OCI-P service and read files from the filesystem with the privileges of the BroadWorks user, including sensitive configuration data, via out-of-band blind XXE.
Affected: Cisco BroadWorks Application Delivery Platform (vulnerable releases, regardless of configuration); Cisco BroadWorks Application Server (vulnerable releases); Cisco BroadWorks Profile Server (vulnerable releases); Cisco BroadWorks Xtended Services Platform (vulnerable releases)
How to Test: Inventory every BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform and compare the installed BroadWorks release against the fixed releases Cisco lists for cisco-sa-bworks-xxe-uwUd7CEt. Because the flaw is an out-of-band blind XXE, review OCI-P request logs for inbound XML messages carrying DOCTYPE/external entity declarations, and check firewall or proxy logs for outbound connections from BroadWorks hosts to unfamiliar external hosts, which would indicate exfiltration of file contents.
How to Patch: Upgrade each affected platform to the fixed BroadWorks release Cisco has published for this advisory; Cisco states there are no workarounds. Until the upgrade is complete, limit network reachability of the OCI-P service to trusted provisioning systems as a compensating control.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · SecurityWeek: Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities · The Hacker News: Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
8. Authenticated path traversal in OpenEMR fax/sms module exposes database credentials and enables file-write RCE (CVE-2026-124450)
REMOTE CODE EXECUTION · HIGH · CVSS 9.3
VulnCheck's canary sensors recorded exploitation attempts against this flaw on 2026-11-10 and 2026-11-11 and a public exploit is in its XDB, so an OpenEMR deployment below 8.3.0 with any low-privilege account reachable by an attacker is one compromised login away from losing its entire patient database.
The disposeDocument action of OpenEMR's bundled fax/sms module (RingCentral and SignalWire clients) takes an unvalidated file_path parameter and checks only the basic patients/demo ACL rather than the documents permission. Any authenticated low-privilege user — most clinical and clerical roles — can read sites/default/sqlconf.php to recover the database credentials for the full patient record set and write arbitrary content to any path owned by the web user, which leads to code execution on the server.
Affected: OpenEMR < 8.3.0 (flaw introduced with the 8.2.0 fax/sms module refactor; fixed in 8.3.0)
How to Test: Confirm the installed OpenEMR version is below 8.3.0 and whether the fax/sms module (interface/modules/custom_modules/oe-module-faxsms) is enabled. Review web server logs for requests to the fax/sms module that invoke the disposeDocument action, especially with a file_path value containing directory-traversal sequences or referencing sites/default/sqlconf.php. Look for unexpected new or modified files owned by the web user in web-writable paths (webshells), and audit database access from unfamiliar hosts; if the credentials in sqlconf.php may have been read, treat them as compromised and rotate them.
How to Patch: Upgrade to OpenEMR 8.3.0, which fixes the missing authentication and path confinement in disposeDocument. If the upgrade must wait, disable the bundled fax/sms module (oe-module-faxsms) so the disposeDocument action is not routable, and restrict OpenEMR logins to trusted networks.
Evidence: VulnCheck KEV · VulnCheck XDB public exploit
9. Improper authentication lets remote attackers take control of Danfoss AK-SM 8xxA refrigeration controllers (CVE-2025-41450)
AUTHENTICATION BYPASS · HIGH · CVSS 8.2
Sekoia published a report today describing exploitation of unpatched Danfoss controllers, with a public exploit already available, so operators still below 4.2 with controllers reachable from the network are exposed to takeover of refrigeration systems.
Danfoss AK-SM 8xxA Series system managers before version 4.2 contain an improper authentication flaw that lets a remote attacker bypass login and gain control of the controller, which manages refrigeration and cold-chain equipment. Version 4.2 fixes the issue.
Affected: Danfoss AK-SM 8xxA Series firmware < 4.2
How to Test: Check the firmware version on each AK-SM 8xxA system manager via its web interface or local display; any version below 4.2 is affected. Review controller and perimeter logs for requests to the read_date_time action from unknown sources, which Sekoia observed in honeypot traffic as a likely prelude to exploitation, and check for unexpected logins, configuration or setpoint changes, and whether the controller's web interface is reachable from the internet.
How to Patch: Upgrade AK-SM 8xxA controllers to firmware version 4.2 or later. Where the upgrade must wait, remove the controllers from direct internet exposure and restrict access to them to trusted management networks or a VPN.
Evidence: VulnCheck KEV · VulnCheck XDB public exploit · Sekoia write-up with request-level proof of concept
10. Fireworks AI breach widens: customer secrets, datasets and model weights stolen
CONFIRMED BREACH · HIGH
Monday's updated notice widens the breach beyond the October 10 disclosure. Any API keys or tokens stored as Fireworks secrets should be treated as stolen and may be in use now.
Fireworks AI says a financially motivated group used stolen internal credentials to reach customer accounts in October. The attackers took environment-variable secrets (API keys and tokens) from evaluation jobs, plus account and billing information, datasets and incomplete model weights from a limited set of accounts. Unit 42 investigated the incident.
Affected: Fireworks AI accounts with secrets/environment variables in evaluation jobs; Fireworks AI customer datasets and fine-tuned/incomplete models
How to Test: Check whether your organization has a Fireworks AI account and whether you received a notice from Fireworks. List every secret or environment variable stored for Fireworks jobs. Review the logs of the services those keys unlock (cloud, LLM, database or SaaS) for use since October 6, 2026 from unfamiliar IPs.
How to Mitigate: Rotate or revoke all credentials stored in Fireworks, rotate Fireworks API keys, and review billing and account details for tampering.
Evidence: The Hacker News: Fireworks AI confirms wider breach · The Record: Fireworks says hackers stole data, billing info
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
