Authentication-Bypass
SCKit: Blank RMM+ Access Key Lets Attackers Push Rogue ScreenConnect Clients to Nearly 500 MSP-Managed Hosts
A third-party ScreenConnect extension, RMM+ 1.0.31-1.0.32, accepted an empty access key. Attackers used it to run SCKit through Run Command on 288 hosts in 90 minutes, then hit 205 more on November 13 from new infrastructure.
Barracuda ESG CVE-2026-116606 + CVE-2026-111560: Pre-Auth Root Chain Now Exploited, CISA KEV Deadline Today
Barracuda confirms exploitation of an ESG authorization bypass chained with a root command injection; CISA added both to KEV with a November 13 federal deadline.
N-able N-central Under Siege: 4EverAble2Shell and Agent2Shell Bypass Hotfix 2 Days After the Able2Shell Zero-Day Dump
A researcher's Able2Shell dump of 33 alleged N-central zero-days forced N-able to take its hosted RMM cloud offline; new 4EverAble2Shell (root RCE) and Agent2Shell (SYSTEM on managed Windows endpoints) chains reportedly defeat the November 10 Hotfix 2.
Xen Orchestra VSA-2026-062: Empty-Object Cookie Auth Bypass Exploited to Take Over XCP-ng Pools
Vates warns that a critical Xen Orchestra auth bypass, triggered by a single crafted cookie, is being exploited to gain admin access and root on managed XCP-ng hosts.
Checked Is Not Used: Four Bugs in Two Weeks Where the Verified Thing Wasn't the Thing That Ran
APT, LXD, WordPress and SonicWall all shipped fixes this month for the same design error: a security check performed on one object or path, and an action taken on another. Here is how to find that gap in your own estate.
CVE-2026-19868: SonicWall SonicOS SSL-VPN SAML Bypass Exploited in the Wild, CISA Deadline November 20
SonicWall patched an actively exploited SonicOS SSL-VPN flaw that lets attackers with valid credentials sidestep SAML-enforced MFA; CISA added it to KEV on November 6.
OpenSSH 'sshole' CVE-2026-123158: A Long Password Walks Past Authentication on Alpine and musl Systems
OpenSSH 10.6p2 ships an emergency workaround for a password-authentication bypass on musl-based, non-PAM builds such as Alpine Linux; a 257-byte-plus password can log in to accounts that have no password set.
Siemens SIMATIC IoT2050 CVE-2026-58115: Unauthenticated Node-RED Editor Exploited to Drop Linux Bots and Persistent Webshells
VulnCheck reports in-the-wild exploitation of CVSS 10.0 CVE-2026-58115, where Siemens SIMATIC IoT2050 Advanced gateways expose an unauthenticated Node-RED editor, since October 30.
Canonical LXD CVE-2026-112816: mTLS Certificate-Chain Flaw Lets Attackers Impersonate Any Trusted Client (CVSS 4.0 10.0)
Canonical patched a CVSS 4.0 10.0 improper certificate validation bug in the LXD HTTPS listener that lets an attacker authenticate as any trusted client via a crafted certificate chain; MicroCloud is affected too.
CVE-2026-118539: Drupal Commerce Core Access Bypass Exploited in the Wild Against Online Stores
Drupal rates SA-CONTRIB-2026-254 'highly critical' and confirms active exploitation of an unauthenticated access bypass in Commerce Core (CVE-2026-118539); fixes are in 3.3.13 and 8.x-2.41.
Nextcloud Built-in CODE Server CVE-2026-110447: Unauthenticated Command Injection Exploited for Webshells Since September
A critical OS command injection in the Collabora-based built-in CODE server app for Nextcloud (richdocumentscode) has been exploited in the wild since about September 10; the CVE was published October 14, over a month after the patch.
SonicWall SMA1000 CVE-2026-102255: CVSS 10.0 Pre-Auth SSRF Probed Within Two Days of Patch
SonicWall's SNWLID-2026-0017 patches CVE-2026-102255, a maximum-severity pre-auth SSRF in SMA1000 that attackers reach an internal CouchDB through; exploitation attempts began two days after the fix.
Ivanti Connect Secure CVE-2026-104935: Auth-Bypass Zero-Day Chained to Root by UTA0576, Added to CISA KEV
Ivanti patched an authentication-bypass-by-spoofing zero-day in Connect Secure that Volexity saw chained with a still-unpatched privilege escalation for root access. CISA added it to KEV with an October 16 deadline.
CVE-2026-61500: Rejetto HFS Predictable Session Key Gives Unauthenticated Admin and RCE, Probed Within a Day
Rejetto HFS 3.x signs sessions with a key derived from Math.random() and leaks its outputs at login, letting unauthenticated attackers forge admin sessions and run server-side JavaScript; scanning from China began October 1.
Atlassian CVE-2026-21589: Unauthenticated File Read Hits Eight Data Center Products
Atlassian's emergency advisory for CVE-2026-21589, a CVSS 9.3 pre-auth arbitrary file read affecting Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye Data Center.
CVE-2026-88779: NetScaler SAML Memory Overflow Zero-Day Crashes Auth, Hits Freshly Patched Appliances
Citrix confirms exploitation of a NetScaler ADC/Gateway SAML memory overflow (CVSS 8.7) that crashes authentication services; honeypot data suggests appliances patched for the previous batch are also being hit.
AhsayCBS CVE-2026-105134: Unauthenticated OS Command Injection (CVSS 10) in Backup Server
A CVSS 10 OS command injection in the AhsayCBS Replication Receiver endpoint allows unauthenticated remote code execution on backup servers up to 10.3.2. Upgrade to 10.3.4.
Two Parsers, One URL: The Interpretation-Conflict Bug Is Eating Authentication in 2026
Cisco SD-WAN, UniFi OS, Starlette and Clerk all fell to the same flaw this year: the component that decides who gets in and the component that decides where the request goes read the URL differently. Here is why it keeps happening and how to stop shipping it.
Zammad CVE-2026-102489 and CVE-2026-102490: Session Hijack to Root Chain Exploited in DIVD Breach
Two Zammad zero-days chain a session hijack into RCE and local root; DIVD says an autonomous AI agent used them to breach its network, CISA added both to KEV, and the root flaw reportedly has no patch.
Dell Container Storage Modules: Two CVSS 10 Missing-Authentication Flaws Expose Kubernetes Storage Admin Credentials
Dell's DSA-2026-448 fixes two maximum-severity missing-authentication bugs in the CSM Authorization module that let unauthenticated attackers take over storage arrays behind Kubernetes clusters.