Weekly Exploit Roundup

Generated 2026-11-10T08:00:11.873440+00:00 (UTC)

1. Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
   Source: The Hacker News | Published: 2026-11-10T06:52:54+00:00 | Score: 27.567
   Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild.

   The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: N/A), has been described as a use-after-free bug in the XML component.

   Use-after-free bugs typically occur when a program attempts to access a memory location after

2. The Race Against the 3-Day Clock: How Rapid7 Helps Meet BOD 26-04 Compliance
   Source: Rapid7 Cybersecurity Blog | Published: 2026-11-04T14:01:55+00:00 | Score: 25.694
   Introduction to BOD 26-04 On June 10, 2026, CISA issued Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk." Strip away the regulatory language and it reads like a single operational fact: for a vulnerability that is actively exploited, publicly reachable, and grants an attacker full control, you now have three calendar days to remediate it — and you must run a forensic investigation in parallel to determine whether you've already been breached. The 2026 Verizon Data Breach Investigations Report puts the industry's median full-remediation time at 43 days, adding that only 26% of Known Exploited Vulnerabilities were fully remediated in 2025, down from 38% the year before. That's a 43-day reality vs. a 3-day mandate; a gap you don't exactly just close by hiring more workers. This blog aims to break down what BOD 26-04 actually requires, mapping each point to the Rapid7 capability that helps to make compliance operationally achievable for all. What did CISA
3. CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation
   Source: The Hacker News | Published: 2026-11-09T06:05:24+00:00 | Score: 17.829
   The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been exploited in real-world attacks.

   The vulnerability, tracked as CVE-2026-19868 (CVSS score: 7.1 / 7.5), has been described as an authentication reinforcement

4. CISA Adds Four Known Exploited Vulnerabilities to Catalog
   Source: Alerts | Published: 2026-11-09T12:00:00+00:00 | Score: 17.405
   CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-102895 GPUStack Improper Authentication Vulnerability CVE-2026-116779 SignalWire FreeSwitch Code Injection Vulnerability CVE-2026-123158 OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability CVE-2026-123218 IBM Aspera Faspex Incorrect Authorization Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KE
5. CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
   Source: The Hacker News | Published: 2026-11-10T06:31:42+00:00 | Score: 15.556
   The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

   The vulnerabilities are listed below –

   CVE-2026-123218 (CVSS score: 9.8) – An incorrect authorization vulnerability

6. CISA Adds One Known Exploited Vulnerability to Catalog
   Source: Alerts | Published: 2026-11-06T12:00:00+00:00 | Score: 15.262
   CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-19868 SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for wh
7. Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
   Source: The Hacker News | Published: 2026-11-05T07:06:33+00:00 | Score: 14.502
   Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found.

   The exploit lets anyone who can reach a switch's web management interface run commands on it without logging in. Zyxel has released new firmware for 10 GS1900 models that closes the hole.

   The earlier fix is the 2.90

8. Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It
   Source: The Hacker News | Published: 2026-11-06T12:06:43+00:00 | Score: 14.365
   A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates.

   The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today.

   The flaw is an out-of-bounds read that could let an attacker run code over a network. Microsoft rates

9. Hackers exploit SSHole OpenSSH flaw to breach Linux systems
   Source: BleepingComputer | Published: 2026-11-09T16:04:57+00:00 | Score: 14.226
   Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access. […]
10. N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits
    Source: The Hacker News | Published: 2026-11-10T06:44:36+00:00 | Score: 14.063
    N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell.

    "As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the

End of report.