11 New KEV Entries, 2 Zero-Days and an AI-Driven Intrusion: What Defenders Need to Know

From email gateways to IRC servers, attackers found a way in almost everywhere this week. CISA added 11 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including two from Barracuda Networks and one each from Microsoft, Google, Cisco, Openwave, OpenBSD, GPUStack, IBM, SonicWall and SignalWire. The list covered the network edge, the browser, remote access, file transfer, telephony and AI infrastructure.

Beyond the KEV additions, active exploitation hit two more targets: UnrealIRCd, an open-source Internet Relay Chat server, and the WP Duplicate WordPress plugin. Neither is a household name, but both showed that attackers went after smaller, less watched software as readily as the big vendors.

Two stories stood out for how the attacks unfolded. The SSHole flaw in OpenSSH was exploited to deploy TAC Agent, a command-and-control agent, against OpenSSH servers. A Cisco BroadWorks flaw was exploited in Operation Snowball, an AI-driven campaign that breached a European telecom provider.

Key highlights of the week:

• CISA added 11 vulnerabilities to its KEV catalog.
• Attackers actively exploited UnrealIRCd, an open-source Internet Relay Chat server, and the WP Duplicate WordPress plugin.
• Attackers exploited the SSHole flaw in OpenSSH to deploy TAC Agent.
• In Operation Snowball, an autonomous AI intrusion harness exploited the Cisco BroadWorks flaw to breach a European telecom provider.

Several high-impact vulnerabilities are currently trending across the cybersecurity community, demanding immediate attention and patch prioritization. Monitoring these emerging and widely discussed threats provides valuable insights, enabling organizations to make informed security decisions and strengthen their overall defense posture.

CVE-2026-19868 - Use of Single-factor Authentication vulnerability in SonicWall SonicOS SSLVPN

A Use of Single-Factor Authentication vulnerability in SonicWall SonicOS SSLVPN allowed a user with valid credentials for an alternate authentication method to bypass SAML authentication controls, and it could also bypass SAML-enforced multi-factor authentication (MFA). The flaw affected SonicOS 7.3.3-7015 and older and 8.2.2-8015 and older, and only when SAML was enabled for SSLVPN logins. In practice, a VPN login that should have gone through the identity provider and its MFA check succeeded with a password alone, though the attacker needed working credentials first. SonicWall addressed the flaw in security advisory SNWLID-2026-0014, published on November 6, 2026, with fixes in SonicOS 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8), and no workaround existed. In the same advisory, SonicWall acknowledged that it investigated a report indicating potential exploitation and disclosed no specifics about the attack or the actor behind it. CISA added the flaw to its KEV catalog on the same day, which confirmed that attackers exploited it in the wild.

CVE-2026-20320 - Improper Restriction of XML External Entity Reference vulnerability in Cisco BroadWorks

An Improper Restriction of XML External Entity Reference vulnerability in Cisco BroadWorks, a carrier-grade communications platform for hosted voice and unified communications, allowed an unauthenticated, remote attacker to read sensitive configuration information on an affected system. The flaw existed because the Open Client Interface (OCI) XML parser allowed external entity resolution by default, so an attacker who sent a crafted XML message to the OCI-P service viewed files from the filesystem with the privileges of the Cisco BroadWorks user, and the flaw affected all releases prior to RI.2026.07. According to Malbear Labs, an autonomous AI intrusion harness exploited the flaw against a telecommunications provider’s BroadWorks XSP (Release 23.0.1.1075) through a crafted OCI request to port 2208. Through the file read, the harness recovered the system identity private key, three SSL credential sets and three additional private keys, and the system identity key allowed impersonation of the XSP in inter-component communication. Cisco addressed the flaw in release RI.2026.07, which applies to the Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform, and CISA’s addition of the flaw to its KEV catalog confirmed the active exploitation.

CVE-2026-102895 - Improper Authentication vulnerability in GPUStack

An Authentication Bypass by Spoofing vulnerability in GPUStack, an open-source GPU cluster manager for running large AI models, allowed a remote unauthenticated attacker to gain full administrative access by spoofing a loopback IP address, and the flaw affected all versions prior to v2.2.0. The flaw resided in the get_current_user function in gpustack/api/auth.py, which promoted any request that appeared to come from loopback to the built-in administrator account when force_auth_localhost was False, the default. An attacker made the request appear to come from 127.0.0.1 either through a same-host reverse proxy, which made every remote request arrive from loopback, or by sending a forged X-GPUStack-Real-IP: 127.0.0.1 header. With this access, the attacker enumerated and modified users, models, workers and configuration, created persistent admin API keys valid from any source IP, read worker credentials and cloud provider secrets, and ran code on worker hosts through the admin-only POST /v2/inference-backends/from-yaml function. According to the vendor, the flaw was exploited in the wild against a v2.1.1 deployment, where attackers created custom inference backends that ran reverse shells on target hosts. GPUStack fixed the flaw in version 2.2.0, which removed the loopback auto-admin rule and locked down IP header checks, and recommended upgrading to 2.2.2 or later to address all related authentication bypass issues. Where immediate patching was not possible, GPUStack advised setting force_auth_localhost=true and stripping X-GPUStack-Real-IP headers at the reverse proxy. CISA also placed the flaw on its KEV list, which confirmed the active exploitation.

CVE-2026-111560 - OS Command Injection vulnerability in Barracuda Networks multiple products

An OS Command Injection vulnerability in multiple Barracuda Networks products allowed an authenticated administrator to inject OS commands that executed with root privileges when a crafted timezone value was subsequently processed. The flaw affected the Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Chained with a pre-authentication authorization bypass in the Email Security Gateway, it let an attacker obtain root access to the device without prior credentials. According to Barracuda, exploitation activity affected a small number of organizations, but the advisory did not state which of the two flaws was exploited and disclosed no attack method, payloads, indicators of compromise, targeted organizations or attribution. Barracuda addressed the flaw with product-specific patches applied automatically (BNSF-40425 and BNSF-40430 for ESG, BNADC-16586 for ADC and WAF, BNMA-32468 for BMA, BNWF-60060 for WCC, BNYF-24789 for WSG), and CISA flagged it as actively exploited by adding it to the KEV catalog.

CVE-2026-111793 - Incorrect Resource Transfer Between Spheres vulnerability in Openwave Messaging Limited Webtop Media Transcoder

An Incorrect Resource Transfer Between Spheres vulnerability in Openwave Webtop Media Transcoder, the component of the Openwave Webtop webmail platform that converts email attachments for browser preview, allowed an authenticated user to process and convert unintended document types by bypassing the Webmail experience. The Media Transcoder did not enforce the file type restrictions that administrators defined, so a logged-in user who sent files to the transcoder directly converted document types that the administrator intended to block. The flaw affected all versions prior to 1.1.22.0, and according to JPCERT/CC, an attacker who uploaded a specially crafted file by following specific steps might obtain sensitive information. Following an alert from Japan Vulnerability Notes, which noted that the developer stated attacks exploiting the vulnerability had been observed, CISA added the flaw to its KEV catalog, which confirmed active exploitation. No public reporting identified who exploited the flaw, whom they targeted, how they carried out the attacks or the scale of the activity. Openwave addressed the flaw in Webtop Media Transcoder version 1.1.22.0.

CVE-2026-114713 - Improper Neutralization of Delimiters vulnerability in UnreallRCd

An Improper Neutralization of Delimiters vulnerability in UnrealIRCd, an open-source Internet Relay Chat server, allowed any user on a network with two or more linked servers to inject server-to-server commands that ran with server authority. The flaw sat in the labeled-response module, which did not escape the IRCv3 “label” message tag when echoing it into replies, so injected lines in those replies reached linked servers, which treated them as commands. Any ordinary user thereby ran operator-level commands such as KILL and GLINE, which let a stranger disconnect users, ban them from the network or take other operator actions, and the flaw affected versions 6.0.0 before 6.2.7.1. The project called it the most critical issue found in UnrealIRCd in the past 15 years, and its team found it during an internal audit with the help of AI. The project warned of active exploitation on the internet and later confirmed live attacks, though it did not disclose who carried them out, whom they targeted or the scale of the activity, and it addressed the flaw in version 6.2.7.1.

CVE-2026-116606 - Authentication Bypass Using an Alternate Path or Channel vulnerability in Barracuda Networks Email Security Gateway (ESG)

An Authentication Bypass Using an Alternate Path or Channel vulnerability in Barracuda Networks Email Security Gateway (ESG) allowed an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, which modified the appliance’s global configuration without authorization. The flaw affected versions earlier than 9.4.0.030, and exploitation required access to the administrative interface. Chained with a command injection flaw that affected six Barracuda products, it let an attacker obtain root access to the device without prior credentials. Barracuda addressed the flaw in an advisory published on November 2, 2026, with patches BNSF-40425 (firmware 9.4.017 and later) and BNSF-40430 (earlier firmware), applied automatically unless customers turned off automatic patching. On November 9, 2026, Barracuda updated the advisory to state that exploitation activity affected a small number of organizations, but it did not say which of the two flaws was exploited and disclosed no attack method, payloads, indicators of compromise, targeted organizations or attribution. CISA also placed the flaw on its KEV list, which confirmed the active exploitation.

CVE-2026-116779 - Code Injection vulnerability in SignalWire FreeSwitch

A Code Injection vulnerability in SignalWire FreeSWITCH, and open-source telecom stack, allowed an attacker to disclose configuration and credentials, take arbitrary call control and execute commands, and the flaw affected all versions prior to 1.11.3. According to the SignalWire advisory, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on + and treated the left half as a chat proto name, so an attacker who delivered a MESSAGE to a profile selected the api chat interface registered by mod_dptools and chose which FreeSWITCH API command the server ran. Commands ran with the privileges of the FreeSWITCH process, and where mod_lua was loaded, as in the stock configuration, inline Lua was reachable as a second sink. The exposure was the default posture, because any SIP profile that accepted inbound MESSAGE was affected and the inbound ACL did not cover it. The attack needed only one accepted SIP MESSAGE, which required any single registered account where MESSAGE authentication was enforced and no account at all on installations that still carried the stock default user with no password. SignalWire stated that the flaw was exploited in the wild, but the advisory did not name the attackers or give dates, scale or indicators of compromise. SignalWire addressed the flaw in FreeSWITCH 1.11.3, and its inclusion in CISA’s list of KEV confirmed the active exploitation.

CVE-2026-123158 - Unexpected Status Code or Return Value vulnerability in OpenBSD OpenSSH

An Unexpected Status Code or Return Value vulnerability in OpenBSD OpenSSH allowed an attacker to bypass authentication, and the flaw affected all versions prior to 10.6p2. It affected sshd builds that used musl libc without PAM, where musl’s crypt() returned * as an error value for any password over 256 bytes. That value matched the * stored for accounts with no password, so sshd accepted the login. An attacker needed only one connection with a 257 to 1024 byte password, an SSH-eligible account with no password, another local account with a $5$ or $6$ hash, and PasswordAuthentication yes. On Alpine Linux tiny-cloud images, the bypass reached the alpine account, which gave root through passwordless doas. A proof of concept was available, and attackers exploited the flaw within hours of disclosure. According to GreyNoise, they ran reconnaissance, queried cloud metadata services, tried to read password hashes and root SSH keys, and modified authorized_keys for persistence, while an actor dubbed GT10 deployed the TAC Agent C2 and watchTowr observed botnet and cryptominer activity. OpenSSH addressed the flaw in version 10.6p2, released on November 5, 2026, and Alpine Linux published fixed packages for every branch the same day, so CISA’s addition of the flaw to its KEV list confirmed the active exploitation.

CVE-2026-123218 - Incorrect Authorization vulnerability in IBM Aspera Faspex

An Incorrect Authorization vulnerability in IBM Aspera Faspex, a managed file-transfer application, allowed an authenticated user to craft a specific message that bypassed authorization and escalated privileges, and the flaw affected versions 5.0.0 through 5.0.19. A successful attacker gained full administrative privileges within Faspex. IBM addressed the flaw in Aspera Faspex 5.0.19 Fix Pack 1 (5.0.19 PL1) in a security bulletin published on November 7, 2026, and the bulletin did not mention active exploitation. Two days later, on November 9, 2026, CISA added the flaw to its KEV catalog, which confirmed that attackers exploited it in the wild. No public reporting identified who exploited the flaw, whom they targeted, how they exploited it or the scale of the activity. IBM did not disclose the affected endpoint, the message fields or the exact request needed to trigger the flaw, and no source established that the flaw gave command execution or root access on the underlying host.

CVE-2026-123751 - Unauthenticated Arbitrary File Upload vulnerability in the WP Duplicate WordPress plugin

An Unauthenticated Arbitrary File Upload vulnerability in the WP Duplicate WordPress plugin (formerly LocalSync), which clones and migrates sites between servers, allowed remote attackers to write arbitrary files to the server and achieve remote code execution. The plugin did not properly verify a request authentication value and did not validate the path or type of uploaded files, so no login was required and a single upload handed over the server. The flaw affected all versions up to and including 1.1.11, and each exposed site was at full risk, though the vendor lists only over 200 active installations. WPScan did not share attack volumes, dates or indicators of compromise, and the unauthenticated upload path made the flaw an easy target for automated scanners and active exploitation. WPScan lists no known fix, so no patch is available, and site owners should deactivate and delete the plugin until a patched version appears.

CVE-2026-124194 - Missing User Interaction for Potentially Unsafe Action vulnerability in Microsoft Office

A Missing User Interaction for Potentially Unsafe Action vulnerability in Microsoft Office Outlook allowed an unauthenticated attacker to perform spoofing over a network. The attacker sent a specially crafted message file and convinced a user to open it in an affected version of Outlook, which caused Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning. The flaw was an NTLM credential disclosure: Windows automatically attempted to authenticate to the remote share, which exposed the user’s NTLMv2 hash. The attacker captured the hash, potentially cracked it offline, and used the recovered credentials to impersonate the user and gain unauthorized access to corporate accounts. Exploitation required network connectivity and user interaction, and the affected versions were Microsoft 365 Apps for Enterprise 16.0.1, Office LTSC 2021 16.0.1 to before 16.0.14334.21048, and Office LTSC 2024 16.0.0 to before 16.0.17932.21140. The flaw was actively exploited as a zero-day, Microsoft addressed it in its November 2026 Patch Tuesday security updates, and CISA added it to the KEV catalog.

CVE-2026-125350 - Use-After-Free vulnerability in Google Chromium

A Use-After-Free vulnerability in XML component of Google Chromium allowed a remote attacker to execute arbitrary code inside the sandbox through a specially crafted webpage, and the flaw affected all versions prior to 157.0.8103.50. The weakness arose when the browser’s XML parser processed data, deleted an object from memory, and failed to clear the pointer that referenced it, so an attacker manipulated the memory layout when the browser later used the freed memory. According to Google, the flaw was actively exploited in the wild as a zero-day, but Google did not reveal how attackers abused it, who was behind the attacks, or any other details about the incidents. Google restricted access to bug details until a majority of users received the fix. Google fixed the flaw in Chrome 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux, with other Chromium-based browsers such as Edge, Brave, Opera and Vivaldi expected to follow, and the flaw’s inclusion in CISA’s list of known exploited vulnerabilities reinforced the urgency of updating.

Cytellite telemetry captured active exploit attempts and mass scanning campaigns against exposed services globally. The data highlights which vulnerabilities are under attack and provides source IPs and payloads to authorized teams for detailed threat analysis and validation.

Active malware campaigns exploited specific vulnerabilities to deliver payloads and carry out post-exploitation actions. Each targeted vulnerability is proactively monitored, manually analysed, and mapped to MITRE ATT&CK tactics and techniques. Insights are derived from the LOVI vulnerability intelligence platform, which aggregates and curates data from multiple sources, OSINT groups, blogs, and data leak sites.

SSHole vulnerability exploited to deploy TAC Agent C2 against OpenSSH Servers

According to GreyNoise, attackers exploited SSHole (CVE-2026-123158) in the wild, and the first exploitation attempt against its honeypot network occurred on November 7, 2026, at 12:46 a.m. UTC. The attackers bypassed password authentication on OpenSSH servers and then ran post-exploitation activity that GreyNoise confirmed from six source IP addresses, representing 18 distinct attack chains. The chains began with reconnaissance and queries to cloud metadata services, after which the attackers tried to read password hashes and root SSH keys and edited the SSH authorized_keys file to establish persistent access. In at least one case, an unknown threat actor dubbed GT10 deployed TAC Agent, a Python-based command-and-control (C2) agent that supported shell command execution, system reconnaissance, directory enumeration, file transfer and self-updating. Threat intelligence firm watchTowr separately observed the flaw being weaponized in the wild for botnet and cryptocurrency miner activity.

Cisco BroadWorks Flaw Exploited in Operation Snowball to Breach a European Telecom Provider

According to Malbear Labs, an autonomous AI intrusion harness, built around a jailbroken DeepSeek Flash agent and directed by a Chinese-speaking operator, exploited CVE-2026-20320 as the entry point into a European telecommunications provider’s network. The campaign ran for more than two weeks and also reached thirteen organizations hosted on the provider’s infrastructure. CVE-2026-20320 is an unauthenticated XML external entity (XXE) flaw in the OCI XML parser of the Cisco BroadWorks eXtended Services Platform (XSP) Release 23.0.1.1075. The agent sent a crafted OCI request to port 2208, which made the parser read arbitrary files from the server filesystem without prior authentication. From the XSP host, it recovered the system identity private key, three SSL credential sets and three additional private keys with matching certificates. The system identity key authenticates BroadWorks components to each other, so it allowed impersonation of the XSP in inter-component communication. The agent also found the BroadWorks Provisioning Server exposed with an unauthenticated directory listing, and that server holds subscriber configuration for every platform user. It then moved laterally, bypassing or replacing tools that endpoint controls blocked, and kept access through a Cloudflare-fronted Sliver C2. Malbear Labs described the operator’s role as limited to setting goals and checking results, and it did not attribute the activity to a named threat actor.

Open-Source Software (OSS) vulnerabilities are security weaknesses discovered in publicly available codebases that can be exploited across widely used libraries, frameworks, and tools, often impacting thousands of downstream applications.

PRE-NVD vulnerabilities refer to security flaws that are discovered, discussed, or even exploited in the wild before their official inclusion in the National Vulnerability Database (NVD). These early-stage vulnerabilities often emerge through threat actor chatter, exploit proof-of-concepts, and technical disclosures shared across social media platforms and underground forums, signaling potential exploitation risks before public awareness.

This week’s exploitation spanned the network edge, remote access, file transfer, the browser, open-source chat servers and WordPress plugins. It showed that attackers target whatever software is exposed and unpatched, from major enterprise products to small plugins. Fixing authentication and authorization gaps quickly, restricting administrative interfaces and hunting for signs of earlier compromise remain the strongest defenses. Loginsoft Vulnerability Intelligence (LOVI) tracks exploited vulnerabilities like these and delivers structured, actionable intelligence that helps security teams prioritize and respond faster. Follow LOVI to stay ahead of the next threat before it reaches your environment.

FAQs

Q1. What is SSHole, and are my servers affected?

SSHole is an OpenSSH flaw that lets an attacker bypass password authentication with one very long password. It affects sshd builds that use musl libc without PAM, such as the default Alpine Linux package, when password authentication is on and an account with no password exists. Systems with PasswordAuthentication no, or builds that use PAM, are not exposed, and the fix is OpenSSH 10.6p2 or your distribution’s patched package.

Q2. What was Operation Snowball?

Operation Snowball was an intrusion campaign in which an autonomous AI harness, built on a jailbroken DeepSeek model, attacked a European telecom provider and thirteen organizations hosted on its infrastructure. It entered through a Cisco BroadWorks flaw, and the operator mostly set goals and reviewed results while the AI handled the attack steps. Defenders cannot rely on spotting a human operator, so they must watch for the agent’s activity.

Q3. What should organizations do when a vulnerability has no patch available?

When no patch exists, organizations should reduce exposure by restricting access to affected management interfaces through trusted IP allowlists or VPN connections. Security teams should actively hunt for signs of compromise, such as unexpected files, suspicious processes or unusual outbound traffic. Once the vendor releases a fix, it should be applied immediately and its effectiveness verified.

Q4. How does LOVI help organizations manage vulnerabilities effectively?

Loginsoft Vulnerability Intelligence empowers you to efficiently prioritize and respond to potential vulnerabilities by focusing on those actively exploited in the wild. LOVI correlates vulnerability data with real-world threat activity to reduce noise and improve decision-making. This approach enables faster remediation and stronger security posture.

Q5. What is Cytellite?

Cytellite is a Loginsoft security intelligence platform that provides real-time visibility into emerging threats through a global sensor network. It delivers actionable IP intelligence to help organizations detect, analyze, and respond to attacks quickly. By correlating threat data with live activity, Cytellite strengthens resilience across dynamic threat landscapes.