As November Began: KEV Additions, Active Exploitation and Evolving Threat Activity

October ended the way it ran, and November opened without a reset. The week bridging the two months brought a steady stream of exploitation across enterprise, industrial and AI infrastructure, as threat actors chained edge appliance flaws, abused authentication gaps in management platforms, and paired known bugs with custom malware to reach targets from Magento storefronts to Ukrainian government networks.  

CISA expanded its Known Exploited Vulnerabilities catalog with six additions. Two came from Ivanti Connect Secure, which UTA0576 chained with a third Ivanti flaw to gain root access on fully patched VPN appliances. The remaining entries covered a GitLab CI/CD remote code execution flaw, a Cisco ASA and FTD SSL VPN bug that attackers used to crash firewalls, an Apple pointer authentication bypass tied to APT29 watering hole attacks, and a WordPress Core race condition that let unauthenticated attackers execute code during the upgrade window.

Active exploitation also surfaced well beyond the KEV catalog. Attackers abused a missing authentication flaw in Siemens SIMATIC IoT2050 to deploy Linux bots through malicious Node-RED flows, and exploited an authentication bypass in the CryptoPayment Gateway WordPress plugin to delete files and pull wallet credentials in cleartext. Loopback spoofing in GPUStack handed intruders full admin control and reverse shells on AI GPU clusters, while a Zyxel GS1900 zero-day slipped past an earlier patch to compromise network switches. In Puppet Enterprise, an impersonation flaw let one node pose as another to reach remote command execution on managed systems. Public exploit details accelerated several of these attacks.

Malware campaigns rounded out the week. A likely Chinese-speaking operator exploited StyleSmuggler, a Magento template-processing flaw, to install the Go-based PSK Agent RAT and PHP webshells on online stores. The China-aligned SlippyNunchucks group hijacked DNS requests from the Sogou Input Method’s insecure HTTP channel to sideload the DarkVigil backdoor onto Chinese-speaking users across Asia. Meanwhile, the Russia-aligned Gorbag group abused a WinRAR path traversal flaw to plant BeautyStealer through weaponized RAR archives, harvesting credentials and documents from Ukrainian law enforcement, local administrations and defense entities.

Key highlights of the week:

• CISA added six vulnerabilities to its KEV catalog, two of them from Ivanti Connect Secure, chained by UTA0576
• GitLab, Cisco ASA/FTD, Apple and WordPress Core each contributed one actively exploited flaw to the KEV catalog
• Active exploitation hit Siemens SIMATIC IoT2050, GPUStack, Zyxel GS1900, Puppet Enterprise and the CryptoPayment Gateway plugin  
• A Zyxel GS1900 zero-day bypassed an earlier patch, leaving switches that admins believed were fixed still exposed
• GPUStack and Siemens IoT2050 attacks showed AI clusters and industrial gateways becoming direct targets
• A likely Chinese-speaking operator exploited StyleSmuggler to deploy the PSK Agent RAT against Magento stores
• SlippyNunchucks hijacked Sogou Input Method DNS requests to deliver the DarkVigil backdoor across Asia
• Gorbag abused a WinRAR flaw to deploy BeautyStealer against Ukrainian government and defense entities

Several high-impact vulnerabilities are currently trending across the cybersecurity community, demanding immediate attention and patch prioritization. Monitoring these emerging and widely discussed threats provides valuable insights, enabling organizations to make informed security decisions and strengthen their overall defense posture.

CVE-2026-58115 - Missing Authentication for Critical Function vulnerability in Siemens SIMATIC IoT2050

A Missing Authentication for Critical Function vulnerability in Siemens SIMATIC IoT2050 advanced devices allowed an unauthenticated remote attacker to execute arbitrary code, affecting versions prior to V4.3.4.1. The flaw let attackers send a single POST request to the Node-RED /flows endpoint that deployed an inject node wired to an exec node, which piped a base64-encoded command into sh to evade filters and downloaded a Linux bot named bot-linux-amd64 into the RAM-backed /dev/shm/.b path before launching it with setsid. A public proof-of-concept was available, and VulnCheck caught active exploitation on October 30, 2026, three days after publishing its detection, from 4.201.105(.)116, a Microsoft-network address geolocating to Brazil that also logged 125 hits against eight CVEs across Apache Solr, Camunda, Gitea, MLflow, Traefik and Joomla, consistent with opportunistic mass scanning. Later activity from the same source fetched staged shell scripts from the payload server 85.215.73(.)250, dropped a file disguised as /tmp/.kworker, and deployed HTTP endpoints wired to exec nodes as a persistent command channel that survived reboots. VulnCheck added the flaw to its KEV catalog, though CISA had not listed it at the time of reporting. Siemens fixed the vulnerability in version V4.3.4.1.

CVE-2026-76418 - Unchecked Return Value to NULL Pointer Dereference vulnerability in Cisco Secure Firewall ASA Software and Cisco Secure FTD Software

An Unchecked Return Value to NULL Pointer Dereference vulnerability in Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software allowed an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The flaw resided in the Remote Access SSL VPN service and stemmed from logic errors that occurred when secondary authentication was configured on a tunnel group, so an attacker could trigger the reload by sending a crafted request while connecting to the SSL remote access VPN. Affected devices ran a vulnerable release of ASA versions 9.16 and earlier through 9.24 or FTD versions 7.0 and earlier through 10.1, exposed a reachable SSL remote access VPN login service, and had secondary authentication configured within the tunnel group scope, including the default DefaultWEBVPNGroup. Cisco became aware of active exploitation in October 2026 but did not disclose when the attacks began, who was behind them, or how widespread they were. Cisco addressed the vulnerability in ASA Software 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and 9.24.1.27 or 9.24.10.1, and in FTD Software 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1 and later, and given the confirmed in-the-wild abuse, CISA included the flaw in its KEV catalog.

CVE-2026-81648 - Authentication Bypass vulnerability in the CryptoPayment Gateway WordPress plugin

An Authentication Bypass vulnerability in the CryptoPayment Gateway WordPress plugin allowed unauthenticated attackers to perform administrative operations, including deleting files and accessing stored credentials, affecting versions 1.2.1 through 1.2.2. The flaw stemmed from an AJAX endpoint registered under the wp_ajax_nopriv_ hook that omitted both the current_user_can() capability check and the check_ajax_referer() nonce verification, so a single crafted HTTP POST request to wp-admin/admin-ajax.php executed the privileged logic with no authentication or user interaction. Attackers could delete arbitrary files on the server, overwrite payment gateway settings to redirect payments to attacker-controlled destinations, and retrieve wallet credentials returned in cleartext because the plugin did not encrypt them at rest. A public proof-of-concept exploit was available, and Defused Cyber observed in-the-wild exploitation attempts originating from infrastructure marketed as “Anonymous KYC-Free VPS Hosting.” No patch was available, and WordPress closed the plugin on its Plugin Directory on August 28, 2026, citing an unspecified security issue.

CVE-2026-97229 - Integer Overflow or Wraparound vulnerability in GitLab Community Edition and Enterprise Edition

An Integer Overflow or Wraparound vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, affecting versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The flaw resided in the CI/CD Regular Expression Compiler, which failed to validate regular expressions sufficiently under certain conditions, so a malicious expression embedded in a CI/CD configuration triggered an integer overflow, caused the compiler to mishandle the input, and opened a path to code execution without valid credentials or any victim interaction. A compromised instance exposed the resources reachable by the GitLab service, including source code, repository data, CI/CD variables and deployment credentials, and the compromise could extend into connected build systems and deployment environments. GitLab fixed the flaw in versions 19.4.2, 19.3.5 and 19.2.8, and CISA listed it in the KEV catalog after confirming exploitation.

CVE-2026-102895 - Authentication Bypass by Spoofing vulnerability in GPUStack

An Authentication Bypass by Spoofing vulnerability rooted in an origin validation error and IP spoofing in the GPUStack login code, allowed remote unauthenticated attackers to take full administrative control of GPU cluster servers in all versions before 2.2.0. Because the force_auth_localhost setting defaulted to false, the server granted built-in admin rights to any request from a loopback address, which attackers reached either through a same-host reverse proxy that made every outside request appear as 127.0.0.1 or by sending a spoofed X-GPUStack-Real-IP: 127.0.0.1 header. Once inside, attackers could steal cloud keys, mint admin tokens and push rogue YAML configurations to run code on worker nodes. The flaw came under active exploitation in the wild against a v2.1.1 deployment, where intruders used custom backends to run reverse shells on target hosts, as reported by researcher Javier Sixto of ulex.fr. GPUStack removed the loopback auto-admin rule and locked down IP header checks in version 2.2.0, and recommended upgrading to version 2.2.2 or later, setting force_auth_localhost=true and stripping X-GPUStack-Real-IP headers at the reverse proxy where immediate patching was not possible.

CVE-2026-107441 - Out-of-Bounds Write vulnerability in Zyxel GS1900  firmware

An Out-of-Bounds Write vulnerability in the dispatcher.cgi component of the Zyxel GS1900 web interface allowed an unauthenticated attacker on the adjacent network to execute OS commands. It affected firmware through 2.90(xxxx.2)C0 on the GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48 and GS1900-48HPv2 models, including the builds that carried the June fix for the related CVE-2026-7273. The program copied each HTTP POST parameter into a fixed global buffer without checking parameter size or count, so a crafted request corrupted memory and redirected execution to run commands. Threat actors exploited the flaw in the wild as a zero-day in attacks that GreyNoise linked to data theft from 996 GS1900 switches across 48 countries starting around August 17, which were first attributed to CVE-2026-7273. Binarly researchers Fernando Mercês and Yegor Vasilenko uncovered the flaw through an LLM-generated “Zyxel GS1900 Pre-Auth RCE” exploit left on a JITTERLY backdoor command server and planned to release a minimized proof-of-concept later. Zyxel fixed the vulnerability in firmware released on October 22, which limited each copied field to 511 bytes and checked the parameter count before copying.

CVE-2026-111357 - Missing Authentication for Critical Function vulnerability in Ivanti Connect Secure

A Missing Authentication for Critical Function vulnerability in Ivanti Connect Secure allowed a local authenticated attacker to escalate their privileges, affecting versions 25.1.1.2 and prior and 22.8R2.5 and prior. The flaw was exploited as part of a chain with CVE-2026-104935 and CVE-2026-118527 by a previously unknown threat actor tracked as UTA0576, which first gained code execution as the cgi-server user and then targeted dsinvoked, a privileged background service that ran maintenance tasks as root. UTA0576 patched the cgi-server process’s in-memory copy of the libdsplibs.so library, which allowed it to modify the DSCache configuration store, redirect an existing maintenance task to launch the Perl interpreter, and have dsinvoked execute a malicious Perl script as root. After achieving root, the attacker restored the DSCache entry and the library to their original states and deleted related log entries, so Ivanti’s Integrity Checker Tool did not flag the activity. Ivanti addressed the flaw in versions 25.1.1.3 and 22.8R2.6, with the fix for CVE-2026-111357 shipping on October 29, 2026, and CISA has since listed it in the KEV catalog.

CVE-2026-115732 – Improper Authorization vulnerability in Puppet Enterprise

An Improper Authorization vulnerability in the trapperkeeper-authorization library used by OpenVox and Puppet servers allowed one node to impersonate another. It affected OpenVox Server 9.1.0 and below and 8.17.0 and below, OpenVox Agent 9.2.0 and below and 8.31.1 and below, Puppet Enterprise before 2023.8.13, 2025.12.1 and 2026.0.1, and Open Source Puppet. The library treated plain hostname rules as wildcards, so a certificate named evil.target.example.com could pass as target.example.com, and in Puppet Enterprise this led to remote command execution on managed nodes. Disclosed on November 3, 2026, the flaw had public exploit details and came under active exploitation in the wild. Vox Pupuli and Perforce fixed the vulnerability in openvox-agent 8.32.0 and 9.3.0, openvox-server 8.18.0 and 9.2.0, openvoxdb 8.18.0 and 9.2.0, and Puppet Enterprise 2023.8.13, 2025.12.1 and 2026.0.1.

CVE-2026-118527 - Generation of Predictable Numbers or Identifiers Vulnerability in Ivanti Connect Secure

A Generation of Predictable Numbers or Identifiers vulnerability (CVE-2026-118527) in Ivanti Connect Secure allowed a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk, affecting versions 25.1.1.2 and prior and 22.8R2.5 and prior. The flaw was exploited as part of a chain with CVE-2026-104935 and CVE-2026-111357 by a previously unknown threat actor tracked as UTA0576, and it involved predictable filenames during file processing that let the attacker place files at known locations, feeding into the exploit chain. The chain gave UTA0576 root access, which it used for credential theft, data exfiltration, log tampering, and network reconnaissance, including Active Directory queries, LDAP traffic capture, and password-spraying attacks. Because the privilege escalation stage patched library code only in memory and restored the configuration store afterward, Ivanti’s Integrity Checker Tool did not flag the activity, and forensic investigation was required to find evidence of exploitation. Ivanti fixed the vulnerability in versions 25.1.1.3 and 22.8R2.6, and CISA added it to the KEV catalog.

CVE-2026-119977 - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in WordPress Core

A Time-of-check Time-of-use (TOCTOU) race condition vulnerability in WordPress Core allowed unauthenticated attackers to execute code on the server during the upgrade window, affecting versions 4.7 through 7.1.3. The flaw stemmed from predictable, web-accessible staging paths: during a full-package Core update, WordPress unpacked the new installation files, including the installer, into a predictable directory beneath wp-content/upgrade, which was often reachable from the public web. An attacker who requested the installer’s setup-config.php file at precisely the right moment could interact with the staged copy and progress to PHP code execution, though the attack complexity was high because the staging directory remained available for only seconds before cleanup. Wordfence confirmed active exploitation, recording more than 18,500 malicious requests against staged installer paths within 21 hours, as attackers used automated scripts that repeatedly polled sites during upgrade windows. WordPress 7.1.4 was released to resolve the vulnerability, and CISA added it to the KEV catalog.

CVE-2024-27834 - Improper Authentication vulnerability in Apple Multiple Products

An Improper Authentication vulnerability in multiple Apple products, including iOS, iPadOS, macOS, Safari, tvOS and watchOS, allowed an attacker with arbitrary read and write capability to bypass pointer authentication. The development followed a large-scale watering hole attack that targeted iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals, which Sekoia attributed with moderate-to-high confidence to APT29 (also known as Midnight Blizzard), a Russian threat group recently linked to hotel WiFi attacks. According to Sekoia, the threat actors exploited the flaw, among others, to extract cookies, messaging app databases and credentials from victims’ devices. Apple had patched the vulnerability back in 2024, yet the flaw remained a viable attack path against unpatched devices. Despite the long-available fix, CISA has now added it to the KEV catalog.

Cytellite telemetry captured active exploit attempts and mass scanning campaigns against exposed services globally. The data highlights which vulnerabilities are under attack and provides source IPs and payloads to authorized teams for detailed threat analysis and validation.

Active malware campaigns exploited specific vulnerabilities to deliver payloads and carry out post-exploitation actions. Each targeted vulnerability is proactively monitored, manually analysed, and mapped to MITRE ATT&CK tactics and techniques. Insights are derived from the LOVI vulnerability intelligence platform, which aggregates and curates data from multiple sources, OSINT groups, blogs, and data leak sites.

StyleSmuggler (CVE-2026-75650) Exploited to Deploy PSK Agent RAT Against Magento Stores

According to Imperva, a coordinated campaign exploited StyleSmuggler in Magento and Adobe Commerce stores across Western Europe, North America, and the Asia-Pacific region between September 9 and September 13, 2026. The attackers placed PHP code in the query string of the /paypal/transparent/response/ endpoint, then used a second request to /graphql to load the poisoned report file and execute the code. The injected PHP retrieved psk_agent.sh, a shell-script dropper with a 0% VirusTotal detection rate, which installed PSK Agent, a Go-based remote access trojan that executed commands, proxied traffic through SOCKS5, and maintained persistence. The operators also confirmed successful exploitation through DNS beacons and, in some cases, deployed a PHP webshell named zer4.php as a second access path. Imperva did not attribute the activity to a named threat actor, but assessed with moderate confidence that the operator was likely Chinese-speaking, and it recommended applying Adobe’s VULN-39341 hotfix and treating affected systems as fully compromised.

SlippyNunchucks Hijacks Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor

According to ESET, the China-aligned threat actor SlippyNunchucks carried out a DNS hijacking operation that abused the insecure HTTP communications of Sogou Input Method for Windows (CVE-2026-120422) to deploy the DarkVigil (FDMTP) implant. Beginning on July 1, 2026, SGTool.exe requested its brand promotion configuration over HTTP from config.pinyin.sogou[.]com, and the attacker resolved that domain to staging servers behind sogou-cdn[.]com, which returned a malicious configuration. The configuration instructed SGTool.exe to download a legitimate Adobe binary, renamed biz_helper.exe and saved as SogouComMgr.exe, along with a malicious libcef.dll, so that DLL side-loading executed DarkVigil through Sogou’s own component workflow. The operation targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka, and the point where the DNS manipulation occurred was never identified. Tencent fixed the vulnerability in version 16.10 by migrating the affected requests to HTTPS and enabling certificate pinning.

Gorbag Exploits WinRAR Flaw to Deploy BeautyStealer Against Ukrainian Organizations

According to ESET, the Russia-aligned threat actor Gorbag exploited CVE-2025-8088, a WinRAR path traversal vulnerability, in early 2026 to target Ukrainian organizations, including law enforcement and justice entities, local administrations near the front line, and the defense sector. The group changed its compromise chain from spear phishing emails with macro-enabled Excel attachments to weaponized RAR archives that abused alternate data streams to extract files outside the user-selected directory. When a victim opened the archive on a vulnerable system, it displayed a decoy PDF while dropping a LNK file into the Windows Startup folder, along with an encrypted payload and a PowerShell loader in %ProgramData%. The LNK file provided persistence by triggering the loader on later startups, which led to the deployment of the BeautyStealer infostealer that harvested browser credentials, VPN configurations, and selected documents before it removed itself. ESET assessed that Gorbag focused on one-time information harvesting and may have acted as an initial access broker for other Russia-aligned threat actors.

Open-Source Software (OSS) vulnerabilities are security weaknesses discovered in publicly available codebases that can be exploited across widely used libraries, frameworks, and tools, often impacting thousands of downstream applications.

PRE-NVD vulnerabilities refer to security flaws that are discovered, discussed, or even exploited in the wild before their official inclusion in the National Vulnerability Database (NVD). These early-stage vulnerabilities often emerge through threat actor chatter, exploit proof-of-concepts, and technical disclosures shared across social media platforms and underground forums, signaling potential exploitation risks before public awareness.

The week showed that patch status alone no longer measured safety. Switches running fixed firmware fell to a new zero-day, signed certificates became a path to node impersonation, and trusted channels such as input method updates and RAR archives carried malware straight to their targets. Defenders who relied on vendor assurances or monthly patch cycles found the ground shifting beneath them, as attackers turned disclosure into action within days. LOVI continues to track exploited vulnerabilities, threat actor campaigns and CISA KEV additions as they emerge, delivering the prioritized intelligence and threat profiles security teams need to stay ahead of the next wave.

FAQs

Q1. Was the Zyxel GS1900 patch for CVE-2026-7273 enough to stop attacks?

No. Binarly found that attackers exploited a separate zero-day, CVE-2026-107441, which worked against firmware carrying the earlier fix, and Zyxel released new firmware on October 22.

Q2. Who is behind the DarkVigil backdoor attacks on Sogou Input Method users?

ESET attributed the campaign to SlippyNunchucks, a China-aligned group that hijacked DNS requests from Sogou Input Method’s insecure HTTP channel to deliver DarkVigil.

Q3. What should organizations do when a vulnerability has no patch available?

When no patch exists, organizations should reduce exposure by restricting access to affected management interfaces through trusted IP allowlists or VPN connections. Security teams should actively hunt for signs of compromise, such as unexpected files, suspicious processes or unusual outbound traffic. Once the vendor releases a fix, it should be applied immediately and its effectiveness verified.

Q4. How does LOVI help organizations manage vulnerabilities effectively?

Loginsoft Vulnerability Intelligence empowers you to efficiently prioritize and respond to potential vulnerabilities by focusing on those actively exploited in the wild. LOVI correlates vulnerability data with real-world threat activity to reduce noise and improve decision-making. This approach enables faster remediation and stronger security posture.

Q5. What is Cytellite?

Cytellite is a Loginsoft security intelligence platform that provides real-time visibility into emerging threats through a global sensor network. It delivers actionable IP intelligence to help organizations detect, analyze, and respond to attacks quickly. By correlating threat data with live activity, Cytellite strengthens resilience across dynamic threat landscapes.