Cyber Threat Brief — November 13 2026
⚠️ This report is AI-generated. Always validate findings.
1. Cisco BroadWorks — CVE-2026-20320
TL;DR: Cisco now says its PSIRT learned in November 2026 of active exploitation of CVE-2026-20320, which CISA KEV lists as due 24 Nov. Upgrade Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform to RI.2026.07.
What’s New:
- Cisco advisory cisco-sa-bworks-xxe-uwUd7CEt, last updated 12 Nov 2026 17:25 GMT as version 1.1, says: “In November 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” The 12 Nov brief still quoted the older line that PSIRT was not aware of malicious use. CISA added CVE-2026-20320 on 10 Nov, due 24 Nov. KEV catalog
- The flaw is an unauthenticated out-of-band blind XML external entity injection in the Open Client Interface - Provisioning (OCI-P) parser. A crafted XML message can expose files readable by the BroadWorks user. CVSS base is 7.5. Cisco bug ID is CSCwv48590. The advisory lists no workaround.
- The first fixed release on the advisory is RI.2026.07 for Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform. A footnote on the Application Delivery Platform row says the flaw affects its Open Client Server and OCIOverSoap components. Cisco lists no workaround.
- The Hacker News quotes Malbear Labs on a campaign it calls Operation Snowball. Malbear says an autonomous agent run by a Chinese-speaking actor used CVE-2026-20320 against a European telecom provider’s XSP, release 23.0.1.1075 on port 2208, and recovered the system identity private key and SSL credentials. Malbear’s own report was not fetched, so treat these details as Malbear’s claim.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| BroadWorks Application Delivery Platform RI.2026.07 | Fixed release | T1190 | BroadWorks software inventory | Install RI.2026.07 on BroadWorks Application Delivery Platform. The advisory lists it as the first fixed release for CVE-2026-20320. Advisory |
| BroadWorks Application Server RI.2026.07 | Fixed release | T1190 | BroadWorks software inventory | Install RI.2026.07 on BroadWorks Application Server. The advisory lists it as the first fixed release for CVE-2026-20320. Advisory |
| BroadWorks Profile Server RI.2026.07 | Fixed release | T1190 | BroadWorks software inventory | Install RI.2026.07 on BroadWorks Profile Server. The advisory lists it as the first fixed release for CVE-2026-20320. Advisory |
| BroadWorks Xtended Services Platform RI.2026.07 | Fixed release | T1190 | BroadWorks software inventory | Install RI.2026.07 on BroadWorks Xtended Services Platform. The advisory lists it as the first fixed release for CVE-2026-20320. Advisory |
| OCI-P XML containing DOCTYPE, ENTITY, or SYSTEM | Request content | T1190 | OCI-P access log | Alert when an OCI-P request body contains DOCTYPE, ENTITY, or SYSTEM. That is the XML shape of CVE-2026-20320. |
| XSP OCI listener on TCP 2208 | Network exposure | T1190 | Firewall or external scan | Restrict TCP 2208 on Xtended Services Platform hosts to known OCI clients. Malbear, quoted by The Hacker News, says the exploited XSP listened there. The Hacker News |
| XSP system identity key and SSL credentials | Credential | T1552.004 | BroadWorks certificate inventory | On any XSP host that ran a release earlier than RI.2026.07 and faced untrusted networks, rotate the system identity key and SSL credentials. Malbear says the agent recovered them. The Hacker News |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule names BroadWorks, OCI-P, or XXE. |
| Elastic | None — verified | No rule names BroadWorks, OCI-P, or XXE. |
| Sigma | Partial — Potential XXE Exploitation Attempt In JVM Based Application | Matches parser errors in JVM logs only. A clean blind XXE may log none. |
Hunt hint: Install RI.2026.07 on Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform. The advisory lists no workaround. On OCI-P listeners, alert on XML that contains DOCTYPE, ENTITY, or SYSTEM. From those BroadWorks hosts, alert on outbound HTTP or DNS to hosts your operators do not already use. Review reads of configuration files by the BroadWorks account that you cannot tie to a change window. Restrict TCP 2208 on XSP hosts. Treat the KEV entry and the Cisco advisory as the exploitation record, and treat Malbear’s Operation Snowball account as an attributed claim only.
Sources: Cisco advisory · CISA KEV · The Hacker News on Malbear Labs · SecurityWeek
2. Check Point Gaia — CVE-2026-123039
TL;DR: Check Point reports that CVE-2026-123039, a local root flaw that needs code already running on the gateway, was seen on a couple of dozen customers after PHP2Shell. That customer report is not independently confirmed and the CVE is not in CISA KEV, so install your branch’s Jumbo Hotfix Take or stop dynamic_server.
What’s New:
- Check Point sk1000362, modified 12 Nov 2026, scores CVE-2026-123039 at 7.8 and says the flaw needs local code execution first. It affects Force Firewalls, Management and Log Servers, MDSM and MDLS, and Maestro Orchestrator. Spark and Smart-1 Cloud are not in that list. Fixed Jumbo Hotfix Accumulator takes are R82.20 Take 14, R82.10 Take 52, R82 Take 132, and R81.20 Take 174. R81 and R81.10 are end of support and have no Take.
- sk1000362 says Check Point observed an active exploit of this vulnerability against a couple of dozen customers. That customer claim is not independently confirmed. The blog, the research report, and sk1000362 are one Check Point origin, and the CVE is not in CISA KEV.
- Check Point Research describes a 30 Oct wave against Israeli organizations, some of it destructive, a 2 Nov wave with no destruction, and activity through 4 Nov. It says PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on Mobile Access was the first step, then names webshells in the login templates, TSGA as slot_CPconfigdaemon, TSProxy at /lib/libcpfwcommon.so, SSH to ESXi as vpxuser, a destroy_v6 wiper, and DREAM_ANNEXATION.txt. It says ESET has tied PhiliKit to UNC5221 and that Check Point cannot confirm that attribution.
- An independent lab at github.com/googlesky/CVE-2026-123039 reproduces the mechanism: root dynamic_server publishes /tmp/dynamic_socket mode 0777 and authenticates no caller, and a patched build refuses the unprivileged connection. The lab does not report customer incidents.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Gaia R82.20 Jumbo Hotfix Accumulator Take 14 | Fixed release | T1068 | Gaia package inventory | Install Jumbo Hotfix Accumulator Take 14 on R82.20 for CVE-2026-123039. sk1000362 |
| Gaia R82.10 Jumbo Hotfix Accumulator Take 52 | Fixed release | T1068 | Gaia package inventory | Install Jumbo Hotfix Accumulator Take 52 on R82.10 for CVE-2026-123039. sk1000362 |
| Gaia R82 Jumbo Hotfix Accumulator Take 132 | Fixed release | T1068 | Gaia package inventory | Install Jumbo Hotfix Accumulator Take 132 on R82 for CVE-2026-123039. sk1000362 |
| Gaia R81.20 Jumbo Hotfix Accumulator Take 174 | Fixed release | T1068 | Gaia package inventory | Install Jumbo Hotfix Accumulator Take 174 on R81.20 for CVE-2026-123039. sk1000362 |
| Gaia R81.10 | Vulnerable version | T1068 | Gaia package inventory | Replace R81.10. sk1000362 lists no Take that fixes CVE-2026-123039 on this end-of-support branch. sk1000362 |
| Gaia R81 | Vulnerable version | T1068 | Gaia package inventory | Replace R81. sk1000362 lists no Take that fixes CVE-2026-123039 on this end-of-support branch. sk1000362 |
| /tmp/dynamic_socket mode 0777 | File mode | T1068 | Gaia shell | Run ls -l /tmp/dynamic_socket. Treat srwxrwxrwx as not patched. A patched socket is srw-rw----, owner root, group config. sk1000362 |
| dbset process:dynamic_server | Configuration | T1068 | Gaia expert mode | Until the Take is installed, run dbset process:dynamic_server and then dbset :save. Check Point says this stops Dynamic CLI commands described in sk144112. Turn it back on with dbset process:dynamic_server t. sk1000362 |
| /var/log/dynamicCli.log | Log path | T1068 | Gaia /var/log/dynamicCli.log | Review Received lines that omit the wrapper . /opt/CPshared/5.0/tmp/.CPprofile.sh >> /dev/null; export SP_DISTRIBUTE=0; set -o noglob;. On a patched gateway, confirm the log contains Rejected connection from unauthorized uid. sk1000362 |
| 130.94.19.204 | Network address | T1071 | Firewall or proxy | Block 130.94.19.204. Check Point Research reports this address against Mobile Access portals. Report |
| 130.94.19.168 | Network address | T1071 | Firewall or proxy | Block 130.94.19.168. Check Point Research lists this address with 130.94.19.204. Report |
| SHA-256 4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8 | File hash | T1543 | EDR file hash | Alert on SHA-256 4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8. Check Point names this hash slot_CPconfigdaemon. Report |
| /lib/libcpfwcommon.so | File path | T1574.006 | EDR file | Alert on creation of /lib/libcpfwcommon.so. Check Point says TSProxy is written to that path. Report |
| DREAM_ANNEXATION.txt | File name | T1485 | EDR file | Alert on DREAM_ANNEXATION.txt. Check Point says the wiper writes that note. Report |
| SHA-256 edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3 | File hash | T1505.003 | EDR file hash | Alert on SHA-256 edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3. Check Point names this hash for the tpl webshell. Report |
| upload_progress_pwn | File content | T1190 | Gaia /opt/CPcvpn-R81.20/tmp/ | Hunt PHP session files under /opt/CPcvpn-R81.20/tmp/ that contain upload_progress_pwn. Check Point reports that marker on the Mobile Access portal. Report |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule covers Gaia, dynamic_socket, or dynamicCli.log. |
| Elastic | None — verified | No rule covers Gaia, dynamic_socket, or dynamicCli.log. |
| Sigma | None — verified | No rule covers Gaia, dynamic_socket, or dynamicCli.log. |
Hunt hint: Install Jumbo Hotfix Accumulator Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82, or Take 174 on R81.20. Replace R81 and R81.10, which have no Take for CVE-2026-123039. Until the Take is installed, run dbset process:dynamic_server and then dbset :save. Run ls -l /tmp/dynamic_socket, treat srwxrwxrwx as not patched, and treat srw-rw---- owned by root and group config as patched. In /var/log/dynamicCli.log, investigate Received lines that omit . /opt/CPshared/5.0/tmp/.CPprofile.sh >> /dev/null; export SP_DISTRIBUTE=0; set -o noglob;, run grep -F “Received = #return_value#”, and look for id, whoami, /etc/shadow, ncat, nc, /dev/tcp, curl, wget, base64, useradd, and authorized_keys. Also hunt slot_CPconfigdaemon, /lib/libcpfwcommon.so, DREAM_ANNEXATION.txt, and upload_progress_pwn under /opt/CPcvpn-R81.20/tmp/.
Sources: sk1000362 · Check Point Research · Check Point blog · Independent lab README
3. Windows SignDrop — public local privilege escalation
TL;DR: A public proof of concept called SignDrop can make Windows Defender write a CLFS signature file that leads to a SYSTEM shell, and Microsoft has published no patch. Cyderes reports no confirmed exploitation as of 10 Nov. Alert on hid.dll created in the Windows ink folder and leave the CLFS mitigation on.
What’s New:
- Abdelhamid Naceri, also called Nightmare Eclipse, published the proof of concept. BleepingComputer and SecurityWeek both quote him. A standard user creates a CLFS log that names a container path, then calls Defender’s signature-update RPC so the engine opens that path. If the signature file is missing, CLFS creates the .cnpf file as SYSTEM, with the original file’s permissions. SecurityWeek says the proof of concept then puts a payload in that file and starts a SYSTEM shell.
- Naceri says he tested Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental. BleepingComputer carries his estimate that about 80 percent of Windows installations are affected. That figure is his estimate, not a Microsoft measurement.
- Cyderes Howler Cell reproduced the chain to a SYSTEM shell. It says the redirected .cnpf write lands as C:\Program Files\Common Files\microsoft shared\ink\hid.dll, and consent.exe loads that DLL while osk.exe runs. It reports no confirmed exploitation as of 10 Nov. Microsoft has published no statement, no CVE, and no fix. Naceri says turning off the CLFS mitigation would expose hosts to the memory-corruption bugs that mitigation was added to stop.
- He also points at HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode. He says a value of 0 or 1, learning mode or enforcement mode, is the mode this proof of concept needs.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| hid.dll in C:\Program Files\Common Files\microsoft shared\ink | File creation | T1574.001 | Sysmon 11 or EDR file | Alert on any creation of hid.dll in the ink folder. Cyderes says Windows does not ship it there. Cyderes |
| consent.exe loading a DLL from the ink folder | Image load | T1574.001 | Sysmon 7 or EDR image load | Alert when consent.exe loads any DLL from C:\Program Files\Common Files\microsoft shared\ink. Cyderes |
| SYSTEM conhost.exe after a hid.dll write | Process behavior | T1068 | Sysmon 1 and 11 | Correlate a SYSTEM conhost.exe on the user desktop with a recent hid.dll write or load from the ink folder. Cyderes |
| MpEngine.dll outside Defender paths | File creation | T1068 | Sysmon 11 or EDR file | Alert when MpEngine.dll is created outside the Windows Defender install paths. The proof of concept stages a bait copy in %TEMP%. Cyderes |
| osk.exe started hidden by a user process | Process behavior | T1068 | Sysmon 1 or EDR process | Hunt osk.exe launched hidden by an unexpected parent, alongside CLFS log files created under %TEMP%. Cyderes |
| HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode | Registry value | T1068 | Registry or Sysmon 13 | Read HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode. Naceri says 0 or 1 is the mode this proof of concept needs. Leave the mitigation enabled. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Windows Suspicious Defender Engine or Signature Files Created | Hits the bait MpEngine.dll only. The ink-folder hid.dll write is not covered. |
| Elastic | Partial — Potential Masquerading as System32 DLL | Hits a new unsigned hid.dll load outside System32. Misses the CLFS and RPC stages. |
| Sigma | Partial — Potential System DLL Sideloading From Non System Locations | Hits hid.dll loaded from the ink folder. Misses the CLFS and RPC stages. |
Hunt hint: Alert on any hid.dll created in C:\Program Files\Common Files\microsoft shared\ink, and on consent.exe loading a DLL from that folder. Correlate a SYSTEM conhost.exe with a recent hid.dll write there. Flag MpEngine.dll created outside Defender paths and osk.exe started hidden by a user process. Read HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode, and treat 0 or 1 as the hosts to watch first. Leave the CLFS signing mitigation enabled. There is no Microsoft patch and no CVE. Cyderes reports no confirmed exploitation as of 10 Nov.
Sources: BleepingComputer · SecurityWeek · Cyderes Howler Cell
Detection index: ESCU dd432279b4c9 (2026-11-13) · elastic detection-rules 836b5669b59e (2026-11-13) · SigmaHQ 54967d64e6dd (2026-11-13). SignDrop, BroadWorks XXE, and Gaia rules were searched at those tips.
Status Updates
- N-central (N-able-NCentral-Able2Shell-2026-11): Huntback reports 21 servers mining, 19 on 2026.4.1.26, from 157.20.241.16 via 4EverAble2Shell. Previdian saw two attempts. N-able, via BleepingComputer, still reports no compromise, disabled Intune, and says keep Legacy API off. No fix for this chain. Huntback Previdian Legacy API X 12 Nov brief
- N-central HF2 CVEs (N-able-NCentral-Able2Shell-2026-11): CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882, and CVE-2026-91000 remain the 2026.4.1.26 set. That build does not close 4EverAble2Shell. HF2 notes 12 Nov brief
- Barracuda ESG (Barracuda-ESG-CVE-2026-116606-2026-11): Due today, 13 Nov, with CVE-2026-111560. No new material. 11 Nov brief
- OpenSSH (OpenSSH-CVE-2026-123158): KEV is now overdue (due 12 Nov). Scope remains musl with PAM disabled. The fix remains 10.6p2. OpenSSH notes 10 Nov brief
- GPUStack (GPUStack-CVE-2026-102895): KEV is now overdue (due 12 Nov). SANS ISC reports attempts from 144.91.73.103 with header X-Gpustack-Real-IP: 127.0.0.1. Still move builds before 2.2.0 to 2.3.0 or later. Releases SANS 10 Nov brief
- FreeSWITCH (FreeSWITCH-CVE-2026-116779): KEV is now overdue (due 12 Nov). No new material. The fix remains 1.11.3 or later. v1.11.3 10 Nov brief
- IBM Aspera Faspex (IBM-Aspera-Faspex-CVE-2026-123218): KEV is now overdue (due 12 Nov). No new material. The fix remains 5.0.19 PL1. IBM bulletin 10 Nov brief
- VMware ESX (CVE-2026-41709): KEV remains overdue (due 11 Nov). No new build. Prior brief
- ScreenConnect (ScreenConnect-SCKit-RMMplus-2026-11): Watching (no change). No new primary since 12 Nov. 12 Nov brief
- GitHub Actions (GitHub-wfx-loot-CI-stealer-2026-11): Watching (no change). No new primary since 12 Nov. 12 Nov brief
- eMudhra (eMudhra-CVE-2026-111943): eMudhra’s 10 Nov report on Mozilla bug 2083449 says it revoked eight RSA-4096 intermediates (G2B and G2C) on 7 Nov, reason cessation of operation, and that private-key integrity stayed intact. eMudhra also says it will exit the public TLS business. CVE-2026-91403 is unchanged. Bug 2083449 27 Oct brief
- Openwave Webtop (Openwave-Webtop-CVE-2026-111793): Still not briefed. KEV remains due 24 Nov. The vendor fix remains 1.1.22.0, with a move to Media Server 2.0. Advisory 11 Nov brief
- Microsoft Outlook (Microsoft-Outlook-CVE-2026-124194): Watching (no change). KEV remains due 24 Nov. 11 Nov brief
- Google Chrome (Chrome-CVE-2026-125350-2026-11): Watching (no change). KEV remains due 24 Nov. 11 Nov brief
- Brotli (CVE-2026-111497): KEV remains overdue (due 10 Nov). The PAN-OS fix builds remain as listed on 10 Nov. Palo Alto 10 Nov brief
- Adobe Commerce (CVE-2026-48356): KEV remains overdue (due 10 Nov). No new material. Prior brief
- European refrigeration controllers (Refrigeration-Controllers-EU-2026-11): Watching (no change). France’s C4 still attributes the 11–12 Oct attacks on about 700 French retail sites to IRGC unit Shahid Kaveh; that attribution does not cover the November wave. 10 Nov brief
- LNbits (LNbits-server-shutdown-2026-11): Watching (no change). The latest release is still v1.6.2 from 18 Sep, so there is no fixed release. Keep self-hosted LNbits stopped and the Paywall extension disabled. Releases 9 Nov brief
- Synology DSM (Cerber-Synology-DSM-2026-10): Watching (no change). Synology still has not identified which of CVE-2024-10441, CVE-2024-50629 or CVE-2024-10445 was used. 2 Nov brief
- ARTEX (ARTEX-Software-Vendors-2026-11): Watching (no change). WorkOS attributes its incident to an escaped test agent. Microsoft’s Storm-3358 financial claim stays deferred. 3 Nov brief
- SonicWall SonicOS (SonicWall-SonicOS-CVE-2026-19868): Watching (no change). KEV remains due 20 November. SNWLID-2026-0014 7 Nov brief
- Apple (Apple-CVE-2024-27834-2026-11): Watching (no change). CVE-2024-27834 remains KEV due 18 November. Prior brief
- Zyxel GS1900 (Zyxel-GS1900-CVE-2026-107441): Watching (no change). The 3 Nov advisory and the separate CVE-2026-7273 KEV bug remain as briefed. Prior brief
- GitLab (CVE-2026-110264): Watching (no change). Prior brief
- Canonical LXD (CVE-2026-112816): Watching (no change). Prior brief
- Binance (Binance-TraderTraitor-2026-11): Watching (no change). Prior brief
- Cursor marketplace Claude Code (Cursor-Claude-Code-2.1.313-2026-10): Watching (no change). Prior brief
- XCPE Android TV (XCPE-Botnet-2026-11): Watching (no change). Prior brief
- Retired from watch: Plex2Shell-CVE-2026-96652 (Plex Media Server, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656, last update 2026-11-06); WordPress-Core-CVE-2026-119977 (WordPress Core, CVE-2026-119977, last update 2026-11-06). 6 Nov brief 7 Nov brief