Cyber Threat Brief — November 14 2026
⚠️ This report is AI-generated. Always validate findings.
1. UnrealIRCd — CVE-2026-114713
TL;DR: CISA added CVE-2026-114713 on 13 Nov, due 16 Nov, and UnrealIRCd’s maintainer says people are exploiting it on the internet now. Install 6.2.7.1, or on 6.0.0 through 6.2.7 run hot-patch bundle-20261107.
What’s New:
- CISA added CVE-2026-114713 on 13 Nov, due 16 Nov. Syzop wrote on the UnrealIRCd forum that the project is seeing this issue exploited on the internet right now, and on 8 Nov that abuse attempts were starting. KEV catalog CISA alert Forum
- The labeled-response module does not escape the IRCv3 label tag. NVD, as quoted by The Hacker News, says any user on a network with two or more linked servers can inject server-to-server commands that run with server authority, including KILL and GLINE. CVSS is 8.6. The maintainer says the issues were found in an internal audit that used AI.
- Affected builds are UnrealIRCd 6.0.0 before 6.2.7.1. Hot-patch bundle-20261107 covers 6.0.0 through 6.2.7. The spamfilter workaround protects a network only when every server is 6.0.4 or newer. UnrealIRCd 5, end of life since 1 Jul 2023, is also affected. Its workaround is to blacklist the labeled-response module and restart.
- A safe module-status line is labeled-response 6.2.7.1 or labeled-response 5.0-hot-patch-bundle-20261107. The line labeled-response 5.0, with no hot-patch suffix, is not patched.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| UnrealIRCd 6.2.7.1 | Fixed release | T1190 | UnrealIRCd software inventory | Install UnrealIRCd 6.2.7.1. The 7 Nov forum post lists it as the fixed release for CVE-2026-114713. Forum |
| hot-patch bundle-20261107 | Hotfix | T1190 | UnrealIRCd host shell | On UnrealIRCd 6.0.0 through 6.2.7, run ./unrealircd hot-patch bundle-20261107. Forum |
| labeled-response 6.2.7.1 | Version string | T1190 | UnrealIRCd module status | On 6.0.2 or later, treat a module-status line of labeled-response 6.2.7.1 as patched for CVE-2026-114713. Forum |
| labeled-response 5.0-hot-patch-bundle-20261107 | Version string | T1190 | UnrealIRCd module status | Treat a module-status line of labeled-response 5.0-hot-patch-bundle-20261107 as the hot-patch for CVE-2026-114713. Forum |
| labeled-response 5.0 | Version string | T1190 | UnrealIRCd module status | Treat labeled-response 5.0 with no hot-patch suffix as not patched. Forum |
| Invalid_label spamfilter | Configuration | T1190 | UnrealIRCd spamfilter log | As an IRCOp, add /SPAMFILTER add -regex T block - Invalid_label ^label=(?![^\r\n;\x20]*\z). The forum says this protects linked servers only when every server is 6.0.4 or newer. Forum |
| blacklist-module “labeled-response” | Configuration | T1190 | UnrealIRCd config | On UnrealIRCd 5, set blacklist-module “labeled-response”; and restart the process. The forum says a rehash is not enough. Forum |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule names UnrealIRCd or labeled-response. |
| Elastic | None — verified | No rule names UnrealIRCd or labeled-response. |
| Sigma | None — verified | No rule names UnrealIRCd or labeled-response. |
Hunt hint: Install 6.2.7.1, or on 6.0.0 through 6.2.7 run ./unrealircd hot-patch bundle-20261107. Read module-status for labeled-response, treat 6.2.7.1 or 5.0-hot-patch-bundle-20261107 as patched, and treat 5.0 alone as not patched. Until every linked server is patched, add the Invalid_label spamfilter, which the vendor says works only when every server is 6.0.4 or newer. On UnrealIRCd 5, blacklist the labeled-response module and restart. Hunt KILL, GLINE, and other server-originated commands that no oper issued. Also hunt client traffic whose label tag contains a carriage return, line feed, space, or semicolon, and hunt spamfilter hits on Invalid_label.
Sources: UnrealIRCd forum · UnrealIRCd · CISA KEV · CISA alert · The Hacker News
2. Copeland XWEB EVO — CVE-2026-124002 through CVE-2026-124015
TL;DR: VulnCheck claims its sensors recorded attempts against two of 14 Copeland XWEB EVO flaws, and that sensor claim is unconfirmed. Copeland ended software support on 16 March 2026, so keep these supervisors off the internet and plan the transition to XWEB PRO.
What’s New:
- VulnCheck disclosed CVE-2026-124002, CVE-2026-124003, CVE-2026-124004, CVE-2026-124005, CVE-2026-124006, CVE-2026-124007, CVE-2026-124008, CVE-2026-124009, CVE-2026-124010, CVE-2026-124011, CVE-2026-124012, CVE-2026-124013, CVE-2026-124014, and CVE-2026-124015 in Copeland (Dixell) XWEB EVO. Copeland’s March 2026 bulletin says software maintenance stopped on 16 March 2026, including security patches, and tells customers to transition to XWEB PRO. End-of-support bulletin VulnCheck
- NVD lists CVE-2026-124010 at CVSS 9.8 on builds before 5.6.2: one unauthenticated request to xwconsole.cgi passes the sh parameter to a setuid-root CGI. NVD lists CVE-2026-124014 on 4.3.0 through 5.8.8 as an unauthenticated write of the system configuration through config.lua. VulnCheck’s blog says that write was removed in the 2021 rewrite and remains on legacy builds. CVE-2026-124010 CVE-2026-124014
- VulnCheck claims its sensors recorded 125 attempts against CVE-2026-124014 from 202.61.138.117 between 22:00 UTC on 12 Nov and 06:16 UTC on 13 Nov, 87 of them in the first hour, and four probes for CVE-2026-124010 from 177.4.12.11 on 13 Nov. VulnCheck calls both sources opportunistic scanners, not the October sabotage group. Those sensor reports are unconfirmed by any second origin, and CISA KEV does not list these CVEs.
- VulnCheck says firmware 5.8.8, which is past Copeland’s 16 March 2026 support end, still exposes the code-of-the-day chain: CVE-2026-124005, CVE-2026-124011, CVE-2026-124012, CVE-2026-124006, and authenticated CVE-2026-124013. VulnCheck counts about 1,663 exposed hosts in Shodan and says Onyphe counts about 1,960. Copeland’s best-practices bulletin says never expose the controller or its web interface to the broader internet. Best practices
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| XWEB EVO | Network exposure | T1190 | Asset inventory or external scan | Keep every XWEB EVO off the broader internet, including its web interface. Copeland’s best-practices bulletin says never expose the control system that way. Best practices |
| XWEB PRO | Product transition | T1190 | Asset inventory | Plan a transition from XWEB EVO to XWEB PRO. Copeland’s March 2026 bulletin says software support ended 16 March 2026 and names that transition as the required action. End-of-support bulletin |
| XWEB EVO before 5.6.2 | Vulnerable version | T1190 | Firmware inventory | Treat XWEB EVO before 5.6.2 as exposed to CVE-2026-124010 and keep it off untrusted networks. NVD End-of-support bulletin |
| XWEB EVO 5.8.8 | Vulnerable version | T1078 | Firmware inventory | Treat XWEB EVO 5.8.8 as exposed to CVE-2026-124005, CVE-2026-124011, CVE-2026-124012, CVE-2026-124006, and CVE-2026-124013. Keep that build off the internet, because Copeland’s bulletin says it gets no security patches after 16 March 2026. NVD End-of-support bulletin |
| /cgi-bin/xwconsole.cgi | URL path | T1190 | Web access log | Alert on any request to /cgi-bin/xwconsole.cgi that includes an sh parameter. NVD says that parameter reaches a setuid-root CGI on builds before 5.6.2. NVD |
| /cgi-bin/config.lua | URL path | T1190 | Web access log | Alert on a POST to /cgi-bin/config.lua with action=set. NVD says that request writes the system configuration on the listed builds. NVD |
| /cgi-bin/sysinfo.lua | URL path | T1082 | Web access log | Alert on requests to /cgi-bin/sysinfo.lua from untrusted networks. VulnCheck says that page returns the device MAC used for the daily administrator password. VulnCheck |
| 202.61.138.117 | Network address | T1190 | Firewall or web log | Review requests from 202.61.138.117. VulnCheck says this host sent the config.lua attempts. VulnCheck |
| 177.4.12.11 | Network address | T1190 | Firewall or web log | Review requests from 177.4.12.11. VulnCheck says this host sent the xwconsole.cgi probes. VulnCheck |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule names XWEB, xwconsole.cgi, or config.lua. |
| Elastic | None — verified | No rule names XWEB, xwconsole.cgi, or config.lua. |
| Sigma | None — verified | No rule names XWEB, xwconsole.cgi, or config.lua. |
Hunt hint: Inventory every XWEB EVO and keep the device and its web interface off the broader internet. Plan the transition to XWEB PRO that Copeland’s March 2026 bulletin requires, and until then restrict access and segment the device. On the web logs, alert on /cgi-bin/xwconsole.cgi with an sh parameter, on POST /cgi-bin/config.lua with action=set, and on /cgi-bin/sysinfo.lua. Review 202.61.138.117 and 177.4.12.11, which VulnCheck names as the two sensor sources. Treat those sensor reports as one origin, and do not tie them to the October sabotage group. There is no vendor patch after 16 March 2026.
Sources: VulnCheck · End-of-support bulletin · Best practices · NVD CVE-2026-124010 · NVD CVE-2026-124014 · NVD CVE-2026-124005
3. ScreenConnect — unauthorized crypto-exchange guest sessions
TL;DR: Huntress says it found thousands of unauthorized ScreenConnect guest sessions that used crypto-exchange names, and it says those sessions showed no malicious activity. Delete the sessions that are not yours, and upgrade on-prem ScreenConnect to 26.6.5 when the server is already on 25.4 or later.
What’s New:
- Huntress says that as of 13 Nov it had seen this activity on at least 118 self-hosted ScreenConnect servers in 109 organizations. Its key takeaways say 2,408 unauthorized sessions since 3 Nov, while the post body says 2,223. Huntress says 97.8 percent connected from 74.208.158.106, and the first three sessions came from 197.47.160.252 at 21:26 UTC on 3 Nov. Huntress
- Huntress says the guests are emulated Windows clients with names such as KUCOIN-SRV and LAPTOP-BINANCE, on guest version 25.3.4.9288. It says it has not seen files pushed, commands run, or anything sent to technicians who joined.
- Huntress’s leading hypothesis is bait for client-side CVE-2026-84869, which is context only and is not reopened as a watch item. ConnectWise’s 8 Sep 2026 bulletin says versions before 26.6.5 can let a session transfer and run a file without host confirmation, and that the servers themselves are not the affected component. Huntress says it has not seen these sessions used that way, and it found no overlap with SCKit indicators. Bulletin
- Huntress says to delete the fake sessions and to put every technician client on 26.6.5 or later. The bulletin says on-prem partners already on 25.4 or later should upgrade to 26.6.5, and that cloud instances are already on 26.6.5.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| ScreenConnect 26.6.5 | Fixed release | T1059 | ScreenConnect version inventory | Upgrade on-prem ScreenConnect to 26.6.5 when the installation is already on 25.4 or later. The 8 Sep 2026 bulletin says versions before 26.6.5 are affected and cloud instances are already on 26.6.5. Bulletin |
| Session.db ClientType 1 with an empty guest public key | Session record | T1078 | ScreenConnect Session.db | Find guest rows with ClientType 1 and an empty guest public key. Huntress says that is the shape of these unauthorized sessions. Huntress |
| guest version 25.3.4.9288 | Version string | T1078 | ScreenConnect Session.db | Find Access guests whose version is 25.3.4.9288. Huntress names that build for the emulated clients. Huntress |
| 74.208.158.106 | Network address | T1078 | ScreenConnect access log | Review ScreenConnect sessions from 74.208.158.106. Huntress says 97.8 percent of these connections came from that address. Huntress |
| 197.47.160.252 | Network address | T1078 | ScreenConnect access log | Review the earliest sessions from 197.47.160.252. Huntress says the first three arrived at 21:26 UTC on 3 Nov. Huntress |
| KUCOIN-SRV | Guest name | T1078 | ScreenConnect session list | Find guests named KUCOIN-SRV. Huntress gives that name as an example of the emulated Windows clients. Huntress |
| LAPTOP-BINANCE | Guest name | T1078 | ScreenConnect session list | Find guests named LAPTOP-BINANCE. Huntress gives that name as a second example. Huntress |
ScreenConnect.WindowsClient.exe child with a file under Documents\*\Temp\ | Process behavior | T1059 | Sysmon 1 or EDR process on technician workstations | Alert when ScreenConnect.WindowsClient.exe starts cmd.exe, powershell.exe, wscript.exe, or msiexec.exe with a file under Documents\*\Temp\. Huntress calls that the host-side shape of CVE-2026-84869 abuse, and says it has not seen these sessions do it. Huntress |
| SHA256:kt6iiIS3kcQ3NsUSVfk7gJoGMSSUqMdXqsmjb+/cSHg | Host key | T1078 | Internet scan data | Pivot on this ECDSA SSH host key in internet scan data to find related hosts. Huntress lists it as the host key of 74.208.158.106, for pivoting. Huntress |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule matches Session.db guests or a WindowsClient.exe child. |
| Elastic | Partial — Suspicious ScreenConnect Client Child Process | Covers WindowsClient.exe starting cmd.exe /c or wscript.exe. Misses powershell.exe without encoded or download arguments, msiexec.exe without quiet install flags, and the Documents Temp file path. |
| Sigma | Partial — Remote Access Tool - ScreenConnect Temporary File | Covers WindowsClient.exe writing a file under Documents\ConnectWiseControl\Temp\. Does not see the process start, is low level, and also fires on legitimate transfers. |
Hunt hint: In Session.db, find Access guests with ClientType 1 and an empty guest public key, and guests on version 25.3.4.9288. Review sessions from 74.208.158.106 and 197.47.160.252, and guests named KUCOIN-SRV or LAPTOP-BINANCE. Delete those sessions when they are not yours, and check whether a technician joined one. Upgrade on-prem ScreenConnect to 26.6.5 when the server is already on 25.4 or later. On technician workstations, alert when ScreenConnect.WindowsClient.exe starts cmd.exe, powershell.exe, wscript.exe, or msiexec.exe with a file under Documents\*\Temp\. Huntress says it saw no malicious activity from the sessions and no overlap with SCKit indicators.
Sources: Huntress · ConnectWise bulletin
Detection index: ESCU 39c8993ea395 (2026-11-13) · elastic detection-rules 836b5669b59e (2026-11-13) · SigmaHQ 54967d64e6dd (2026-11-13). UnrealIRCd, XWEB, and ScreenConnect guest-session rules were searched at those tips.
Status Updates
- Check Point Gaia (CheckPoint-Gaia-CVE-2026-123039-2026-11): CISA added CVE-2026-123039 to KEV on 13 Nov, due 16 Nov, so KEV now stands for exploitation. Fixed Takes remain those in the 13 Nov brief. KEV sk1000362
- Barracuda ESG (Barracuda-ESG-CVE-2026-116606-2026-11): CVE-2026-116606 and CVE-2026-111560 are now overdue. The due date was 13 Nov. No new material. 11 Nov brief
- GitHub Actions (GitHub-wfx-loot-CI-stealer-2026-11): Aikido says, via BleepingComputer, that about 50 stolen accounts can publish to npm, PyPI, Go, crates, or Packagist. The 4,837 account count is unchanged. 12 Nov brief
- Binance (Binance-TraderTraitor-2026-11): The Hacker News says the Justice Department announced seizure and restraint of more than $1.2 billion from the Binance theft. 4 Nov brief
- ARTEX (ARTEX-Software-Vendors-2026-11): Cisco Talos says financially motivated and China-nexus actors use ARTEX, including alongside VShell, GoPhish, and AdaptixC2. The Storm-3358 financial claim stays unconfirmed. 3 Nov brief
- European refrigeration controllers (Refrigeration-Controllers-EU-2026-11): The October attribution is unchanged. Today’s XWEB EVO section is separate, and VulnCheck says its scanners are not that sabotage group. 10 Nov brief
- ScreenConnect SCKit (ScreenConnect-SCKit-RMMplus-2026-11): The SCKit campaign is unchanged. Huntress’s crypto-exchange guest sessions are a separate section, and Huntress says they do not overlap SCKit indicators. 12 Nov brief
- Cisco BroadWorks (Cisco-BroadWorks-CVE-2026-20320): KEV remains due 24 Nov. The fix remains RI.2026.07. Advisory 13 Nov brief
- Windows SignDrop (Windows-SignDrop-LPE-2026-11): Still no Microsoft patch and no CVE. Cyderes still reports no confirmed customer use as of 10 Nov. 13 Nov brief
- N-central (N-able-NCentral-Able2Shell-2026-11): No new primary since 13 Nov. Huntback’s mining report and N-able’s no-compromise line, via BleepingComputer, still stand. There is still no fix for 4EverAble2Shell. 13 Nov brief
- N-central HF2 (N-able-NCentral-Able2Shell-2026-11): CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882, and CVE-2026-91000 remain the 2026.4.1.26 set. That build still does not close 4EverAble2Shell. HF2 notes 13 Nov brief
- OpenSSH (OpenSSH-CVE-2026-123158): KEV remains overdue (due 12 Nov). Scope remains musl with PAM disabled. The fix remains 10.6p2. OpenSSH notes 10 Nov brief
- GPUStack (GPUStack-CVE-2026-102895): KEV remains overdue (due 12 Nov). Still move builds before 2.2.0 to 2.3.0 or later. Releases 10 Nov brief
- FreeSWITCH (FreeSWITCH-CVE-2026-116779): KEV remains overdue (due 12 Nov). No new material. The fix remains 1.11.3 or later. v1.11.3 10 Nov brief
- IBM Aspera Faspex (IBM-Aspera-Faspex-CVE-2026-123218): KEV remains overdue (due 12 Nov). No new material. The fix remains 5.0.19 PL1. IBM bulletin 10 Nov brief
- VMware ESX (CVE-2026-41709): KEV remains overdue (due 11 Nov). No new build. 29 Oct brief
- Brotli (CVE-2026-111497): KEV remains overdue (due 10 Nov). The PAN-OS fix builds remain as listed on 10 Nov. Palo Alto 10 Nov brief
- Adobe Commerce (CVE-2026-48356): KEV remains overdue (due 10 Nov). No new material. 28 Oct brief
- Apple (Apple-CVE-2024-27834-2026-11): Watching (no change). CVE-2024-27834 remains KEV due 18 Nov. 5 Nov brief
- SonicWall SonicOS (SonicWall-SonicOS-CVE-2026-19868): Watching (no change). KEV remains due 20 Nov. 7 Nov brief
- Microsoft Outlook (Microsoft-Outlook-CVE-2026-124194): Watching (no change). KEV remains due 24 Nov. 11 Nov brief
- Google Chrome (Chrome-CVE-2026-125350-2026-11): Watching (no change). KEV remains due 24 Nov. 11 Nov brief
- Openwave Webtop (Openwave-Webtop-CVE-2026-111793): Not yet briefed. KEV remains due 24 Nov. The vendor fix remains 1.1.22.0. Advisory 11 Nov brief
- eMudhra (eMudhra-CVE-2026-111943): Watching (no change). 13 Nov brief
- LNbits (LNbits-server-shutdown-2026-11): Watching (no change). The latest release is still v1.6.2, so there is still no fixed release. Releases 9 Nov brief
- Synology DSM (Cerber-Synology-DSM-2026-10): Watching (no change). Synology still has not identified which of CVE-2024-10441, CVE-2024-50629, or CVE-2024-10445 was used. 2 Nov brief
- GitLab (CVE-2026-110264): Watching (no change). 2 Nov brief
- Canonical LXD (CVE-2026-112816): Watching (no change). 1 Nov brief
- Zyxel GS1900 (Zyxel-GS1900-CVE-2026-107441): Watching (no change). 5 Nov brief
- XCPE Android TV (XCPE-Botnet-2026-11): Watching (no change). 3 Nov brief
- Retired from watch: Cursor-Claude-Code-2.1.313-2026-10 (Cursor marketplace Claude Code 2.1.312 and 2.1.313, last update 2026-10-31). 31 Oct brief