#6 · 2026-11-13 · Severity: Critical
Threat types: vulnerability-exploit, zero-day · Industries: technology
Verified status
| CVE | CVSS | Vendor/product | Exploitation | References |
|---|---|---|---|---|
| CVE-2026-119077 | 9.8 | — | None known | NVD |
| CVE-2026-125055 | 9.8 | — | None known | NVD |
| CVE-2026-126378 | 9.4 | — | None known | NVD |
| CVE-2026-120868 | 9.3 | — | Reported by source | NVD |
| CVE-2026-123039 | 7.8 | — | Reported by source | NVD |
Checked against NVD and CISA KEV on 2026-11-13.
TL;DR
- Top story: Check Point warns of zero-day flaw exploited for root access
- Also notable: New N-able “4EverAble2Shell” zero-day exploited hours after PoC released; New Windows SignDrop zero-day gives hackers SYSTEM privileges
- No new CISA KEV entries in the last 24 hours
Executive summary
The overall threat level is currently critical, driven by multiple zero-day flaws and critical vulnerabilities. Threat activity over the last 24 hours includes warnings about a Check Point zero-day exploited for root access, alongside newly exploited zero-days affecting N-able and Windows SignDrop. Additionally, critical vulnerabilities affecting WordPress plugins, including the ELEX WordPress HelpDesk and Chatterbug Forms plugins, have been identified.
Top threats
1. Check Point warns of zero-day flaw exploited for root access
Severity: Critical | Type: zero-day | Industry: technology
Check Point Software has released emergency hotfixes to address a high-severity zero-day flaw. Hackers have been actively exploiting this vulnerability since late October to gain root privileges and establish persistence on vulnerable devices. Users are advised to apply the emergency updates.
Sources: BleepingComputer
Recommended actions:
- Check the linked report for products you run and verify details with the vendor before acting.
2. New N-able “4EverAble2Shell” zero-day exploited hours after PoC released
Severity: Critical | Type: zero-day, vulnerability-exploit | Industry: cross-industry
Hackers are actively exploiting a newly disclosed N-able N-central zero-day vulnerability called 4EverAble2Shell to compromise servers and deploy cryptocurrency miners. Researchers have reported at least 21 affected systems, including 19 running the company’s latest security update. The exploitation began hours after a proof-of-concept was released.
Sources: BleepingComputer
Recommended actions:
- Check the linked report for products you run and verify details with the vendor before acting.
3. New Windows SignDrop zero-day gives hackers SYSTEM privileges
Severity: Critical | Type: zero-day, vulnerability-exploit | Industry: cross-industry
Security researcher Abdelhamid Naceri, also known as Nightmare Eclipse, has released a new Windows zero-day exploit. According to BleepingComputer, the vulnerability can allow attackers to gain SYSTEM privileges.
Sources: BleepingComputer
Recommended actions:
- Check the linked report for products you run and verify details with the vendor before acting.
4. CVE-2026-119077: The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object…
Severity: Critical | Type: vulnerability-exploit | Industry: cross-industry
The ELEX WordPress HelpDesk & Customer Ticketing System plugin, in all versions up to and including 3.3.9, is vulnerable to PHP Object Injection with a CVSS score of 9.8. The flaw exists in the ticket_label parameter due to missing server-side authentication and a lack of a class allowlist during deserialization. Unauthenticated attackers can exploit this vulnerability to execute code on the server, relying only on a publicly emitted nonce.
Sources: NVD
Recommended actions:
- Check whether you run the affected product and apply the vendor fix when it is available.
- Prioritise internet-facing systems.
5. CVE-2026-125055: The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary…
Severity: Critical | Type: vulnerability-exploit | Industry: cross-industry
The Chatterbug Forms plugin for WordPress, in all versions up to and including 1.0.2, suffers from an arbitrary file upload vulnerability via the cbforms_check_form_submissions function. This issue arises from missing server-side file extension validation that defaults to the uploaded file’s own extension when no field restriction is configured. Consequently, unauthenticated attackers can upload executable files like PHP scripts, leading to remote code execution.
Sources: NVD
Recommended actions:
- Check whether you run the affected product and apply the vendor fix when it is available.
- Prioritise internet-facing systems.
Ongoing: previously reported
| CVE | Vendor/product | CVSS | KEV due date | First reported |
|---|---|---|---|---|
| CVE-2026-111560 | Barracuda Networks Multiple Products | 8.6 | 2026-11-13 | 2026-11-11 |
| CVE-2026-116606 | Barracuda Networks Barracuda Email Security Gateway (ESG) | 9.3 | 2026-11-13 | 2026-11-11 |
| CVE-2026-19868 | SonicWall SonicOS SSLVPN | 7.5 | 2026-11-20 | 2026-11-09 |
| CVE-2026-111793 | Openwave Messaging Limited Webtop Media Transcoder | 4.3 | 2026-11-24 | 2026-11-11 |
| CVE-2026-124194 | Microsoft Office | 6.5 | 2026-11-24 | 2026-11-11 |
| CVE-2026-125350 | Google Chromium | 8.8 | 2026-11-24 | 2026-11-10 |
| CVE-2026-20320 | Cisco BroadWorks | 7.5 | 2026-11-24 | 2026-11-11 |
Today’s action checklist
- Ransomware activity is concentrated in Manufacturing: verify offline backups, patch internet-facing edge devices and review remote-access logins.
- Pull current indicators from the linked abuse.ch and OTX pages and add them to blocklists or detection rules where relevant.
- Read the linked sources for the products you run and subscribe to vendor security notices.
Indicators
10 new ransomware victims were listed in this window.
| Sector | Victims | Most active groups |
|---|---|---|
| Manufacturing | 2 | safepay, incransom |
| Technology | 2 | Vexy Ransomware, krybit |
| Unknown | 2 | N0n, Vexy Ransomware |
| Energy & Utilities | 1 | Vexy Ransomware |
| Government & Defense | 1 | Panzer |
Raw indicators are not republished here. Pull them from the source pages.
- ThreatFox: 1761 new IOCs (view on threatfox.abuse.ch)
- URLhaus: 100 new malicious URLs (view on urlhaus.abuse.ch)
- MalwareBazaar: 14 new malware samples (view on bazaar.abuse.ch)
Sources
- CISA Known Exploited Vulnerabilities Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- CISA Cybersecurity Advisories and ICS Advisories (https://www.cisa.gov/news-events/cybersecurity-advisories)
- This product uses data from the NVD API but is not endorsed or certified by the NVD (https://nvd.nist.gov).
- EPSS scores by FIRST (https://www.first.org/epss)
- Ransomware victim data: ransomware.live (https://www.ransomware.live)
- Data: abuse.ch (URLhaus, ThreatFox, MalwareBazaar), https://abuse.ch. Used non-commercially.
- BleepingComputer (https://www.bleepingcomputer.com/feed/)
- The Hacker News (https://feeds.feedburner.com/TheHackersNews)
- SecurityWeek (https://feeds.feedburner.com/securityweek)
- The Record (https://therecord.media/feed)
- Krebs on Security (https://krebsonsecurity.com/feed/)
- NCSC UK (https://www.ncsc.gov.uk/api/1/services/v1/all-rss-feed.xml)
- CERT-EU (https://cert.europa.eu/publications/security-advisories-rss)
AI-assisted, published automatically, not human-reviewed; verify with vendors before acting.