#5 · 2026-11-12 · Severity: Critical
Threat types: vulnerability-exploit · Industries: technology
Verified status
| CVE | CVSS | Vendor/product | Exploitation | References |
|---|---|---|---|---|
| CVE-2026-110697 | 9.9 | — | None known | NVD |
| CVE-2026-123710 | 9.8 | — | None known | NVD |
| CVE-2026-76954 | 9.8 | — | None known | NVD |
| CVE-2026-108186 | 9.6 | — | None known | NVD |
| CVE-2026-118383 | 9.5 | — | None known | NVD |
| CVE-2026-126325 | 9.2 | — | Reported by source | NVD |
| CVE-2026-119618 | N/A | — | None known | NVD |
Checked against NVD and CISA KEV on 2026-11-12.
TL;DR
- Top story: PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution
- Also notable: Critical Xen Orchestra Flaws Exploited in Attacks; CVE-2026-110697: A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from…
- No new CISA KEV entries in the last 24 hours
Executive summary
Over the past 24 hours, threat activity reached an overall critical level driven by significant vulnerabilities and threat intelligence data. Critical flaws were identified across multiple platforms, including patches from PTC for Windchill and FlexPLM to address remote code execution risks, and actively exploited critical flaws in Xen Orchestra. Additional critical SQL vulnerability advisories were recorded for Red Hat Quay, including CVE-2026-110697, CVE-2026-123710, and CVE-2026-76954. Concurrently, telemetry tracked extensive indicator activity involving hundreds of ThreatFox entries, dozens of MalwareBazaar samples, URLhaus URLs, multiple news items, and ransomware victims.
Top threats
1. PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution
Severity: Critical | Type: vulnerability-exploit | Industry: technology
PTC has released security patches for a critical vulnerability affecting its Windchill and FlexPLM software. The flaw, tracked as CVE-2026-126325, stems from improper input validation and the deserialization of untrusted data. Successful exploitation of this vulnerability could lead to remote code execution.
Sources: The Hacker News
Recommended actions:
- Check the linked report for products you run and verify details with the vendor before acting.
2. Critical Xen Orchestra Flaws Exploited in Attacks
Severity: Critical | Type: vulnerability-exploit | Industry: cross-industry
According to SecurityWeek, critical authentication bypass flaws in Xen Orchestra are being exploited in attacks. The vulnerability allows attackers to execute arbitrary code as an administrator and take over XCP-ng nodes.
Sources: SecurityWeek
Recommended actions:
- Check the linked report for products you run and verify details with the vendor before acting.
3. CVE-2026-110697: A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from…
Severity: Critical | Type: vulnerability-exploit | Industry: cross-industry
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their…
Sources: NVD
Recommended actions:
- Check whether you run the affected product and apply the vendor fix when it is available.
- Prioritise internet-facing systems.
4. CVE-2026-123710: A flaw was found in Red Hat Quay.
Severity: Critical | Type: vulnerability-exploit | Industry: cross-industry
A critical flaw with a CVSS score of 9.8 has been identified in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with a controlled audience and present it to the service key rotation endpoint to install an unexpired signing key. This allows the attacker to gain read and write access to private images and replace repository tags.
Sources: NVD
Recommended actions:
- Check whether you run the affected product and apply the vendor fix when it is available.
- Prioritise internet-facing systems.
5. CVE-2026-76954: An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in…
Severity: Critical | Type: vulnerability-exploit | Industry: cross-industry
A critical SQL injection vulnerability exists in the Auth API of Synology DiskStation Manager (DSM), carrying a CVSS score of 9.8. Remote attackers can exploit this flaw to read or write arbitrary files on affected systems. The vulnerability impacts multiple DSM versions prior to the provided patched releases and can also lead to denial-of-service attacks.
Sources: NVD
Recommended actions:
- Check whether you run the affected product and apply the vendor fix when it is available.
- Prioritise internet-facing systems.
Ongoing: previously reported
| CVE | Vendor/product | CVSS | KEV due date | First reported |
|---|---|---|---|---|
| CVE-2026-102895 | GPUStack GPUStack | 9.8 | 2026-11-12 | 2026-11-10 |
| CVE-2026-116779 | SignalWire FreeSwitch | 9.8 | 2026-11-12 | 2026-11-10 |
| CVE-2026-123158 | OpenBSD OpenSSH | 8.1 | 2026-11-12 | 2026-11-10 |
| CVE-2026-123218 | IBM Aspera Faspex | 9.8 | 2026-11-12 | 2026-11-10 |
| CVE-2026-111560 | Barracuda Networks Multiple Products | 8.6 | 2026-11-13 | 2026-11-11 |
| CVE-2026-116606 | Barracuda Networks Barracuda Email Security Gateway (ESG) | 9.3 | 2026-11-13 | 2026-11-11 |
| CVE-2026-19868 | SonicWall SonicOS SSLVPN | 7.5 | 2026-11-20 | 2026-11-09 |
| CVE-2026-111793 | Openwave Messaging Limited Webtop Media Transcoder | 4.3 | 2026-11-24 | 2026-11-11 |
| CVE-2026-124194 | Microsoft Office | 6.5 | 2026-11-24 | 2026-11-11 |
| CVE-2026-125350 | Google Chromium | 8.8 | 2026-11-24 | 2026-11-10 |
Today’s action checklist
- Ransomware activity is concentrated in Unknown: verify offline backups, patch internet-facing edge devices and review remote-access logins.
- Pull current indicators from the linked abuse.ch and OTX pages and add them to blocklists or detection rules where relevant.
- Read the linked sources for the products you run and subscribe to vendor security notices.
Indicators
18 new ransomware victims were listed in this window.
| Sector | Victims | Most active groups |
|---|---|---|
| Unknown | 6 | N0n, medusalocker, Doommageddon |
| Healthcare | 4 | Curious Worm |
| Education | 2 | qilin |
| Professional Services | 2 | Curious Worm |
| Technology | 2 | Barracuda, Curious Worm |
Raw indicators are not republished here. Pull them from the source pages.
- ThreatFox: 1119 new IOCs (view on threatfox.abuse.ch)
- URLhaus: 100 new malicious URLs (view on urlhaus.abuse.ch)
- MalwareBazaar: 30 new malware samples (view on bazaar.abuse.ch)
Sources
- CISA Known Exploited Vulnerabilities Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- CISA Cybersecurity Advisories and ICS Advisories (https://www.cisa.gov/news-events/cybersecurity-advisories)
- This product uses data from the NVD API but is not endorsed or certified by the NVD (https://nvd.nist.gov).
- EPSS scores by FIRST (https://www.first.org/epss)
- Ransomware victim data: ransomware.live (https://www.ransomware.live)
- Data: abuse.ch (URLhaus, ThreatFox, MalwareBazaar), https://abuse.ch. Used non-commercially.
- BleepingComputer (https://www.bleepingcomputer.com/feed/)
- The Hacker News (https://feeds.feedburner.com/TheHackersNews)
- SecurityWeek (https://feeds.feedburner.com/securityweek)
- The Record (https://therecord.media/feed)
- Krebs on Security (https://krebsonsecurity.com/feed/)
- NCSC UK (https://www.ncsc.gov.uk/api/1/services/v1/all-rss-feed.xml)
- CERT-EU (https://cert.europa.eu/publications/security-advisories-rss)
AI-assisted, published automatically, not human-reviewed; verify with vendors before acting.