13 Nov 2026
Week in review
Greetings,
A global widespread outage is affecting Microsoft platforms today with the company confirming a large number of its servers are unexpectedly unavailable triggering the outage. Microsoft is currently investigating the situation and working to restore the platforms. Please be mindful that this will cause interruption or errors on most Microsoft platforms including Outlook, Teams, and SharePoint.
As artificial intelligence continues to advance, the Australian Government has proposed a dedicated AI safety regulator to oversee the risks associated with advanced AI models and autonomous agents. The proposal follows a recent incident in which an AI agent accessed public and non-public files linked to a legacy Medicare data portal, highlighting the growing governance and security challenges posed by increasingly capable AI systems. Under the proposed legislation, developers of frontier AI technologies would be required to meet stricter safety obligations, including independent model testing, enhanced risk management, and timely incident reporting. The move aims to strike a balance between innovation, accountability, and the protection of critical systems and sensitive data.
Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday
Date: 2026-11-10
Author: CyberScoop
[AUSCERT has published security bulletins for these Microsoft updates]
Microsoft’s November security update addresses roughly 1,090 vulnerabilities across Windows, Office, Azure and the company’s other product lines, the second consecutive monthly release to exceed the totals of all previous years.
The release formally lists 1,094 CVEs, with Windows accounting for 726 and Office 174. A smaller number of patches went to SQL Server, Exchange Server, SharePoint Server, Azure and other products.
Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities
Date: 2026-11-11
Author: Security Week
[See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2026.14204/]
Citrix and Ivanti on Tuesday announced patches for 19 vulnerabilities in their products, including multiple critical- and high-severity flaws.
Ivanti fixed 13 vulnerabilities across five products, including two critical-severity defects in Cloud Services Application (CSA) and Endpoint Manager (EPM).
Citrix rolled out fixes for six security defects in XenServer, including CVE-2026-102705, a high-severity bug that could allow attackers to infer the Pool Secret and compromise the host.
Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation
Date: 2026-11-11
Author: The Hacker News
[See AUSCERT Bulletins: https://portal.auscert.org.au/bulletins/ESB-2026.14205/ & https://portal.auscert.org.au/bulletins/ESB-2026.14206/]
Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems.
The vulnerabilities are listed below –
CVE-2026-108186 (CVSS score: 9.6) – An improper input validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via network access.
CVE-2026-108187 (CVSS score: 8.1) – An origin validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via network access.
Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
Date: 2026-11-06
Author: The Hacker News
[See AUSCERT bulletin https://portal.auscert.org.au/bulletins/ASB-2026.0288/]
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian.
The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled, including Alpine Linux's default OpenSSH server configuration.
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
Date: 2026-11-11
Author: Bleeping Computer
ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices.
As part of its investigation, ConnectWise has disabled five third-party ScreenConnect extensions across approximately 400 partner environments as a precaution, warning that they may be associated with the attacks.
The campaign was first discovered Wednesday by cybersecurity firm Huntress, which says it has identified six compromised MSPs and 286 affected endpoints across 47 organizations, and that the number of victims continues to rise.
ASB-2026.0295 – Microsoft Office, Microsoft Office Services and Web Apps: CVSS (Max): 9.9
Microsoft has released update patches to resolve 204 vulnerabilities across several products such as Microsoft 365 Apps for Enterprise, Office LTSC, SharePoint Server and Teams. CVE-2026-124194 has also been listed on the CISA KEV as a known exploited vulnerability.
ESB-2026.14056 – Linux kernel (NVIDIA): CVSS (Max): 10.0
Several security issues were discovered in the Linux Kernel that could enable an attacker to compromise the system. A local attacker with hypervisor access could trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory.
ESB-2026.14145 – Apple iOS & iPadOS: CVSS (Max): 9.8*
Apple released updates for iOS, iPadOS and AirPlay to address vulnerabilities such as accessing sensitive user data, bypassing of rate limits on bluebooth pairing code attempts, corruption of process memory, and joining of iMessage group chats to receive messages.
ESB-2026.14206 – Zoom: CVSS (Max): 9.6
Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access. Zoom has released update patches to address this vulnerability.
ESB-2026.14234 – Adobe Connect: CVSS (Max): 10.0
Adobe has released security updates for Adobe Connect. This update addresses vulnerabilities that could result in privilege escalation, arbitrary code execution, memory exposure, and arbitrary file system read.
Stay safe, stay patched and have a good weekend!
The AUSCERT team
