CISA adds Ivanti Connect Secure zero-days to KEV catalog

Why it matters.Lightweight container base images like Alpine Linux run across thousands of microservices and pipelines. When library error codes match lockout tokens, locked accounts permit remote password logins. Platform engineers running Alpine containers must update OpenSSH packages and restart the SSH daemon immediately. Security teams should enforce key authentication across bastions to neutralize password handling flaws.

• Vulnerability mechanics: Tracked as CVE-2026-123158, the defect occurs when OpenSSH invokes the musl crypt function for accounts without usable password hashes.
• Password parsing defect: When submitted passwords exceed 256 bytes, musl returns an asterisk error value that matches the asterisk lockout placeholder in shadow files.
• Affected distributions: The weakness impacts Linux distributions utilizing musl libc without PAM enabled, notably standard Alpine Linux container and server images.
• Remediation release: Maintainers published OpenSSH Portable 10.6p2 and backported distribution packages, advising teams without immediate patch access to disable password authentication.

Why it matters.Server management platforms coordinate compute clusters and hardware fabric configurations across private cloud facilities. When management consoles allow low-privilege users to traverse paths and run system commands, compromised employee credentials yield infrastructure control. Data center engineers must apply official Cisco UCS Central updates across all management appliances immediately. Security operations teams should review HTTP request logs for directory traversal signatures around management endpoints.

• Vulnerability mechanics: Tracked as CVE-2026-76506 with a CVSS score of 7.6, insufficient input validation in HTTP requests permits path traversal within web management interfaces.
• Exploitation impact: Authenticated remote attackers with valid low-privilege credentials can execute arbitrary operating system commands and write files across the filesystem.
• Information leakage: Exploitation allows attackers to read sensitive configuration files and exfiltrate internal system telemetry from managed server pools.
• Remediation status: Cisco released software updates addressing the defect, confirming that no configuration workarounds exist to mitigate vulnerable deployments.

Why it matters.Smart managed network switches direct local network traffic and enforce VLAN isolation across enterprise offices. When network switch web interfaces harbor unauthenticated remote command execution flaws, attackers gain root privileges without passing edge firewalls. Network engineers must flash Patch 3 firmware updates across all GS1900 switches immediately. Infrastructure teams should remove administrative management consoles from public internet routing and enforce dedicated management VLANs.

• Vulnerability mechanics: Tracked as CVE-2026-107441 with a CVSS score of 8.8, an out-of-bounds write defect in the web management CGI interface permits unauthenticated remote code execution.
• Active in-the-wild exploitation: Threat intelligence revealed threat actors exploited the flaw to compromise nearly 1,000 switches across dozens of countries to harvest configuration records.
• Patch bypass context: The campaign evaded earlier June 2026 patches because the underlying vulnerable code path remained unaddressed in intermediate firmware releases.
• Remediation release: Zyxel published Patch 3 firmware updates across 10 switch models, urging operators to restrict administrative web consoles from public routing.

Why it matters.Machine learning pipelines automatically unpack datasets and pretrained model weights during distributed training runs. When archive extraction routines permit link-based directory traversal, untrusted model files overwrite system binaries and execution hooks. Machine learning engineers should upgrade GluonTS dependencies to version 0.17.0 across training containers. Platform teams must enforce read-only container root filesystems to prevent malicious archive extractions from modifying runtime binaries.

• Vulnerability mechanics: Tracked as CVE-2026-119083, the flaw occurs when GluonTS processes untrusted tar archive packages containing symbolic or hard link targets.
• Exploitation risk: Applications ingesting machine learning model artifacts or dataset archives can permit attackers to overwrite arbitrary files outside intended extraction directories.
• Affected packages: The vulnerability impacts GluonTS releases prior to version 0.17.0 across time-series forecasting and deep learning modeling pipelines.
• Remediation release: AWS published GluonTS 0.17.0 with strict link sanitization, recommending that machine learning engineers upgrade client and server dependencies.

Why it matters.Virtualization hypervisors enforce hardware isolation between tenant virtual machines across multi-tenant hosting environments. When guest breakouts allow virtual machines to breach hypervisor boundaries, shared cloud infrastructure loses physical tenant isolation guarantees. Systems administrators operating XenServer clusters must apply latest channel updates across hosts and management appliances immediately. Network engineers should segment hypervisor management networks onto isolated out-of-band administration switches.

• Vulnerability mechanics: Tracked as CVE-2026-98432 and CVE-2026-102703, the defects allow management network compromises and guest virtual machine breakouts.
• Host compromise risk: Privileged users inside guest virtual machines can escape hypervisor isolation boundaries to execute code on the underlying virtualization host.
• Management plane exposure: Unauthenticated attackers with management network reachability can compromise XenServer hosts and associated workload balancing appliances.
• Affected platforms: The issues impact XenServer 8.4, XenServer 9, Workload Balancing versions prior to 2026.1.1, and Conversion Manager versions prior to 2026.2.0.

Why it matters.Enterprise resource planning platforms coordinate customer records, warehouse inventory, and internal accounting databases. When public web endpoints permit server-side request forgery, remote adversaries leverage internal server trust to harvest cloud metadata credentials. Enterprise software engineers must upgrade Apache OFBiz deployments to version 24.09.08 immediately. Infrastructure teams should configure local firewall egress filters to block internal service engines from querying cloud metadata IP addresses.

• Vulnerability mechanics: Tracked as CVE-2026-81828 and CVE-2026-71901, the defects affect the SurveyWrapper component and Sales Force Automation vCard import functions.
• Request forgery impact: Unauthenticated remote attackers can exploit SurveyWrapper to force server-side HTTP requests against internal cloud metadata endpoints and databases.
• Unauthorized service execution: Authenticated users manipulating vCard import parameters can override authorization controls to dispatch arbitrary internal business services.
• Remediation release: Maintainers released Apache OFBiz 24.09.08 to resolve both flaws, advising organizations to retire older installations immediately.

Why it matters.Mobile operating systems provide foundational communication and authentication channels for workforce personnel and field operations. When telephony parsing components harbor zero-click crash defects, adversaries can remotely disable employee devices and two-factor authentication channels. Mobile fleet administrators should enforce automated distribution of security patch level 2026-11-05 across enterprise devices. Systems engineers must prepare out-of-band communication protocols for incident responders during cellular service denial events.

• Vulnerability mechanics: Tracked as CVE-2026-58882, the defect resides in the WAP Push SMS packet decoding routine within the Android operating system framework.
• Zero-click exploitation: Remote attackers knowing a target device phone number can deliver malformed SMS packets that crash telephony services without user interaction.
• Emergency impact: Successful exploitation drops active voice connections, disrupts emergency 911 calling capabilities, and can force devices into recurring reboot cycles.
• Remediation release: Google published operating system patches across security patch levels 2026-11-01 and 2026-11-05, urging carriers and vendors to expedite updates.