← Back to Vulnerability Reports

Vulnerability Priority Report – Week 2 of November 2026

📅 November 9 – 15•🟢 Live · updated 2026-11-09•32 CVEs tracked this week

Analyst Guidance

This week's priority is two actively exploited vulnerabilities: OpenSSH SSHole (CVE-2026-123158) affecting Linux systems with musl libc and PAM disabled, and. organizations should cross-reference internal asset inventories against CISA's catalog to identify exposure. WordPress patch installation carries a transient exploitation window during file extraction.

CVE Details & Remediation

How to read this report
Verified facts — NVD & CISA KEV Partially verified — awaiting NVD enrichment AI analysis — synthesis, verify before acting
Actionable · Verified facts
NVD-published · CISA KEV cross-checked

🛡️CVE-2026-97229 – GitLab Community Edition And Enterprise Edition ✓ NVD

CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS65% · P99
ActionPatch immediately
AffectedGovernment

Remediation Steps

  1. Review CISA Known Exploited Vulnerabilities Catalog entry for product details
  2. Identify all instances of affected software in enterprise inventory
  3. Apply vendor patch or deploy compensating controls
  4. Validate remediation and update asset management records

References:

🛡️CVE-2026-105134 – Ahsay AhsayCBS ✓ NVD

CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS82% · P100
ActionPatch immediately
AffectedGovernment Technology

Remediation Steps

  1. Apply the vendor security update for Ahsay AhsayCBS as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-114625 – Arista VeloCloud Orchestrator ✓ NVD

CVSS9.9 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS1% · P64
ActionPatch immediately
AffectedTechnology Government Defense

Remediation Steps

  1. Apply the vendor security update for Arista VeloCloud Orchestrator as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-109618 – PHP Group PHP ✓ NVD

CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV
EPSS100% · P100
ActionPatch immediately
AffectedTechnology

Remediation Steps

  1. Apply the vendor security update for PHP Group PHP as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-102764 – BeyondTrust Remote Support ✓ NVD

CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS78% · P100
ActionPatch immediately
AffectedTechnology Government

Remediation Steps

  1. Apply the vendor security update for Beyondtrust Remote Support as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-76519 – Cisco Secure Email Gateway ✓ NVD

CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS6% · P94
ActionPatch immediately
AffectedTechnology Government Finance

Remediation Steps

  1. Apply the vendor security update for Cisco Secure Email Gateway as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-111497 – Google Brotli ✓ NVD

CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS83% · P100
ActionPatch immediately
AffectedRetail Technology Education

Remediation Steps

  1. Apply the vendor security update for Google Brotli as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-110447 – Collabora Online – Built-In CODE Server ✓ NVD

CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS73% · P99
ActionPatch immediately

Remediation Steps

  1. Apply the vendor patch for Collabora Online Built-in CODE Server immediately
  2. Verify patch application and restart affected services
  3. Monitor logs for signs of exploitation attempts
  4. Restrict access to Collabora Online instances to trusted networks if patching is delayed

References:

🛡️CVE-2026-48356 – Adobe Commerce And Magento ✓ NVD

CVSS9.3 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS47% · P99
ActionPatch immediately

Remediation Steps

  1. Consult CISA's Known Exploited Vulnerabilities Catalog for affected product details
  2. Identify systems running vulnerable versions
  3. Apply vendor-supplied security updates
  4. Verify patch installation and test system functionality

References:

🛡️CVE-2026-96951 – Microsoft Windows ✓ NVD

CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS10% · P96
ActionPatch immediately
AffectedTechnology Finance

Remediation Steps

  1. Apply the vendor security update for Microsoft Windows as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-104935 – Ivanti Connect Secure ✓ NVD

CVSS8.6 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS89% · P100
ActionPatch immediately
AffectedTechnology

Remediation Steps

  1. Apply the vendor security update for Ivanti Connect Secure as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-76418 – Cisco Secure Firewall ASA Software And Cisco Secure FTD Software ✓ NVD

CVSS8.6 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS1% · P58
ActionPatch immediately

Remediation Steps

  1. Apply the vendor security update for Cisco Secure Firewall ASA Software And Cisco Secure FTD Software as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-119977 – WordPress Core ✓ NVD

CVSS8.1 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV
EPSS1% · P67
ActionPatch immediately

Remediation Steps

  1. Cross-reference CVE-2026-119977 against CISA's Known Exploited Vulnerabilities catalog for affected product and version details
  2. Determine applicability to your environment
  3. Apply vendor patch per CISA advisory guidance

References:

🛡️CVE-2026-109619 – PHP Group PHP ✓ NVD

CVSS8.1 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV
EPSS100% · P100
ActionPatch immediately
AffectedTechnology

Remediation Steps

  1. Apply the vendor security update for PHP Group PHP as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-46300 – Linux Kernel ✓ NVD

CVSS7.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS16% · P97
ActionPatch immediately
AffectedGovernment Technology

Remediation Steps

  1. Apply the vendor security update for Linux Kernel as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-106931 – EG Secure Solutions SiteGuard Server Edition ✓ NVD

CVSS7.8 NVD 3.0
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS3% · P85
ActionPatch immediately
AffectedTechnology Government

Remediation Steps

  1. Apply the vendor security update for SiteGuard WAF Server Edition as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-19868 – SonicWall SonicOS SSLVPN ✓ NVD

CVSS7.5 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV
EPSS1% · P50
ActionPatch immediately

Remediation Steps

  1. Cross-reference CVE-2026-19868 against CISA's Known Exploited Vulnerabilities catalog for affected product and version details
  2. Determine applicability to your environment
  3. Apply vendor patch per CISA advisory guidance

References:

🛡️CVE-2026-21589 – Atlassian Multiple Products ✓ NVD

CVSS7.5 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS100% · P100
ActionPatch immediately

Remediation Steps

  1. Locate CISA Known Exploited Vulnerabilities Catalog entry for CVE-2026-21589
  2. Identify affected products in your environment
  3. Apply vendor-supplied patches or workarounds as directed
  4. Monitor for exploitation attempts

References:

🛡️CVE-2026-105133 – Ahsay AhsayCBS ✓ NVD

CVSS7.3 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS84% · P100
ActionPatch immediately

Remediation Steps

  1. Apply the vendor security update for Ahsay AhsayCBS as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-96656 – Plex Media Server ✓ NVD

CVSS7.2 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS2% · P78
ActionPatch immediately
AffectedTechnology Media

Remediation Steps

  1. Apply the vendor security update for Plex Media Server as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-0322 – Palo Alto Networks PAN-OS ✓ NVD

CVSS7.2 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS2% · P78
ActionPatch immediately
AffectedGovernment Technology

Remediation Steps

  1. Apply the vendor security update for Palo Alto Networks PAN-OS as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-111357 – Ivanti Connect Secure ✓ NVD

CVSS7 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV
EPSS1% · P45
ActionPatch immediately

Remediation Steps

  1. Cross-reference CVE-2026-111357 against CISA's Known Exploited Vulnerabilities catalog for affected product and version details
  2. Determine applicability to your environment
  3. Apply vendor patch per CISA advisory guidance

References:

🛡️CVE-2026-110936 – Siemens Software Center ✓ NVD

CVSS6.7 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS1% · P62
ActionPatch immediately

Remediation Steps

  1. Apply the vendor security update for Siemens Software Center as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-96654 – Plex Media Server ✓ NVD

CVSS6.5 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS2% · P80
ActionPatch immediately
AffectedTechnology Media

Remediation Steps

  1. Apply the vendor security update for Plex Media Server as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2025-61624 – Fortinet Multiple Products ✓ NVD

CVSS6.5 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS1% · P72
ActionPatch immediately

Remediation Steps

  1. Consult CISA Known Exploited Vulnerabilities catalog entry for affected product details and remediation guidance
  2. Prioritize patching based on CISA's recommended timeline
  3. Monitor systems for active exploitation activity
  4. Implement network segmentation to limit exposure if patching cannot be deployed immediately

References:

🛡️CVE-2024-27834 – Apple Multiple Products ✓ NVD

CVSS5.5 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV
EPSS2% · P74
ActionPatch immediately

Remediation Steps

  1. Cross-reference CVE-2024-27834 against CISA's Known Exploited Vulnerabilities catalog for affected product and version details
  2. Determine applicability to your environment
  3. Apply vendor patch per CISA advisory guidance

References:

🛡️CVE-2026-118527 – Ivanti Connect Secure ✓ NVD

CVSS4.3 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS1% · P58
ActionPatch immediately
AffectedTechnology Finance

Remediation Steps

  1. Apply the vendor security update for Ivanti Connect Secure as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-96652 – Plex Media Server ✓ NVD

CVSS4.3 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS12% · P96
ActionPatch immediately
AffectedTechnology Media

Remediation Steps

  1. Apply the vendor security update for Plex Media Server as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-96655 – Plex Media Server ✓ NVD

CVSS4.3 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS11% · P96
ActionPatch immediately
AffectedTechnology Media

Remediation Steps

  1. Apply the vendor security update for Plex Media Server as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-41709 – Broadcom VMware ESX ✓ NVD

CVSS2.7 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS1% · P53
ActionPatch immediately

Remediation Steps

  1. Consult CISA Known Exploited Vulnerabilities Catalog for affected product details
  2. Apply vendor-supplied security patch
  3. Verify patch deployment across all affected systems

References:

🛡️CVE-2026-123158 – OpenSSH (Linux systems with musl libc and PAM disabled) ✓ NVD

CVSS8.1 NVD 3.1
Triage statusNo Known Exploit
ExploitationNo exploitation reported
EPSS1% · P63
ActionPatch this week

Remediation Steps

  1. Identify all Linux systems running OpenSSH on musl C library with Pluggable Authentication Modules (PAM) disabled
  2. Apply OpenSSH patch immediately to affected systems
  3. Restart OpenSSH service after patching
  4. Verify passwordless accounts and review SSH access logs for unauthorized sign-in attempts

References:

🛡️CVE-2026-83844 – Microsoft Paint ✓ NVD

CVSS7 NVD 3.1
Triage statusNo Known Exploit
ExploitationNo exploitation reported ● New this week
EPSS<1% · P33
ActionPatch this week

Remediation Steps

  1. Open Microsoft Store application on affected Windows systems
  2. Navigate to Microsoft Paint app page
  3. Update to build 11.2609.401.0 or later if available
  4. Verify Paint update completion before resuming normal use

References:

🤖 This vulnerability report was compiled by defend.network using AI-powered analysis of vulnerability databases, vendor advisories, and threat intelligence feeds. Always verify remediation steps through official vendor channels before implementing changes in production environments.

Get Vulnerability Priority Updates

Subscribe free and stay on top of critical patches.