This edition leads with a major round of patches from Citrix: NetScaler ADC and Gateway receive updates for a series of critical memory flaws, one of which affects every installation, including in the default configuration. In addition, N-able’s hotfix for N-central has proved insufficient, as a new exploit is already being used against patched servers. Elsewhere, Ivanti fixes a critical SQL injection flaw in Endpoint Manager, a public exploit is available for an unpatched Windows flaw that grants SYSTEM privileges, and attackers are using a fake Teams scheduler to take over Microsoft 365 accounts via device code phishing.
- Citrix fixes critical flaws in NetScaler ADC, Gateway and Console
- N-able N-central: new exploit bypasses hotfix and is now being actively exploited
- Critical SQL injection flaw in Ivanti Endpoint Manager enables takeover without login
- SignDrop: public exploit for unpatched Windows flaw grants SYSTEM privileges
- Attackers disguise device code phishing as Teams meeting scheduler
Citrix fixes critical flaws in NetScaler ADC, Gateway and Console
| Vulnerability | A series of memory flaws in NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, ADC 14.1-FIPS before 14.1-73.58 FIPS and 13.1-FIPS/NDcPP before 13.1-37.293. In addition, an authentication bypass in NetScaler Console 14.1 before 14.1-74.34 and privilege escalation in the Secure Access Client for Windows and Linux |
| CVE number | Including CVE-2026-120868 (all installations), CVE-2026-107412 (Gateway and AAA), CVE-2026-120869 (Console), CVE-2026-118268 and CVE-2026-118269 (Secure Access Client) |
| CVSS score | 9.3 (CVE-2026-120868), 9.5 (CVE-2026-107412), 9.4 (CVE-2026-120869), 8.5 (Secure Access Client) |
| Actively exploited | No, as of 12 November Citrix is not aware of any exploitation and there is no confirmed public proof of concept |
| Patch available | Yes: ADC and Gateway 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS and 13.1-37.293; Console 14.1-74.34; Secure Access Client Windows 26.11.1.6 and Linux 26.10.4 |
How can the vulnerability be exploited?
On 12 November, Cloud Software Group published bulletins covering a total of 28 memory errors in NetScaler ADC and Gateway, according to CERT-EU. The most serious flaw lies in the core packet processing: it requires no login and no special feature, so every installation is at risk. A second set of overflows can be reached without authentication on appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN or RDP Proxy) or as an AAA server. Other flaws depend on features such as SAML, LDAP, Email OTP, Endpoint Analysis, DNS-over-HTTPS and HTTP/2. In NetScaler Console, an attacker can bypass the authentication check without logging in, reports The Hacker News. According to Citrix, the fixes stem from a deeper review of the code using AI-assisted analysis; those who reported the flaws include researchers from watchTowr, among others, according to the Citrix bulletin.
What could the consequences be?
Citrix describes the impact as unpredictable behaviour and denial of service. For memory overflows in an appliance at the edge of the network, that is a worrying picture: previous NetScaler flaws were exploited shortly after disclosure, and a Gateway outage brings an entire organisation’s remote access to a standstill. The flaw in the Secure Access Client allows an ordinary user on a workstation to obtain SYSTEM or root privileges.
What should IT administrators do now?
Update all self-managed NetScaler ADC and Gateway appliances to the patched builds, starting with the devices exposed to the internet as a Gateway or AAA server. Citrix-managed cloud services are updated by the vendor itself. Place NetScaler Console in an isolated management network and patch it at the same time, and roll out the new Secure Access Client to workstations. The Dutch NCSC has published its own advisory on the updates.
N-able N-central: new exploit bypasses hotfix and is now being actively exploited
| Vulnerability | ‘4EverAble2Shell’: a combination of an Apache Axis flaw and a privilege escalation in N-central that allows an attacker to gain root privileges on on-premises N-central servers without logging in, including on 2026.4 Hotfix 2 (build 2026.4.1.26). Requires the Legacy API to be enabled. According to N-able, hosted environments are not affected |
| CVE number | CVE-2026-90436 (Apache Axis); no CVE has been assigned to the privilege escalation in N-central (Previdian: VULN-2026-0009) |
| CVSS score | 9.8 (CVE-2026-90436) |
| Actively exploited | Yes, since 09:16 UTC on 12 November; that day Huntback counted 21 servers running a cryptominer, 19 of which were already on Hotfix 2 |
| Patch available | No, N-able is working on additional fixes. Mitigation: disable the Legacy API (off by default); N-able has disabled the Intune integration |
How has this been exploited?
In Thursday’s Patchwork we reported that N-able had released a hotfix for the leaked zero-days in N-central. That same day, researcher Sean Bales published new exploits that also work against that hotfix. According to Huntback, the exploit appeared at 03:58 UTC and the first successful attack with root escalation followed at 09:16 UTC. By 12:50 UTC, 21 N-central servers were mining for the attackers, in countries including the US, the UK, Germany, France and Sweden. BleepingComputer reports that Previdian also observed the attacks. According to the researcher, a second exploit, ‘Agent2Shell’, can make managed Windows agents execute as SYSTEM, provided the attacker knows the appliance ID, writes The Hacker News.
What could the consequences be?
For now, the attackers are installing an XMRig miner. With root on the RMM server, however, the way is open to every managed customer environment.
What should IT administrators do now?
Check immediately that the Legacy API is disabled and update agents and probes in line with the earlier hotfix instructions. Look for POST requests to /dms/services/ServerUI containing jline.internal.TerminalLineSettings, for /tmp/.xvd or /var/tmp/.xvd, a systemd service xvd.service, /etc/cron.d/xvd and connections to 157.20.241[.]16. Treat any hit as a full compromise of the server.
Critical SQL injection flaw in Ivanti Endpoint Manager enables takeover without login
| Vulnerability | SQL injection in the Core of Ivanti Endpoint Manager (EPM) before 2024 SU8, which can lead to remote code execution without login. In addition, the EPM agent in the same versions transmits sensitive data unencrypted |
| CVE number | CVE-2026-121653 (SQL injection), CVE-2026-18128 (unencrypted agent traffic) |
| CVSS score | 9.8 (CVE-2026-121653) |
| Actively exploited | No, as of 12 November Ivanti is not aware of any exploitation |
| Patch available | Yes, EPM 2024 SU8 |
How can the vulnerability be exploited?
According to the NCSC advisory, a remote attacker can inject malicious SQL commands into the EPM Core without logging in, potentially resulting in the execution of arbitrary code. The second flaw lies in the agent: it sends sensitive information unencrypted, allowing an attacker in a man-in-the-middle position to intercept, read and modify HTTP traffic. Details are available in Ivanti’s security advisory.
What could the consequences be?
Organisations use EPM to manage laptops, smartphones and servers and to distribute software and updates, notes Dutch site Security.nl. A compromised EPM server therefore gives an attacker a channel to all managed devices. EPM has been targeted by attacks on several occasions in the past.
What should IT administrators do now?
Update EPM to 2024 SU8, both the Core and the agents. Make sure the EPM server is not unnecessarily reachable from the internet and check the Core logs for unusual database requests.
SignDrop: public exploit for unpatched Windows flaw grants SYSTEM privileges
| Vulnerability | Local privilege escalation via the authentication mitigation of the Common Log File System (CLFS) driver in Windows. Tested on Windows 11 26H2 and Windows Server 2025 (Experimental); the researcher estimates that around 80 per cent of Windows installations are vulnerable |
| CVE number | No CVE assigned |
| Actively exploited | No, not reported; the proof of concept has been publicly available on GitHub since 12 November |
| Patch available | No, Microsoft has not yet released an update or workaround |
How can the vulnerability be exploited?
Researcher Abdelhamid Naceri, known as Nightmare Eclipse, published the exploit without notifying Microsoft beforehand, reports BleepingComputer. The flaw lies in the mitigation that Microsoft added to CLFS in October 2025. The access check is correct when a log file is created, but a privileged process such as Windows Defender can later be forced to open the file, after which an authentication file with SYSTEM privileges is created. According to The Hacker News, the researcher claims the technique can also bypass the tamper protection of security software.
What could the consequences be?
An attacker who can already execute code as an ordinary user, for example via a phishing attachment, can escalate to full control of the system. With a ready-made exploit on GitHub, the barrier to exploitation is low.
What should IT administrators do now?
Check the registry value HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode: according to the researcher, a value of 0 or 1 means the system is vulnerable. Do not disable the CLFS mitigation, as this would make systems vulnerable to older memory attacks again. Keep your EDR alert to suspicious processes obtaining SYSTEM privileges and roll out the update as soon as Microsoft releases it.
Attackers disguise device code phishing as Teams meeting scheduler
| Vulnerability | Abuse of Microsoft 365 device code sign-in via a fake ‘Microsoft Teams Meeting Scheduler’, in which the device code is presented as a booking reference. This is abuse of existing functionality; no software bug is involved |
| CVE number | No CVE assigned |
| Actively exploited | Yes, observed by Huntress at a construction company in October 2026 and described on 12 November |
| Patch available | No, not applicable. Mitigation: restrict device code sign-in with Conditional Access and enforce phishing-resistant MFA |
How has this been exploited?
According to Huntress (Andrea Hatcher, Matt Poto and Lindsey O’Donnell-Welch), an employee received an email from a typosquatted domain impersonating a director at another construction company. The link led via Microsoft Safe Links and a Google short link to a replica Teams scheduler. After a time slot was selected, the page’s back end requested a genuine Microsoft device code and displayed it as a ‘Booking Reference’. The code was copied to the clipboard and a pop-up opened the legitimate Microsoft sign-in page. By entering the code there, the victim approved the attacker’s session. The victim then landed on a Calendly page. If an MFA error occurred, the kit automatically started a new session, and the phishing page was encrypted so that scanners without JavaScript saw nothing, reports Help Net Security.
What could the consequences be?
The attacker obtained a valid session token for the Microsoft 365 account and signed in via a residential proxy, making the traffic look like ordinary consumer traffic. This allows access to email and files without the password being known.
What should IT administrators do now?
Block or restrict the device code flow with Conditional Access in tenants where it is not needed, and enforce phishing-resistant MFA. Search the sign-in logs for programmatic user agents such as python-requests and node, for sign-ins from unmanaged devices and residential proxies, and for Cmsi:Cmsi sign-ins to the Microsoft Authentication Broker. In the event of a suspected breach, check for new MFA methods, unknown devices, app consents and suspicious mailbox rules.
This article was originally published in Dutch on MSP Business. Read the original →
