{"id":228,"date":"2026-11-05T07:43:35","date_gmt":"2026-11-05T06:43:35","guid":{"rendered":"https:\/\/mspbusiness.com\/en\/it-news\/patchwork-thursday-5-november\/"},"modified":"2026-11-05T07:45:06","modified_gmt":"2026-11-05T06:45:06","slug":"patchwork-thursday-5-november","status":"publish","type":"post","link":"https:\/\/mspbusiness.com\/en\/security\/patchwork-thursday-5-november\/","title":{"rendered":"Patchwork \u2013 Thursday 5 November"},"content":{"rendered":"<p id=\"top\"><strong>This edition focuses on a critical Linux kernel flaw for which scanning has already been observed, a Metabase flaw with a CVSS score of 10.0 that is being actively exploited, and a campaign using stolen Entra app secrets at clients of MSPs. In addition, SonicWall is leaving its GMS management software unprotected, and the previously patched Zyxel GS1900 flaw turns out to have been exploited for months.<\/strong><\/p>\n<ul>\n<li><a href=\"#linux\">Linux kernel: critical TCP flaw grants remote root, scanning for vulnerable servers observed<\/a><\/li>\n<li><a href=\"#metabase\">Metabase: critical SQL injection flaw grants admin access and is being actively exploited<\/a><\/li>\n<li><a href=\"#entra\">Stolen Entra app secrets: attacker signs in as workload at clients of MSPs<\/a><\/li>\n<li><a href=\"#sonicwall\">SonicWall GMS: critical flaw in end-of-life management software, no patch coming<\/a><\/li>\n<li><a href=\"#zyxel\">Zyxel GS1900: now actively exploited, nearly 1,000 switches hacked<\/a><\/li>\n<\/ul>\n<h4 id=\"linux\">Linux kernel: critical TCP flaw grants remote root, scanning for vulnerable servers observed<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Race condition in the IPv4 TCP stack of the Linux kernel (use-after-free when freeing the IPv4 options of an incoming connection). The known exploit works on servers with a listening service that uses a Multipath TCP (MPTCP) socket<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-98432<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">9.8<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Not yet confirmed. Researcher Marcus Hutchins has, however, observed an attacker who appears to be scanning for vulnerable servers (4 November 2026)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, upstream in versions including 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113 and 6.18.56. Distributions are shipping their own kernel updates; Ubuntu still had no patch as of 4 November<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How can the vulnerability be exploited?<\/strong><\/p>\n<p>According to Dutch security news site <a href=\"https:\/\/www.security.nl\/posting\/960326\" target=\"_blank\" rel=\"noopener\">Security.nl<\/a>, an attacker can use specially crafted packets to execute commands as root on a server with an MPTCP listener, without credentials or user interaction. Anthropic has reported a working exploit. Debian and other distributions enable MPTCP by default, and software built with Go 1.24 or later binds MPTCP sockets by default, so even services you would not expect can provide the required listening endpoint. Hutchins counted around 2.1 million Linux servers reachable via MPTCP on port 443, of which around 763,000 completed a full TLS connection.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>An attacker can take full control of a vulnerable server from the internet. For MSPs and hosting providers, this concerns web servers, reverse proxies and Go services at clients. According to <a href=\"https:\/\/www.akamai.com\/blog\/security-research\/cve-2026-98432-remote-uaf-linux-kernels-tcp-stack\" target=\"_blank\" rel=\"noopener\">Akamai<\/a>, the underlying bug is not specific to MPTCP, so systems without an MPTCP listener are not necessarily safe.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Install your distribution&#8217;s kernel update and reboot, then check the running kernel version. Ubuntu does not yet have a patch, so keep an eye on Canonical&#8217;s tracker. If patching is not yet possible, disable MPTCP on listening services (Akamai cites the sysctl net.mptcp.enabled = 0) and restrict access to trusted sources. This is a temporary measure: Red Hat states that none of the mitigations it tested is an adequate substitute for patching. See also the <a href=\"https:\/\/www.n-able.com\/blog\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know\" target=\"_blank\" rel=\"noopener\">explanation from N-able<\/a>.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"metabase\">Metabase: critical SQL injection flaw grants admin access and is being actively exploited<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Unauthenticated SQL injection in Metabase (open source and Enterprise), allowing an attacker to gain admin access to the instance. Affected: 0.58.0 to 0.58.24, 0.59.0 to 0.59.21, 0.60.0 to 0.60.17, 0.61.0 to 0.61.11, 0.62.0 to 0.62.9 and 0.63.0 to 0.63.5, plus the corresponding 1.x branches<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-72898<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">10.0<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, according to Singapore&#8217;s CSA (4 November 2026); a public proof of concept is available<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5 or later (and the 1.x equivalents). Temporary workaround: block access to \/api\/session\/reset_password<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>According to the alert from the <a href=\"https:\/\/www.csa.gov.sg\/alerts-and-advisories\/alerts\/al-2026-158\/\" target=\"_blank\" rel=\"noopener\">Cyber Security Agency of Singapore<\/a>, an attacker without an account can execute arbitrary SQL on Metabase&#8217;s application database and thereby become an administrator. A working example exploit is publicly available, making copycat attacks easy.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>Metabase is often connected directly to client databases for reporting and dashboards. With admin access, an attacker can reach the stored connections and the data behind them. Metabase is also frequently self-hosted and sometimes exposed directly to the internet.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Update to a patched version immediately. If you cannot update right away, block the \/api\/session\/reset_password endpoint. After updating, revoke active sessions, check admin accounts and API keys, rotate the database credentials connected to Metabase and search the logs for suspicious activity.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"entra\">Stolen Entra app secrets: attacker signs in as workload at clients of MSPs<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Abuse of stolen application secrets from app registrations in Microsoft Entra ID, allowing an attacker to sign in as the application to Microsoft 365 and Azure environments without a user. Not a software bug<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No CVE assigned<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, discovered by Todyl and, according to the report of 4 November 2026, still ongoing; Huntress is assisting with the investigation<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, it is not a software flaw. The report does not specify fixed measures; administrators must rotate secrets and review sign-in activity themselves<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/www.cybersecuritydive.com\/news\/attacker-microsoft-entra-id-downstream-msp\/873744\/\" target=\"_blank\" rel=\"noopener\">Cybersecurity Dive<\/a>, the attacker targeted 45 app registrations at around 18 organisations, at least 33 of which were signed into successfully. According to Huntress, the activity comes from a single operator using a server in Poland. Around 95 per cent of the sign-ins were scripted, with bursts of 24 logins in 10 seconds. Todyl describes the campaign in its <a href=\"https:\/\/www.todyl.com\/blog\/stolen-app-credentials-real-access-an-actor-is-signing-into-entra-id-and-azure-devops-as-your-workloads\" target=\"_blank\" rel=\"noopener\">own report<\/a>. The credentials were reportedly harvested before 1 November. No direct link to the earlier ConnectWise campaign has been found.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>The attacker gained access to 27 organisations, including downstream clients of MSPs in energy, government, food and agriculture, transport and construction. Searches were carried out in 25 tenants, 81 files were downloaded and around 2,300 mailbox items were accessed.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Take stock of the app registrations and service principals in the tenants you manage, rotate client secrets and certificates where they may have been leaked, and audit service principal sign-ins for logins from unknown IP addresses. Consider Conditional Access for workload identities and the use of certificates or managed identities instead of secrets.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"sonicwall\">SonicWall GMS: critical flaw in end-of-life management software, no patch coming<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Unauthenticated file read in SonicWall Global Management System (GMS), the management software for SonicWall firewalls. According to BleepingComputer, GMS 9.5.2 and earlier are affected; there is also a post-authentication SQL injection (CVE-2026-109594, CVSS 6.8)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-109593 (advisory SNWLID-2026-0019)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">9.1<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Not reported<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, GMS has been end-of-life since 30 September 2026. SonicWall recommends migrating to Network Security Manager (NSM)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How can the vulnerability be exploited?<\/strong><\/p>\n<p>An attacker without credentials can read sensitive files on the GMS system via the management interface, according to <a href=\"https:\/\/www.security.nl\/posting\/960405\" target=\"_blank\" rel=\"noopener\">Security.nl<\/a>. SonicWall does not specify which data is involved. See also the report from <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/sonicwall-warns-of-unpatched-flaws-in-end-of-life-gms-software\/\" target=\"_blank\" rel=\"noopener\">BleepingComputer<\/a> and the <a href=\"https:\/\/psirt.global.sonicwall.com\/vuln-detail\/SNWLID-2026-0019\" target=\"_blank\" rel=\"noopener\">SonicWall advisory<\/a>.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>GMS manages firewalls for multiple clients from a single location. Anyone who can read files there may be able to obtain configurations and credentials for the managed devices. Because no patch is coming, every GMS installation remains vulnerable.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Plan the migration to NSM, and in the meantime take GMS off the internet or restrict access to a management network. Rotate passwords and keys stored in GMS if the system was reachable from the internet.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"zyxel\">Zyxel GS1900: now actively exploited, nearly 1,000 switches hacked<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Out-of-bounds write in the web management interface of ten Zyxel GS1900 switch models, allowing an unauthenticated attacker to execute OS commands via specially crafted HTTP requests<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-107441<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, according to GreyNoise since around 17 August 2026; 996 devices in 48 countries compromised<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, firmware dated 22 October 2026; install the latest firmware<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>In the <a href=\"https:\/\/mspbusiness.com\/security-en-privacy\/patchwork-dinsdag-3-november\/\" target=\"_blank\" rel=\"noopener\">Patchwork of Tuesday 3 November<\/a> we reported the patch for this flaw. What is new is that the flaw has been exploited on a large scale as a zero-day since August.<\/p>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches\/\" target=\"_blank\" rel=\"noopener\">BleepingComputer<\/a>, GreyNoise observed a suspected Chinese-speaking actor, tracked as Kapibala, executing commands on switches from mid-August and then downloading a script that collected configurations, hashed root credentials and network information. GreyNoise initially linked this to a previously patched flaw. Binarly found an open archive containing an exploit that bypassed the earlier patches, and reported the flaw to Zyxel on 29 September.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>An attacker gains command execution on the network device and can exfiltrate configurations and credentials, enabling lateral movement through the client&#8217;s network.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Install the latest firmware on all GS1900 switches, take the web interface off the internet and check devices that were exposed before 22 October for signs of intrusion. Rotate management passwords after a suspected compromise.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Critical Linux kernel flaw being scanned for, Metabase flaw actively exploited, stolen Entra app secrets at MSP clients, unpatched SonicWall GMS and Zyxel GS1900 switches hacked en masse.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"mspb_bron_id":1169567,"mspb_url_nl":"https:\/\/mspbusiness.com\/security-en-privacy\/patchwork-donderdag-5-november\/","mspb_url_de":"https:\/\/mspbusiness.com\/de\/security\/patchwork-donnerstag-5-november\/","mspb_url_en":"","mspb_beeld_url":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-P.png","mspb_beeld_klein":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-P-400x225.png","mspb_auteur":"Redactie","mspb_beeld_alt":"","mspb_video":"","_yoast_wpseo_metadesc":"Linux kernel CVE-2026-98432 and Metabase: critical flaws, Entra app secrets stolen, SonicWall GMS unpatched and Zyxel switches hacked en masse.","footnotes":""},"categories":[3],"tags":[],"layout":[6],"class_list":["post-228","post","type-post","status-publish","format-standard","hentry","category-security","layout-news"],"_links":{"self":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/comments?post=228"}],"version-history":[{"count":1,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/228\/revisions"}],"predecessor-version":[{"id":229,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/228\/revisions\/229"}],"wp:attachment":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/media?parent=228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/categories?post=228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/tags?post=228"},{"taxonomy":"layout","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/layout?post=228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}