{"id":335,"date":"2026-11-14T07:47:16","date_gmt":"2026-11-14T06:47:16","guid":{"rendered":"https:\/\/mspbusiness.com\/en\/it-news\/patchwork-saturday-14-november\/"},"modified":"2026-11-14T07:49:28","modified_gmt":"2026-11-14T06:49:28","slug":"patchwork-saturday-14-november","status":"publish","type":"post","link":"https:\/\/mspbusiness.com\/en\/security\/patchwork-saturday-14-november\/","title":{"rendered":"Patchwork &#8211; Saturday 14 November"},"content":{"rendered":"<p id=\"top\"><strong>This edition leads with an actively exploited zero-day in Check Point gateways. Attackers got in through the Mobile Access portal, escalated their privileges to root and, at some of the victims, also wiped ESXi hosts. In addition, fake sessions bearing the names of crypto exchanges are appearing on more than a hundred self-hosted ScreenConnect servers, the Dutch NCSC is warning about critical flaws in Zoom Workplace for Windows, and an unpatched flaw in Tactical RMM allows attackers to send commands to every managed agent.<\/strong><\/p>\n<ul>\n<li><a href=\"#checkpoint\">Check Point gateways taken over via zero-day: attackers gain root and wipe ESXi hosts<\/a><\/li>\n<li><a href=\"#screenconnect\">Fake sessions with crypto exchange names on more than a hundred self-hosted ScreenConnect servers<\/a><\/li>\n<li><a href=\"#zoom\">NCSC warns of critical flaws in Zoom Workplace for Windows<\/a><\/li>\n<li><a href=\"#tacticalrmm\">Unpatched flaw in Tactical RMM gives access to all managed agents<\/a><\/li>\n<\/ul>\n<h4 id=\"checkpoint\">Check Point gateways taken over via zero-day: attackers gain root and wipe ESXi hosts<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Local privilege escalation to root in the DynamicCLI daemon (dynamic_server) of Gaia OS. Affected products are Check Point Security Gateway, Security Management Server, Multi-Domain Security Management, Scalable Platforms and Maestro Orchestrator, versions R81 up to and including R82.20<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-123039 (initial access via the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">7.8<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, at a few dozen Check Point customers, since 30 October 2026. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 13 November<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, hotfixes via sk1000362, including in R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174. Temporary workaround: stop the dynamic_server process and prevent it from restarting<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/research.checkpoint.com\/2026\/php2shell-exploitation-on-check-point-gateway\/\" target=\"_blank\" rel=\"noopener\">research by Check Point Research<\/a>, the attackers got in through the PHP2Shell flaws in the Mobile Access portal, roughly a week after an update for them had been released. From the portal&#8217;s service account, they then used the new zero-day to gain root. The DynamicCLI daemon runs as root and listens on a local socket that any process is allowed to write to, without checking who is connecting. A first wave on 30 October hit Israeli organisations; a second on 2 November was broader and affected organisations in several countries and sectors. According to <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/check-point-patches-zero-day-that-lets-hackers-get-root-access\/\" target=\"_blank\" rel=\"noopener\">BleepingComputer<\/a>, Check Point saw the exploitation at &#8216;a couple of dozen customers&#8217;.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>After the takeover, the attackers deployed webshells, the TSGA backdoor with its TSProxy proxy component, and the gogo scanner. At some of the victims from the first wave, they moved on via SSH using the vpxuser account to a VMware ESXi host and ran the destroy_v6 wiper, which overwrites files with zeros and then deletes them. According to <a href=\"https:\/\/thehackernews.com\/2026\/11\/hackers-exploit-php2shell-flaws-in.html\" target=\"_blank\" rel=\"noopener\">The Hacker News<\/a>, TSGA and TSProxy resemble components of the PhiliKit toolkit that ESET previously linked to a Chinese group. Check Point considers the evidence too thin to attribute the campaign to that group.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Install the hotfix from sk1000362 on gateways and management servers, and check that the PHP2Shell updates for Mobile Access have also been installed. If you cannot patch yet, stop dynamic_server and prevent the process from restarting; note that this disables the DynamicCLI commands. On the gateway, look for zz*.tpl files in the portal&#8217;s template folder, for \/lib\/libcpfwcommon.so, for slot_CPconfigdaemon and for an unknown listener on TCP port 11072. Check ESXi hosts for SSH logins using vpxuser and block the IP addresses 130.94.19.204 and 130.94.19.168. Germany&#8217;s <a href=\"https:\/\/wid.cert-bund.de\/portal\/wid\/securityadvisory?name=WID-SEC-2026-4562\" target=\"_blank\" rel=\"noopener\">CERT-Bund<\/a> has compiled a list of the patched versions.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"screenconnect\">Fake sessions with crypto exchange names on more than a hundred self-hosted ScreenConnect servers<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Abuse of publicly downloadable guest installers from self-hosted ConnectWise ScreenConnect servers. An automated client registers as a fake endpoint with names such as KUCOIN-SRV and LAPTOP-BINANCE. Presumably bait for technicians running an unpatched ScreenConnect client<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No CVE assigned for the fake sessions. The presumed target is CVE-2026-84869 in the technician client<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, fake sessions since 3 November 2026 on at least 118 servers at 109 organisations (Huntress, 13 November). No malicious activity has yet been observed from the sessions<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, for CVE-2026-84869: update technician clients to 26.6.5 or later. Temporary alternative: revoke the TransferFiles permission. The fake sessions themselves must be cleaned up manually<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>In <a href=\"https:\/\/www.huntress.com\/blog\/fake-crypto-exchange-sessions-screenconnect\" target=\"_blank\" rel=\"noopener\">an analysis<\/a>, Huntress researcher John Hammond describes how an MSP asked about unknown machines in its own ScreenConnect console. On closer inspection, thousands of fake sessions turned out to have been created since 3 November, with more than a thousand different names combining a crypto exchange with a role, such as SRV-BINANCE or BACKUP-PROBIT. Almost 98 per cent of the connections came from a single IP address at hosting provider IONOS. Huntress does not cite a software flaw as the cause: the guest installer contains the server&#8217;s relay address and can be downloaded without logging in by default. On the first server investigated, the Access installer had already been retrieved by an online scanning service in mid-October. The campaign is unrelated to the <a href=\"https:\/\/mspbusiness.com\/security-en-privacy\/patchwork-donderdag-12-november\/\" target=\"_blank\" rel=\"noopener\">SCKit attacks on customers of six MSPs<\/a>; Huntress found no overlap in indicators.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>The fake sessions did not send any files or execute any commands. They do, however, remain visible as online, because the attacker reconnects roughly every hour. Huntress&#8217;s main hypothesis is that they are meant to lure technicians into opening a session. Via CVE-2026-84869, a malicious guest can make an unpatched technician client execute files, possibly with elevated privileges. In a few cases technicians did open such a session, and one of them sent text twice. Huntress is treating that as potentially leaked credentials.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Update all technician clients to 26.6.5 or later, including affected Access agents. Make a copy of App_Data\\Session.db and the associated WAL file before deleting fake sessions, and check the session history to see whether anyone opened one. Look for new guest sessions with client version 25.3.4.9288 or an empty public key, and for large numbers of new guests from 74.208.158.106. Keep installer links private, rebuild installers that may have leaked and agree with technicians that they will not open any session they cannot link to a customer.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"zoom\">NCSC warns of critical flaws in Zoom Workplace for Windows<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Two flaws in Zoom Workplace for Windows that allow an attacker without an account to gain elevated privileges over the network: insufficient input validation in versions 7.1.0 to 7.1.8 and an origin validation error in versions prior to 7.1.5<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-108186 and CVE-2026-108187<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">9.6 (CVE-2026-108186) and 8.1 (CVE-2026-108187)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, according to the NCSC (13 November 2026) no exploitation is known<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, Zoom Workplace for Windows 7.1.8 or later fixes both flaws<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How could the vulnerability be exploited?<\/strong><\/p>\n<p>On 10 November, Zoom published the bulletins <a href=\"https:\/\/www.zoom.com\/en\/trust\/security-bulletin\/ZSB-26023\" target=\"_blank\" rel=\"noopener\">ZSB-26023<\/a> and <a href=\"https:\/\/www.zoom.com\/en\/trust\/security-bulletin\/ZSB-26024\" target=\"_blank\" rel=\"noopener\">ZSB-26024<\/a>. The most serious flaw lies in the Windows client&#8217;s input validation and allows an attacker to escalate their privileges over the network without logging in. According to the CVSS vector, this does require user interaction. The second flaw is an error in validating the origin of requests. The <a href=\"https:\/\/www.ncsc.nl\/alerts\/kwetsbaarheden-in-zoom-workplace-voor-windows-update-nu\" target=\"_blank\" rel=\"noopener\">NCSC issued a separate alert on 13 November<\/a>, rating the likelihood of exploitation as medium and the potential damage as high.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>According to the NCSC, an attacker could use the privileges obtained to, for example, change settings or access sensitive information. Zoom runs on many workstations managed by MSPs, often in a version that users either update themselves or simply leave as it is.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Roll out Zoom Workplace for Windows 7.1.8 or later via your RMM or software distribution tool. If you are using a version prior to 7.1.5, you are vulnerable to both flaws. Also check workstations where users have installed Zoom themselves and disabled automatic updates.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"tacticalrmm\">Unpatched flaw in Tactical RMM gives access to all managed agents<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Arbitrary file read via the \/reporting\/templates\/preview\/ endpoint in AmidaWare&#8217;s Tactical RMM, versions 0.17.0 up to and including 1.6.1. Requires an account with permission to manage reports<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-129165<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">9.4 (CVSS 4.0, VulnCheck)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, no exploitation is known and the flaw is not listed in CISA&#8217;s KEV catalogue (13 November 2026)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, the latest version, 1.6.1, falls within the affected range and no patched version has yet been announced. Restrict the permission to manage reports<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How could the vulnerability be exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/www.vulncheck.com\/advisories\/tactical-rmm-0.17.0-through-1.6.1-arbitrary-file-read-via-report-preview\" target=\"_blank\" rel=\"noopener\">VulnCheck&#8217;s advisory<\/a>, which disclosed the flaw on 13 November, the reporting feature processes the user-supplied template with WeasyPrint. WeasyPrint follows file:\/\/ links in the template and embeds the contents of local files in the PDF that is returned. This allows a user with reporting permissions to read the server&#8217;s Django SECRET_KEY. The flaw was discovered by researcher Wu Yulun.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>Tactical RMM uses the same SECRET_KEY as the password for the NATS messaging server. With that key, an attacker can publish runscript commands to every managed agent. An account with limited permissions thus becomes a route to code execution on all endpoints of all customers in the environment.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Until a patched version is available, grant the permission to manage reports only to accounts that genuinely need it, and check which accounts currently hold that permission. Keep an eye on the <a href=\"https:\/\/github.com\/amidaware\/tacticalrmm\/releases\" target=\"_blank\" rel=\"noopener\">Tactical RMM releases page<\/a> and install the update as soon as it is available. If you have reason to believe that an account with reporting permissions has been misused, consider replacing the SECRET_KEY and, with it, the NATS password.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Check Point gateways taken over via a zero-day, fake sessions appear on ScreenConnect servers, the Dutch NCSC warns about Zoom Workplace and Tactical RMM has an unpatched flaw.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"mspb_bron_id":1169674,"mspb_url_nl":"https:\/\/mspbusiness.com\/security-en-privacy\/patchwork-zaterdag-14-november\/","mspb_url_de":"https:\/\/mspbusiness.com\/de\/security\/patchwork-samstag-14-november\/","mspb_url_en":"","mspb_beeld_url":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-P.png","mspb_beeld_klein":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-P-400x225.png","mspb_auteur":"Redactie","mspb_beeld_alt":"","mspb_video":"","_yoast_wpseo_metadesc":"Check Point zero-day exploited to reach ESXi hosts, fake ScreenConnect sessions, critical Zoom flaws and an unpatched Tactical RMM bug.","footnotes":""},"categories":[3],"tags":[],"layout":[6],"class_list":["post-335","post","type-post","status-publish","format-standard","hentry","category-security","layout-news"],"_links":{"self":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/335","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/comments?post=335"}],"version-history":[{"count":1,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/335\/revisions"}],"predecessor-version":[{"id":336,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/335\/revisions\/336"}],"wp:attachment":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/media?parent=335"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/categories?post=335"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/tags?post=335"},{"taxonomy":"layout","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/layout?post=335"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}