Morning Threat Brief: 30-plus N-central zero-days under attack, a new Windows flaw with no patch, Xen Orchestra logins bypassed, and Maersk confirms a breach

Good morning. Attackers are already probing the 30-plus N-central zero-days a researcher dropped over the weekend, and N-able rushed out patches after taking its hosted environments offline. A new Windows privilege escalation called SignDrop has a public proof of concept and no patch, and Microsoft has not confirmed it. A single crafted cookie logs an attacker into Xen Orchestra as an admin, and the vendor confirms it is being exploited. And Maersk confirmed a breach in a legacy logistics system while the gang behind the claim demands $5 million. Patch N-central and Xen Orchestra today.

1. Hackers are probing 30-plus N-central zero-days as N-able rushes patches. Security researcher Sean Bales published details and proof-of-concept code for more than 30 vulnerabilities in N-able N-central, which he calls Able2Shell, saying he did not responsibly disclose them because he was unhappy with N-able not patching two flaws he previously reported in another product. On Monday the company took hosted N-central environments offline to investigate and develop fixes, and urged customers to disconnect on-premises deployments as well. The flaws include CVE-2026-125883, multiple XML external entity issues scored 9.3; CVE-2026-125881, a server-side request forgery flaw scored 9.3; CVE-2026-125882, a path traversal flaw that leads to remote code execution, scored 8.6; and CVE-2026-91000, missing authentication leading to privilege escalation, scored 8.4. N-able says all the vulnerabilities that could be exploited without authentication are now resolved in N-central 2026.4 HF2, with fixes prioritized by severity and exploitability. Attackers are already scanning: cybersecurity firm Defused reports anonymous agent sessions opening, appliance configuration being pulled, and the remote-control endpoint being hit without authentication. N-central is the remote monitoring tool service providers use to manage their customers' networks, so a flaw here is a flaw in all of them at once. Update to 2026.4 HF2 now, and if your N-central server was reachable from the internet, check for unexpected agent sessions and configuration changes.

2. A new Windows privilege escalation has a public proof of concept and no patch. UNVERIFIED. Researcher MSNightmare published a proof of concept on November 10 for SignDrop, a local privilege escalation in the Windows Common Log File System driver, clfs.sys. The exploit coerces the Microsoft Defender engine through an RPC method to open an attacker-prepared CLFS container, and CLFS then signs the empty container and creates a missing authentication file in a privileged context, giving the attacker SYSTEM privileges. It is a follow-on to CVE-2025-29824, the CLFS zero-day Microsoft patched in April after the Storm-2460 ransomware group used it with PipeMagic to deploy ransomware. As of November 11 there is no CVE, no advisory, and no patch, Microsoft has not confirmed the claims, and no in-the-wild exploitation has been reported. The proof of concept is public on GitHub, so assume it will be tested against real targets. There is nothing to install yet. Watch for Defender creating unexpected .cnpf authentication files and for CLFS container activity from unprivileged processes, and keep Windows fully updated so the April CLFS hardening is in place.

3. One crafted cookie logs an attacker into Xen Orchestra as an admin, and it is being exploited. Vates, the company behind Xen Orchestra, published advisory VSA-2026-062 on November 10 confirming active exploitation of a critical authentication bypass in Xen Orchestra and the Xen Orchestra Appliance. The REST interface parses a cookie named authenticationToken, and the value j:%7B%7D decodes to an empty JSON object, which the token lookup accepts without checking that it is a string. That hands the attacker the session of an existing token owner, with full administrative privileges over the virtualization management layer and the XCP-ng hosts it controls. No CVE has been assigned and no CVSS score published, so do not wait for a scanner to flag it. The fix is in Xen Orchestra 6.9.2 on the stable channel and 6.10.1 on the latest channel. Vates says a successful exploit leaves no log entry, so detection has to come from HTTP monitoring in front of the server: look for the crafted cookie value and for traffic from the campaign infrastructure, including 91.211.251.112 on port 8001 and a Tor onion service. Update today, take the management interface off the internet until you have, and hunt for rogue virtual machines and persistent cron backdoors, which the vendor ties to the campaign.

4. Maersk confirms a breach in a legacy logistics system as WhiteArmor demands $5 million. UNVERIFIED claim details. A.P. Moller-Maersk confirmed on November 11 that an attacker got into a local legacy system inherited from a past acquisition and extracted data. The company says the incident is isolated, it found no sign of impact on other Maersk systems or on customer and partner systems, and current evidence strongly suggests no sensitive data was disclosed. Maersk did not name the system, say what data was taken, say when the intrusion began, or name the attacker. The WhiteArmor ransomware gang listed Maersk on its leak site over the weekend and demanded $5 million in bitcoin within 30 days, claiming it stole about 100GB from the OCF/LF Logistics platform, including nearly 30,000 driver records, plaintext passwords, 33 SUPER_ADMIN accounts, signed delivery receipts, and 27,842 mobile device logs. None of those figures is confirmed by Maersk, and Maersk has not linked the incident to WhiteArmor at all. Maersk acquired LF Logistics from Li and Fung in 2022. If you move freight through Maersk, watch for unusual messages claiming to be from the company, and treat any password reset or document request tied to the incident as suspect until verified through a known contact.

Warning: four exploited flaws are due today, Thursday, November 12: the GPUStack flaw CVE-2026-102895, the FreeSwitch code injection CVE-2026-116779, the OpenSSH flaw CVE-2026-123158, and the IBM Aspera Faspex flaw CVE-2026-123218. SANS honeypots are already seeing exploit attempts against the OpenSSH hole. The two Barracuda flaws and the second Ivanti flaw CVE-2026-118527 are due tomorrow, Friday, November 13. The Apple KEV entry CVE-2024-27834 is due November 18, the SonicWall SSL-VPN flaw CVE-2026-19868 is due Friday, November 20, and the four new KEV entries from November 10, including the Outlook and Chrome zero-days, are due Tuesday, November 24.

Full writeups: kevinthecyberguy.com/vuln-watch
Indicators to hunt: kevinthecyberguy.com/ioc-library

No new CISA KEV entries today. The catalog stands at 1,779 entries, last updated November 10.

← kevintswaney.com