Security Digest: November 4, 2026 - 60 Critical Vulnerabilities

Today’s advisory set is dominated by remote code execution, authentication bypass, and privilege escalation flaws across enterprise software, routers, email gateways, and embedded systems. Several issues are unauthenticated and publicly exploitable, including multiple Quest Foglight for Databases flaws, NoMachine, libwebsockets, SEPPmail, and router vulnerabilities.

· 16 min read

November 4, 2026: 60 Critical Vulnerabilities Demand Immediate Action

Executive Summary

Today’s advisory set is dominated by remote code execution, authentication bypass, and privilege escalation flaws across enterprise software, routers, email gateways, WordPress plugins, and embedded systems. Several issues are unauthenticated and publicly exploitable, including multiple Quest Foglight for Databases flaws, NoMachine, libwebsockets, SEPPmail, and router vulnerabilities.

Act now: patch exposed systems first, isolate management interfaces, rotate secrets where required, and assume internet-facing deployments are at immediate risk. If you run any affected product, treat this as a same-day remediation event.

Critical Vulnerabilities

CVE-2026-114549: NoMachine nxwebrunner heap overflow RCE

  • Impact: Unauthenticated remote code execution on NoMachine via TCP 4443.
  • Affected Systems: Affected NoMachine installations.
  • Immediate Action: Remove public exposure of port 4443 and patch immediately.
  • Mitigation: Upgrade to a fixed release; restrict access to trusted networks only.

CVE-2026-92189: Quest Foglight writeTopologySectionToFile path control RCE

  • Impact: Unauthenticated SYSTEM-level code execution.
  • Affected Systems: Quest Foglight for Databases.
  • Immediate Action: Patch now and block direct internet access.
  • Mitigation: Apply vendor fixes; review service exposure and admin access paths.

CVE-2026-92190: Quest Foglight baseRmiServiceExporter deserialization RCE

  • Impact: Unauthenticated SYSTEM-level code execution.
  • Affected Systems: Quest Foglight for Databases.
  • Immediate Action: Isolate the product and patch immediately.
  • Mitigation: Upgrade and monitor for suspicious RMI activity.

CVE-2026-92188: Quest Foglight ForgeMBeanServerSupport missing auth RCE

  • Impact: Unauthenticated remote code execution as SYSTEM.
  • Affected Systems: Quest Foglight for Databases.
  • Immediate Action: Treat as internet-exploitable until proven otherwise.
  • Mitigation: Patch, restrict management traffic, and review access logs.

CVE-2026-121607: Qihoo 360 D603/D600/D606/D706 command injection

  • Impact: Remote command execution; exploit publicly available.
  • Affected Systems: Qihoo 360 D603-2, D600-2, D606-6, D706 up to 6.4.9.
  • Immediate Action: Disconnect or firewall affected devices now.
  • Mitigation: Update firmware if available; otherwise replace or isolate.

CVE-2022-29966: Emerson Ovation unauthenticated protocol access

  • Impact: Controller configuration changes or denial of service.
  • Affected Systems: Emerson Ovation deployments with unauthenticated protocols.
  • Immediate Action: Segregate OT networks and disable exposed protocols.
  • Mitigation: Apply vendor guidance and enforce strict network controls.

CVE-2026-121803: UFS FFU out-of-bounds write

  • Impact: Local code execution or denial of service with no extra privileges.
  • Affected Systems: Systems using affected UFS FFU functionality.
  • Immediate Action: Delay firmware update workflows until patched.
  • Mitigation: Install the vendor fix before enabling FFU operations.

CVE-2026-121606: Qihoo 360 firmware signature verification bypass

  • Impact: Remote compromise through improper signature checks.
  • Affected Systems: Qihoo 360 D621/D603/D600/D619/D606/D706 up to 6.4.9.
  • Immediate Action: Block remote administration and audit firmware trust chains.
  • Mitigation: Patch or retire exposed devices; validate firmware provenance.

CVE-2026-121615: Linksys E5600 improper authentication

  • Impact: Remote authentication bypass on end-of-support devices.
  • Affected Systems: Linksys E5600 1.1.0.26.
  • Immediate Action: Replace unsupported hardware now.
  • Mitigation: Segment the device and disable remote management.

CVE-2026-121609: Qihoo 360 Whole Home Router hard-coded credentials

  • Impact: Remote compromise via built-in credentials.
  • Affected Systems: Qihoo 360 Whole Home Router M5 4.0.17.1566.
  • Immediate Action: Remove from exposed networks immediately.
  • Mitigation: Replace device or isolate behind strict ACLs.

CVE-2026-114424: SEPPmail replacement text code execution

  • Impact: Unauthenticated remote code execution in mail-processing worker context.
  • Affected Systems: SEPPmail Secure Email Gateway before 15.1.1.
  • Immediate Action: Patch immediately and inspect mail rule logic.
  • Mitigation: Update to 15.1.1 or later; review active replacement rules.

CVE-2026-114425: SEPPmail LFT path trust flaw

  • Impact: File disclosure, movement, or deletion as root.
  • Affected Systems: SEPPmail Secure Email Gateway before 15.1.1 with LFT enabled.
  • Immediate Action: Disable LFT until patched.
  • Mitigation: Upgrade and review attachment metadata handling.

CVE-2026-121802: @better-auth/expo account takeover

  • Impact: Unauthenticated account email changes and takeover paths.
  • Affected Systems: @better-auth/expo before 1.7.16.
  • Immediate Action: Upgrade and rotate the application secret.
  • Mitigation: Deploy 1.7.16 or later; force secret rotation after update.

CVE-2026-120422: Sogou Input Method insecure config retrieval

  • Impact: Man-in-the-middle can deliver malicious files and trigger code execution.
  • Affected Systems: Sogou Input Method for Windows.
  • Immediate Action: Block untrusted network paths and update immediately.
  • Mitigation: Use HTTPS-only update channels and vendor-fixed builds.

CVE-2026-92192 through CVE-2026-92197: Quest Foglight authenticated RCE chain

  • Impact: Multiple authenticated paths to SYSTEM-level code execution.
  • Affected Systems: Quest Foglight for Databases.
  • Immediate Action: Patch every instance; do not rely on authentication alone.
  • Mitigation: Apply vendor updates covering installLicense, paFnUploadFileAndCreateInfo, unzipFile, loadManageServerLicense, runScript, extractAndCreateUploadInfoList, loadEvolveLicense, and renderTemplateString.

CVE-2026-16511, CVE-2026-87039, CVE-2026-87040, CVE-2026-87041, CVE-2026-87038: Zephyr RTIO/I2S/I3C kernel boundary flaws

  • Impact: Privilege escalation, memory corruption, kernel crashes, and possible code execution on CONFIG_USERSPACE builds.
  • Affected Systems: Zephyr-based systems using RTIO, I2S, or I3C features.
  • Immediate Action: Rebuild with fixed Zephyr releases and disable unnecessary subsystems.
  • Mitigation: Update to versions containing the verifier fixes; validate usermode isolation settings.

CVE-2026-104608: GitHub Enterprise Server babeld RCE

  • Impact: SSH-authenticated attacker can run commands as babeld and expose secrets.
  • Affected Systems: GitHub Enterprise Server before 3.23 and related fixed releases.
  • Immediate Action: Patch immediately and review SSH access.
  • Mitigation: Upgrade to 3.22.3, 3.21.8, 3.20.10, or 3.19.14 as applicable.

CVE-2026-84730: ASUS router stack overflow

  • Impact: Nearby attacker can execute commands as root.
  • Affected Systems: Certain ASUS Router firmware.
  • Immediate Action: Update router firmware and limit physical proximity risks.
  • Mitigation: Apply ASUS security update guidance for AiCloud-related exposure.

CVE-2026-110022: PFI plugin framework unsigned DLL overwrite

  • Impact: Full compromise through malicious plugin code loading.
  • Affected Systems: Affected PFI plugin framework deployments.
  • Immediate Action: Review plugin packages and block untrusted archives.
  • Mitigation: Patch and verify package signing covers all extracted files.

CVE-2026-111036 and CVE-2026-111038: Coupa Supplier Portal SSRF and CSV injection

  • Impact: Internal network probing, data disclosure, and possible client-side command execution.
  • Affected Systems: Coupa Supplier Portal SaaS document conversion and export features.
  • Immediate Action: Restrict template editing and inspect exported files before opening.
  • Mitigation: Apply vendor remediation and harden external resource handling.

CVE-2026-118623, CVE-2026-118627, CVE-2026-118628: MLflow artifact and explainer flaws

  • Impact: SSRF, information disclosure, and deserialization-based RCE.
  • Affected Systems: MLflow deployments using get-artifacts, PickleEvaluationArtifact, or SHAP load_explainer.
  • Immediate Action: Restrict untrusted model/artifact inputs and patch immediately.
  • Mitigation: Upgrade MLflow, disable unsafe artifact loading, and review network egress.

CVE-2026-92211: OpenUSD crate parsing double free

  • Impact: Remote code execution through malicious USD files.
  • Affected Systems: Pixar Animation Studio OpenUSD consumers.
  • Immediate Action: Treat inbound USD/USDZ files as hostile.
  • Mitigation: Update the library and sandbox file processing.

CVE-2026-92199 and CVE-2026-92200: Quest Foglight local privilege escalation

  • Impact: SYSTEM-level escalation from low-privileged local access.
  • Affected Systems: Quest Foglight for Databases.
  • Immediate Action: Patch endpoints and review local admin exposure.
  • Mitigation: Fix hard-coded keys and incorrect folder permissions.

CVE-2026-118623, CVE-2026-118627, CVE-2026-118628, CVE-2026-92185, CVE-2026-92198: template/XML disclosure risks

  • Impact: Internal file and network data exposure.
  • Affected Systems: MLflow and Quest Foglight components using template or XML parsing.
  • Immediate Action: Disable untrusted input paths and patch immediately.
  • Mitigation: Enforce parser hardening and outbound request controls.

CVE-2026-120554: WordPress Import and export users and customers privilege escalation

  • Impact: Authenticated attackers can escalate to Administrator.
  • Affected Systems: Plugin versions up to 2.5.11.
  • Immediate Action: Update plugin and review cron settings.
  • Mitigation: Patch, verify role permissions, and audit prior admin saves.

CVE-2026-121731 and CVE-2026-121730: emailflare key abuse and sender spoofing

  • Impact: API key takeover, mail sending as any domain, and integration disruption.
  • Affected Systems: emailflare before commit cf31f33.
  • Immediate Action: Rotate keys and restrict inbox API access now.
  • Mitigation: Deploy the fixed commit and audit all issued keys.

CVE-2025-11229: scope authorization bypass

  • Impact: Client credentials can gain unauthorized scopes and administrative access.
  • Affected Systems: Deployments with authorize_all_scopes enabled.
  • Immediate Action: Disable the setting unless absolutely required.
  • Mitigation: Review OAuth policy and constrain scope grants.

Additional WordPress XSS issues include CVE-2026-119477, CVE-2026-57666, CVE-2026-119366, CVE-2026-54851, CVE-2026-57639, CVE-2026-54861, CVE-2026-62007, and CVE-2026-115498. These are lower than the RCE group but still require fast patching because they can be used for session theft, admin takeover, or malicious redirects.

What to Do Now

  1. Patch exposed systems first: NoMachine, Quest Foglight, SEPPmail, GitHub Enterprise Server, MLflow, router firmware, and any internet-facing WordPress instances.
  2. Isolate management services: Remove direct internet access to admin ports, RMI services, email gateways, and router management interfaces.
  3. Rotate credentials and secrets: Especially for @better-auth/expo, emailflare API keys, and any systems touched by suspected exploitation.
  4. Replace unsupported devices: Linksys E5600 and other end-of-support hardware should be retired, not just patched.
  5. Verify build and runtime exposure: Check whether Zephyr systems use CONFIG_USERSPACE, RTIO, I2S, or I3C, and confirm fixed builds are deployed.

Verification steps: inventory affected products, confirm versions against vendor advisories, review logs for unusual authentication, file writes, RMI traffic, SSH activity, and suspicious mail rule changes, and validate that patching did not break critical workflows.

Monitoring recommendations: watch for new admin accounts, unexplained service crashes, outbound connections from mail and database servers, unexpected firmware or plugin updates, and unusual API key creation or revocation events.

Related Resources

  • Internal: Refer to the pending internal incident-response brief and patch-triage blog post for this advisory set.
  • Official vendor advisories: NoMachine, Quest, SEPPmail, GitHub, ASUS, Emerson, Coupa, MLflow, and Zephyr project security notices.

Keep reading