Security Digest: November 11, 2026 - 38 Critical Vulnerabilities

November 11, 2026 brings a broad wave of high-risk flaws across CMS platforms, .NET/ASP.NET Core, mail servers, WordPress plugins, and enterprise management tools. Several issues allow unauthenticated remote code execution, authentication bypass, or full admin takeover; others enable stored XSS, privilege escalation, or service-wide denial of service.

· 22 min read

Urgent Security Digest: 38 Critical Vulnerabilities Demand Immediate Action

November 11, 2026 brings a broad wave of high-risk flaws across CMS platforms, .NET/ASP.NET Core, mail servers, WordPress plugins, and enterprise management tools. Several issues allow unauthenticated remote code execution, authentication bypass, or full admin takeover; others enable stored XSS, privilege escalation, or service-wide denial of service. If you run any affected product, patch now and assume active exploitation will follow quickly.

Immediate priority: update exposed internet-facing services first, then internal platforms, and verify no self-contained .NET apps or bundled packages were missed.

Critical Vulnerabilities

  • CVE-2026-64682: AstroBlocks admin session forgery
    • Impact: Attackers can forge owner sessions and take over the CMS.
    • Affected Systems: AstroBlocks prior to 3.4.0.
    • Immediate Action: Upgrade to 3.4.0 immediately and rotate all session/JWT secrets.
    • Mitigation: Treat any exposed instance as compromised until patched and tokens are invalidated.
  • CVE-2026-126261: Fortinet FortiManager FGFM code execution
    • Impact: Unauthenticated attackers reaching the FGFM port may execute code or commands.
    • Affected Systems: FortiManager 8.0.0; 7.6.0-7.6.7; 7.4.0-7.4.5; 7.2.0-7.2.8.
    • Immediate Action: Patch immediately and restrict FGFM access to trusted management networks only.
    • Mitigation: Block FGFM at firewalls until remediation is complete.
  • CVE-2026-64678: Nitrite deserialization to RCE
    • Impact: Crafted legacy database files can trigger unsafe deserialization and potential code execution.
    • Affected Systems: Nitrite prior to 4.4.1.
    • Immediate Action: Upgrade to 4.4.1 and inspect any database files from untrusted sources.
    • Mitigation: Do not open legacy stores on systems with high-value classpath gadgets until patched.
  • CVE-2026-126187: React Server Components remote code execution
    • Impact: Crafted payloads can trigger unauthenticated RCE in affected React Server Components stacks.
    • Affected Systems: react-server-dom-webpack, -parcel, and -turbopack in affected React 19 releases.
    • Immediate Action: Update to the fixed versions: 19.0.9, 19.1.10, 19.2.9, or 19.3.1.
    • Mitigation: If you do not use React Server Components, confirm your framework/plugin path is not pulling in the vulnerable packages.
  • CVE-2026-112174: Iperius Backup local privilege escalation
    • Impact: Local users can launch programs that inherit elevated context, up to SYSTEM.
    • Affected Systems: Iperius Backup 8.8.3.
    • Immediate Action: Remove or restrict local access and update to a fixed release as soon as available.
    • Mitigation: Avoid running the GUI/service persistently with Administrator privileges until patched.
  • CVE-2026-64670: Waline stored XSS into moderator sessions
    • Impact: A single edit click by an admin can execute attacker HTML in the moderator’s session.
    • Affected Systems: Waline 3.15.2 and earlier.
    • Immediate Action: Apply a vendor fix when released; until then, limit comment editing privileges and review moderation workflows.
    • Mitigation: Treat attacker-controlled comments as active payloads.
  • CVE-2026-126542: AVideo authentication bypass via social login display names
    • Impact: Attackers can log in as arbitrary users, including admins.
    • Affected Systems: WWBN AVideo 6.5 through 29.7.1.
    • Immediate Action: Patch immediately and disable/limit social login paths if possible.
    • Mitigation: Review admin accounts and recent logins for impersonation.
  • CVE-2026-126539: Directus WebSocket authorization bypass
    • Impact: Unauthenticated attackers can read and modify collections in public-mode WebSocket connections.
    • Affected Systems: Directus before 12.1.0.
    • Immediate Action: Upgrade to 12.1.0 or later and restrict public WebSocket exposure.
    • Mitigation: Assume data exposure if public-mode sockets were reachable.
  • CVE-2026-12062: ManageEngine ADAudit Plus SQL injection
    • Impact: Authenticated attackers can inject SQL through Reports API.
    • Affected Systems: ADAudit Plus below build 8703.
    • Immediate Action: Upgrade immediately and review API access logs.
    • Mitigation: Restrict authenticated access until patched.
  • CVE-2026-126617: hMailServer SQL injection
    • Impact: Remote attackers can alter SQL statements and potentially execute follow-on database actions.
    • Affected Systems: hMailServer 6.0.0-B1 through 6.2.18 on MySQL/MariaDB or PostgreSQL.
    • Immediate Action: Patch and rotate database credentials.
    • Mitigation: Treat mail server database access as exposed if those engines are in use.
  • CVE-2026-76981: ADAudit Plus second-order SQL injection
    • Impact: Stored input can later trigger SQL injection in custom reports.
    • Affected Systems: ADAudit Plus below build 8711.
    • Immediate Action: Upgrade and review custom report content.
    • Mitigation: Clear suspicious stored report data.
  • CVE-2026-126541: AVideo live stream key theft
    • Impact: Authenticated streamers can steal other users’ stream keys and restream private content.
    • Affected Systems: WWBN AVideo through 29.7.1.
    • Immediate Action: Patch and audit live plugin permissions.
    • Mitigation: Revoke exposed stream tokens.
  • CVE-2026-111190: ARForms arbitrary file upload
    • Impact: Unauthenticated attackers may upload PHP and gain code execution.
    • Affected Systems: ARForms up to 7.2.4 with publicly accessible file-upload forms.
    • Immediate Action: Disable public file fields and update immediately.
    • Mitigation: Check web roots for unexpected uploads.
  • CVE-2026-126607: hMailServer plugin path DLL hijack
    • Impact: Local authenticated users can execute code as the service account.
    • Affected Systems: hMailServer 6.2.3 through 6.3.7 on Windows with MySQL/MariaDB.
    • Immediate Action: Upgrade to 6.3.8 and review install paths for non-ASCII characters.
    • Mitigation: Restrict local write access near drive roots and service folders.
  • CVE-2026-114146: ASP.NET Core SignalR identity confusion
    • Impact: Injected messages can execute Hub actions as another user.
    • Affected Systems: Affected ASP.NET Core runtime/package versions across .NET 8-11.
    • Immediate Action: Upgrade to the fixed runtime/package versions listed by Microsoft, then redeploy.
    • Mitigation: Restarting alone is not enough for self-contained apps.
  • CVE-2026-105948: Octopus Server privilege escalation
    • Impact: Users can gain elevated permissions, including admin access.
    • Affected Systems: Octopus Server with LDAP and self-service login editing enabled.
    • Immediate Action: Disable self-service login editing and apply the vendor update.
    • Mitigation: Review all LDAP-linked accounts for privilege drift.
  • CVE-2026-114158: .NET out-of-bounds write via crafted Portable PDB
    • Impact: Crafted PDBs can trigger memory corruption on Windows.
    • Affected Systems: .NET 8.0-11.0 on Windows and affected runtime packs/SDKs.
    • Immediate Action: Update runtimes and SDK feature bands to Microsoft’s patched releases.
    • Mitigation: Rebuild and redeploy self-contained apps.
  • CVE-2026-114159: .NET PDB document name heap write
    • Impact: Crafted PDBs can cause a heap out-of-bounds write.
    • Affected Systems: Same Windows .NET versions and SDK bands as above.
    • Immediate Action: Patch all Windows .NET installations now.
    • Mitigation: Update Visual Studio-hosted SDKs too.
  • CVE-2026-118745: .NET native PDB line metadata corruption
    • Impact: Malicious PDB line metadata can corrupt memory during symbol reading.
    • Affected Systems: Microsoft.DiaSymReader.Native on Windows and bundled .NET releases.
    • Immediate Action: Upgrade runtimes/SDKs to the fixed versions.
    • Mitigation: Redeploy any self-contained apps using affected native readers.
  • CVE-2026-114151: .NET LF_DECIMAL stack write
    • Impact: Crafted PDB constants can trigger stack corruption.
    • Affected Systems: Affected .NET Windows releases and SDKs.
    • Immediate Action: Patch immediately and restart affected processes.
    • Mitigation: Do not rely on machine-wide runtime updates alone for embedded runtimes.
  • CVE-2026-114152: .NET COFF relocation out-of-bounds write
    • Impact: Attacker-influenced object files can corrupt memory during PDB processing.
    • Affected Systems: Affected .NET Windows releases and SDKs.
    • Immediate Action: Update all Windows .NET runtimes and SDK bands.
    • Mitigation: Rebuild any distributed self-contained binaries.
  • CVE-2026-96414: Octopus Server cookie integrity weakness
    • Impact: Users may escalate to Administrator.
    • Affected Systems: Octopus Server deployments with impacted auth-cookie handling.
    • Immediate Action: Apply the vendor fix and invalidate authentication cookies.
    • Mitigation: Audit audit-log and user-view permissions.
  • CVE-2026-126613: hMailServer JSON resource exhaustion
    • Impact: Attackers can exhaust memory and block mail delivery, REST, and webmail.
    • Affected Systems: hMailServer 6.3.2 through 6.3.7.
    • Immediate Action: Patch and rate-limit or disable exposed report and reply flows where possible.
    • Mitigation: Watch for large decompressed JSON payloads.
  • CVE-2026-126621: hMailServer TLS file name confusion
    • Impact: Local attackers may hijack CA trust, intercept mail, or steal private keys.
    • Affected Systems: hMailServer 6.0.0-B1 through 6.3.7 on Windows.
    • Immediate Action: Patch and verify all TLS-related file paths are ASCII-safe.
    • Mitigation: Remove writable folders that shadow configured certificate paths.
  • CVE-2026-114149: ASP.NET Core multipart resource exhaustion
    • Impact: Attackers can bypass header-count limits and consume server resources.
    • Affected Systems: Affected ASP.NET Core runtime/package versions across .NET 8-11.
    • Immediate Action: Update runtimes and packages, then redeploy.
    • Mitigation: Confirm request-size and multipart limits still apply after upgrade.
  • CVE-2026-114147: ASP.NET Core SignalR Redis DoS
    • Impact: Persistent resource amplification can degrade or halt services.
    • Affected Systems: Affected Microsoft.AspNetCore.SignalR.StackExchangeRedis and runtime packages.
    • Immediate Action: Patch both the package and runtime, then redeploy.
    • Mitigation: Review Redis-backed SignalR group cleanup behavior.
  • CVE-2026-126609: hMailServer PostgreSQL CA confusion
    • Impact: Local attackers can force trust in an attacker-controlled database certificate and intercept traffic.
    • Affected Systems: hMailServer 6.2.25 through 6.3.7 with PostgreSQL and certain TLS settings.
    • Immediate Action: Patch and verify certificate path handling on Windows and Linux.
    • Mitigation: Do not rely on non-ASCII CA file names.
  • CVE-2026-126623: hMailServer JSON algorithmic DoS
    • Impact: Attackers can hold mail delivery and REST worker threads.
    • Affected Systems: hMailServer 6.3.6 and 6.3.7.
    • Immediate Action: Upgrade immediately and monitor for repeated large JSON inputs.
    • Mitigation: Add throttling at exposed report and API endpoints.
  • CVE-2026-64669: pam_usb remote session detection bypass
    • Impact: Remote tmux sessions may be mistaken for local sessions, weakening authentication policy.
    • Affected Systems: pam_usb 0.8.0 through 0.9.2.
    • Immediate Action: Upgrade to 0.9.3.
    • Mitigation: Do not depend on deny_remote as the only control.
  • CVE-2026-64668: pam_usb IPv6 zone-index bypass
    • Impact: Remote clients on link-local IPv6 can bypass remote-session checks.
    • Affected Systems: pam_usb 0.8.0 through 0.9.2.
    • Immediate Action: Upgrade to 0.9.3 and review PAM policy.
    • Mitigation: Validate remote-session detection in IPv6 environments.
  • CVE-2026-126610: hMailServer CA file omission
    • Impact: Database traffic can be intercepted and modified when CA file handling fails.
    • Affected Systems: hMailServer 6.3.4 through 6.3.7 with MySQL/MariaDB and TlsMode=verify-full.
    • Immediate Action: Patch and test database TLS verification end-to-end.
    • Mitigation: Avoid non-ASCII CA filenames.
  • CVE-2026-64671: Waline stored XSS via UserList widget
    • Impact: A malicious comment can execute in every visitor’s browser.
    • Affected Systems: Waline 3.15.2 and earlier.
    • Immediate Action: Remove or sandbox the widget until a patch exists.
    • Mitigation: Treat commenter link fields as untrusted HTML.
  • CVE-2026-12424: ARForms stored XSS via Referer header
    • Impact: Unauthenticated attackers can store scripts that run in victims’ browsers.
    • Affected Systems: ARForms up to 7.2.4.
    • Immediate Action: Update immediately and purge malicious form entries.
    • Mitigation: Disable public incomplete-form endpoints if possible.
  • CVE-2026-12427: ARForms stored XSS via description parameter
    • Impact: Stored payloads execute when admins view affected entries.
    • Affected Systems: ARForms up to 7.2.4.
    • Immediate Action: Patch and review admin views for injected content.
    • Mitigation: Sanitize legacy entries before reopening them.
  • CVE-2026-64666: pam_usb XRDP environment bypass
    • Impact: Remote login detection can be bypassed by clearing an environment variable.
    • Affected Systems: pam_usb prior to 0.9.3.
    • Immediate Action: Upgrade to 0.9.3.
    • Mitigation: Do not rely on environment-based checks alone in setuid PAM contexts.
  • CVE-2026-124250: GeoDirectory reflected XSS
    • Impact: Attackers can inject scripts into affected WordPress pages.
    • Affected Systems: GeoDirectory through 2.8.202.
    • Immediate Action: Update the plugin and invalidate cached pages.
    • Mitigation: Review exposed search and listing endpoints.
  • CVE-2026-126611: hMailServer local certificate trust bypass
    • Impact: Local attackers can impersonate the database server and capture credentials.
    • Affected Systems: hMailServer 6.3.4 through 6.3.7 with MySQL/MariaDB and TlsMode=verify-full with no CA file.
    • Immediate Action: Patch and confirm local-connection certificate validation behavior.
    • Mitigation: Avoid localhost trust assumptions for database TLS.
  • CVE-2026-118368: Akaunting stored XSS in XLSX item import
    • Impact: Stored markup can execute in invoices or bills viewed by other users.
    • Affected Systems: Akaunting 3.3.0.
    • Immediate Action: Update and review imported item names for HTML payloads.
    • Mitigation: Block untrusted XLSX imports until patched.

What to Do Now

  1. Patch internet-facing systems first: FortiManager, Directus, React Server Components stacks, ASP.NET Core/.NET runtimes, hMailServer, AVideo, ARForms, Waline, and ManageEngine ADAudit Plus.
  2. Rebuild and redeploy any .NET self-contained applications after updating runtimes or packages; do not assume a machine-wide runtime update is enough.
  3. Rotate secrets and invalidate sessions for any product with auth bypass, session forgery, or admin takeover risk.
  4. Restrict exposure of FGFM ports, public WebSockets, Redis-backed SignalR paths, and mail/report endpoints until patched.
  5. Review logs now for unusual admin logins, forged sessions, unexpected uploads, large JSON payloads, and repeated PDB/symbol-processing crashes.

Verification steps: Confirm installed versions against vendor advisories; check package locks, runtime manifests, and self-contained app bundles; verify patched build numbers are actually deployed. For .NET, remember that SDK updates do not automatically fix standalone package references.

Monitoring recommendations: Watch for new admin accounts, token reuse, spikes in 500s or thread exhaustion, abnormal WebSocket activity, suspicious file uploads, and database TLS certificate warnings. Add alerts for repeated access to moderation, report, and import workflows.

Related Resources

  • Internal: Follow-up analysis and remediation checklist post to be published.
  • Official vendor advisories: Microsoft .NET/ASP.NET Core advisories; Fortinet FortiManager bulletin; Directus release notes; ManageEngine ADAudit Plus security advisory; hMailServer release notes; WWBN AVideo updates; AstroBlocks 3.4.0 release; Waline security notices; Octopus Server security advisories; ARForms plugin update notes; GeoDirectory plugin advisory.

Keep reading