Security Digest: November 12, 2026 - 47 Critical Vulnerabilities

Today’s alerts span remote code execution, authentication bypass, privilege escalation, SQL injection, and stored XSS across enterprise management platforms, storage appliances, and developer-facing tools. The most urgent risks are in ManageEngine, Azul Payara, MISP Modules, Synology DSM, Philips Hue Bridge Pro, and multiple file-parsing products where attackers can move from low privilege or no auth to full compromise.

· 23 min read

November 12, 2026: 47 Critical Vulnerabilities Demand Immediate Action

Executive Summary

Today’s alerts span remote code execution, authentication bypass, privilege escalation, SQL injection, and stored XSS across enterprise management platforms, storage appliances, and developer-facing tools. The most urgent risks are in ManageEngine, Azul Payara, MISP Modules, Synology DSM, Philips Hue Bridge Pro, and multiple file-parsing products where attackers can move from low privilege or no auth to full compromise.

Act now: patch exposed systems first, disable unused admin and management interfaces, and treat any internet-facing instance as high risk until proven updated. Where patching is not yet possible, isolate the service, restrict access by network, and review logs for suspicious admin activity, file uploads, and webhook traffic.

Critical Vulnerabilities

  • CVE-2026-12591: ManageEngine M365 Manager Plus privilege escalation to RCE
    • Impact: Authenticated technicians may escalate beyond intended scope and trigger remote code execution during admin processing.
    • Affected Systems: ManageEngine M365 Manager Plus below 4818.
    • Immediate Action: Patch immediately and review technician roles.
    • Mitigation: Upgrade to 4818 or later; restrict delegated admin access.
  • CVE-2026-8333: Microchip TimePictra stored XSS
    • Impact: Low-privileged users can plant scripts that run in another user’s browser.
    • Affected Systems: Microchip TimePictra platform.
    • Immediate Action: Patch and inspect stored content for injected script.
    • Mitigation: Apply vendor fix; sanitize and review user-generated fields.
  • CVE-2026-110003: Azul Payara admin REST auth bypass
    • Impact: Remote unauthenticated attackers may execute administrative commands and fully compromise the server.
    • Affected Systems: Azul Payara administration REST interface.
    • Immediate Action: Block remote admin access now.
    • Mitigation: Patch immediately; remove empty admin passwords and restrict admin endpoints to trusted hosts.
  • CVE-2026-90908: Azul Payara JMX/RMI host spoofing to RCE
    • Impact: Unauthenticated attackers can gain MBean access and potentially execute code.
    • Affected Systems: Azul Payara Server and Payara Micro with JMX connector enabled.
    • Immediate Action: Disable or firewall JMX/RMI.
    • Mitigation: Patch; ensure JMX is off unless strictly required.
  • CVE-2026-126785: rmalright TR-VISION HOME incorrect default permissions
    • Impact: Local attackers may gain elevated access.
    • Affected Systems: TR-VISION HOME 2.0.5.
    • Immediate Action: Limit local access and remove untrusted users.
    • Mitigation: Await vendor fix; isolate affected devices.
  • CVE-2026-127016: MISP Modules external tools auth bypass
    • Impact: Anonymous users can add, delete, or reconfigure external tools, including API keys and ingestion URLs.
    • Affected Systems: MISP Modules website when ADMIN_PASSWORD is set.
    • Immediate Action: Restrict network access and verify tool configuration integrity.
    • Mitigation: Patch; confirm admin auth is enforced on all external_tools handlers.
  • CVE-2026-12507: ManageEngine Reports module RCE
    • Impact: Authenticated users with report-query permission can execute commands on the server.
    • Affected Systems: AssetExplorer below 7860; ServiceDesk Plus below 15290; ServiceDesk Plus MSP below 15150; SupportCenter Plus below 15150.
    • Immediate Action: Remove unnecessary Create Query Reports permissions.
    • Mitigation: Patch all affected products immediately.
  • CVE-2026-125836: Simple JWT Login CSRF
    • Impact: Attackers can force actions through a victim’s browser.
    • Affected Systems: Simple JWT Login through 3.6.8.
    • Immediate Action: Update plugin and review auth flows.
    • Mitigation: Upgrade beyond 3.6.8; add CSRF protections.
  • CVE-2026-13672: Synology DSM SSOAuth authorization bypass
    • Impact: Authenticated users can read/write files and trigger DoS.
    • Affected Systems: DSM before 7.3.2-86009-5 and 7.4.1-90080-1.
    • Immediate Action: Patch and restrict file-access features.
    • Mitigation: Update DSM to fixed builds.
  • CVE-2026-74857: Synology DSM Auth API missing auth step
    • Impact: Remote authenticated users can read/write files and cause DoS.
    • Affected Systems: DSM before 7.3.2-86009-5 and 7.4.1-90080-1.
    • Immediate Action: Upgrade immediately.
    • Mitigation: Apply Synology security update.
  • CVE-2026-76173: Dolibarr WhatsApp webhook SQL injection
    • Impact: Unauthenticated attackers can extract database data and disrupt service.
    • Affected Systems: Dolibarr WhatsApp module 1.9 with WHATSAPP_WEBHOOK_ALLOW enabled.
    • Immediate Action: Disable the webhook option if not required.
    • Mitigation: Patch and validate all inbound webhook parameters.
  • CVE-2026-122044: Philips Hue Bridge Pro auth bypass
    • Impact: Network-adjacent attackers can bypass authentication.
    • Affected Systems: Philips Hue Bridge Pro HTTP service on TCP 443.
    • Immediate Action: Segment the device and limit local network access.
    • Mitigation: Apply vendor firmware update when available.
  • CVE-2026-8331: Microchip TimePictra unrestricted upload to RCE
    • Impact: Malicious file uploads may lead to code execution.
    • Affected Systems: Microchip TimePictra platform.
    • Immediate Action: Disable risky upload paths.
    • Mitigation: Patch and enforce file-type allowlists.
  • CVE-2026-18792: Synology DSM path restriction failure
    • Impact: Authenticated users can read/write arbitrary files and cause DoS.
    • Affected Systems: DSM before 7.3.2-86009-5 and 7.4.1-90080-1.
    • Immediate Action: Update and audit file-sharing permissions.
    • Mitigation: Install Synology fix.
  • CVE-2026-85101: Synology rsync auth bypass
    • Impact: Remote attackers can read/write files and cause limited DoS.
    • Affected Systems: DSM before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, 7.4.1-90080-1.
    • Immediate Action: Disable rsync exposure to untrusted networks.
    • Mitigation: Patch to fixed DSM release.
  • CVE-2026-111433: openEuler iSulad symlink host directory exposure
    • Impact: Crafted images can expose sensitive host directories inside containers.
    • Affected Systems: iSulad through 2.1.6.
    • Immediate Action: Block untrusted images and review container workloads.
    • Mitigation: Upgrade iSulad and restrict image sources.
  • CVE-2026-18596: Synology OTP auth bypass
    • Impact: Remote authenticated users can read/write files and cause DoS.
    • Affected Systems: DSM before 7.3.2-86009-5 and 7.4.1-90080-1.
    • Immediate Action: Patch and review MFA/OTP settings.
    • Mitigation: Apply DSM update.
  • CVE-2026-81584: Synology User API SQL flaw tied to LDAP/AD compromise
    • Impact: Attackers controlling LDAP/AD can read/write files and trigger DoS.
    • Affected Systems: DSM before 7.3.2-86009-5 and 7.4.1-90080-1.
    • Immediate Action: Audit directory trust relationships now.
    • Mitigation: Patch and validate external directory integrations.
  • CVE-2026-118632: Philips Hue Bridge Pro SQL injection to root RCE
    • Impact: Network-adjacent attackers can execute code as root.
    • Affected Systems: Philips Hue Bridge Pro HTTP service on TCP 443.
    • Immediate Action: Isolate the device and restrict LAN access.
    • Mitigation: Install vendor firmware update.
  • CVE-2026-121753: Ashlar-Vellum Cobalt XE parsing RCE
    • Impact: Malicious files or pages can execute code on the victim system.
    • Affected Systems: Ashlar-Vellum Cobalt.
    • Immediate Action: Warn users not to open untrusted files.
    • Mitigation: Patch when available; isolate engineering workstations.
  • CVE-2025-10935: libilbm ILBM parsing heap overflow
    • Impact: Malicious files can trigger code execution.
    • Affected Systems: libilbm-based applications.
    • Immediate Action: Remove exposure to untrusted media files.
    • Mitigation: Update affected libraries and applications.
  • CVE-2026-114558: OriginLab Origin Viewer OPJU parsing RCE
    • Impact: Malicious files can execute code in the current process.
    • Affected Systems: OriginLab Origin Viewer.
    • Immediate Action: Block untrusted project files.
    • Mitigation: Patch and enforce file provenance checks.
  • CVE-2026-114559: OriginLab Origin Viewer OGG parsing RCE
    • Impact: File parsing can lead to code execution.
    • Affected Systems: OriginLab Origin Viewer.
    • Immediate Action: Restrict file handling from external sources.
    • Mitigation: Apply vendor fix.
  • CVE-2026-114560: OriginLab Origin Viewer OPJ parsing RCE
    • Impact: Malicious files can overwrite memory and execute code.
    • Affected Systems: OriginLab Origin Viewer.
    • Immediate Action: Keep the app off internet-facing endpoints.
    • Mitigation: Patch immediately.
  • CVE-2026-114561: OriginLab Origin Viewer OPJU parsing RCE
    • Impact: Malicious files can execute code.
    • Affected Systems: OriginLab Origin Viewer.
    • Immediate Action: Restrict file intake.
    • Mitigation: Install updates as soon as released.
  • CVE-2026-114562: OriginLab Origin Viewer OGWU parsing RCE
    • Impact: Out-of-bounds write can enable code execution.
    • Affected Systems: OriginLab Origin Viewer.
    • Immediate Action: Block untrusted OGWU files.
    • Mitigation: Patch.
  • CVE-2026-114563: OriginLab Origin Viewer OGWU stack overflow RCE
    • Impact: Stack overflow can execute code.
    • Affected Systems: OriginLab Origin Viewer.
    • Immediate Action: Treat OGWU files as hostile.
    • Mitigation: Apply vendor patch.
  • CVE-2026-114564: OriginLab Origin Viewer OGG out-of-bounds write RCE
    • Impact: Malicious files may execute code.
    • Affected Systems: OriginLab Origin Viewer.
    • Immediate Action: Limit file exchange to trusted sources.
    • Mitigation: Patch.
  • CVE-2026-114565: OriginLab Origin Viewer OGG out-of-bounds write RCE
    • Impact: Malicious files may execute code.
    • Affected Systems: OriginLab Origin Viewer.
    • Immediate Action: Restrict external file imports.
    • Mitigation: Patch.
  • CVE-2026-114566: OriginLab Origin Viewer OGM memory corruption RCE
    • Impact: Memory corruption can lead to code execution.
    • Affected Systems: OriginLab Origin Viewer.
    • Immediate Action: Keep vulnerable versions off shared systems.
    • Mitigation: Update immediately when available.
  • CVE-2026-114567: OriginLab Origin Viewer OGWU out-of-bounds write RCE
    • Impact: Malicious files can execute code.
    • Affected Systems: OriginLab Origin Viewer.
    • Immediate Action: Block untrusted project files.
    • Mitigation: Patch.
  • CVE-2026-114568: OriginLab Origin Viewer OPJ heap overflow RCE
    • Impact: Heap overflow can execute code.
    • Affected Systems: OriginLab Origin Viewer.
    • Immediate Action: Restrict file handling to trusted workflows.
    • Mitigation: Apply vendor fix.
  • CVE-2026-114569: OriginLab Origin Viewer OGWU heap overflow RCE
    • Impact: Heap overflow can execute code.
    • Affected Systems: OriginLab Origin Viewer.
    • Immediate Action: Treat OGWU imports as high risk.
    • Mitigation: Patch.
  • CVE-2026-121741: Trimble SketchUp SKP parsing UAF RCE
    • Impact: Malicious SKP files can execute code.
    • Affected Systems: Trimble SketchUp.
    • Immediate Action: Warn users to avoid untrusted models.
    • Mitigation: Patch when available.
  • CVE-2026-121742: Ashlar-Vellum Cobalt XE parsing UAF RCE
    • Impact: Malicious files can execute code.
    • Affected Systems: Ashlar-Vellum Cobalt.
    • Immediate Action: Restrict file intake.
    • Mitigation: Apply vendor update.
  • CVE-2026-121743: Ashlar-Vellum Cobalt AR heap overflow RCE
    • Impact: Malicious files can execute code.
    • Affected Systems: Ashlar-Vellum Cobalt.
    • Immediate Action: Block untrusted AR files.
    • Mitigation: Patch.
  • CVE-2026-121744: Ashlar-Vellum Cobalt XE stack overflow RCE
    • Impact: Malicious files can execute code.
    • Affected Systems: Ashlar-Vellum Cobalt.
    • Immediate Action: Restrict file sharing and downloads.
    • Mitigation: Patch.
  • CVE-2026-121752: Ashlar-Vellum Cobalt LI heap overflow RCE
    • Impact: Malicious files can execute code.
    • Affected Systems: Ashlar-Vellum Cobalt.
    • Immediate Action: Treat LI files from outside the org as hostile.
    • Mitigation: Patch.
  • CVE-2026-87772: Pardus About incorrect authorization
    • Impact: Privilege escalation on affected systems.
    • Affected Systems: Pardus About before 1.2.5.
    • Immediate Action: Update and limit local admin access.
    • Mitigation: Install the fixed version.
  • CVE-2026-13269: Quest NetVault Backup truncation DoS
    • Impact: Remote attackers can cause denial of service without authentication.
    • Affected Systems: Quest NetVault Backup.
    • Immediate Action: Monitor backup service availability and isolate exposure.
    • Mitigation: Patch and restrict network access.
  • CVE-2026-13270: Quest NetVault Backup nvpmgr integer underflow DoS
    • Impact: Remote unauthenticated attackers can crash the service.
    • Affected Systems: Quest NetVault Backup nvpmgr on UDP 20031.
    • Immediate Action: Block UDP 20031 from untrusted networks.
    • Mitigation: Apply vendor patch.
  • CVE-2026-114556: MailEnable directory traversal to arbitrary file creation
    • Impact: Remote attackers can create arbitrary files and potentially reach SYSTEM code execution chain.
    • Affected Systems: MailEnable.
    • Immediate Action: Patch and monitor for unexpected file writes.
    • Mitigation: Restrict access until fixed.
  • CVE-2026-111435: openEuler iSulad relative path traversal
    • Impact: Malicious tar packages can make root read arbitrary host files.
    • Affected Systems: iSulad through 2.1.6.
    • Immediate Action: Stop importing untrusted tar packages.
    • Mitigation: Upgrade and validate manifest paths.
  • CVE-2026-125637: Konflux UI proxy config injection
    • Impact: Authenticated users may bypass auth/authorization controls and potentially cause DoS.
    • Affected Systems: Konflux UI proxy.
    • Immediate Action: Restrict who can edit the KonfluxUI custom resource.
    • Mitigation: Patch and sanitize hostname values.
  • CVE-2026-75785: Synology VPN API command injection
    • Impact: Admin-privileged users can read/write files and trigger DoS.
    • Affected Systems: DSM before 7.3.2-86009-5 and 7.4.1-90080-1.
    • Immediate Action: Patch and review VPN admin accounts.
    • Mitigation: Update DSM and limit admin rights.
  • CVE-2026-118597: Akaunting stored XSS in custom payment terms
    • Impact: Attackers can run JavaScript in another user’s authenticated session.
    • Affected Systems: Akaunting 3.3.0.
    • Immediate Action: Review custom payment-term content.
    • Mitigation: Patch and sanitize stored invoice metadata.
  • CVE-2026-118855: Akaunting stored XSS via invoice import
    • Impact: Stored markup executes when another user opens the invoice edit form.
    • Affected Systems: Akaunting 3.3.0.
    • Immediate Action: Block untrusted invoice imports.
    • Mitigation: Patch and escape rendered invoice fields.

Previously Alerted

What to Do Now

  1. Patch internet-facing products first: ManageEngine, Payara, Synology DSM, MISP Modules, MailEnable, Quest NetVault Backup, Philips Hue Bridge Pro, and any exposed developer or admin portals.
  2. Disable or restrict admin interfaces: block remote admin access, JMX/RMI, rsync, webhook receivers, and backup ports from untrusted networks.
  3. Remove risky permissions: strip unnecessary report, technician, and administrator privileges until systems are updated.
  4. Quarantine untrusted files and uploads: treat project files, media files, and archives as hostile until patched.
  5. Check for abuse now: look for new external tools, unexpected file creation, suspicious admin commands, and anomalous webhook or proxy config changes.

Verification: confirm versions against vendor advisories, verify that fixed builds are deployed, and test that exposed services are no longer reachable from the internet where they should not be. Validate that ADMIN_PASSWORD is set only where needed and that every management endpoint enforces authentication.

Monitoring: watch for spikes in 4xx/5xx errors, unusual admin logins, new files under web roots or backup paths, outbound connections from management servers, and repeated requests to file-parsing endpoints. Preserve logs from affected systems for incident review.

Related Resources

  • Internal blog post on emergency patch prioritization for enterprise management systems — coming soon.
  • Internal blog post on hardening exposed admin interfaces and backup services — coming soon.
  • Official vendor advisories from Zoho, Azul, Synology, Philips, Microchip, Quest, MailEnable, Trimble, Ashlar-Vellum, OriginLab, and Akaunting.

Keep reading