Daily briefing · November 3, 2026
Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs lands
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — attention1 seen before CISA
The verdict for November 3 is ATTENTION: no vulnerability has reached weaponized-exploit status, but two are under active exploitation and one was observed by VulnCheck before CISA acknowledged it. The Ivanti Connect Secure flaw (CVE-2026-118527) is confirmed in both KEV catalogs, and the WordPress plugin Advanced Custom Fields: Extended PRO (CVE-2026-120534) is a critical early warning. The day also brought a cluster of CVSS 10.0 flaws in Linksys and Qihoo 360 devices, all with public proof of concept and no vendor response.
Today’s brief
- CVE-2026-118527 (Ivanti Connect Secure) is confirmed as actively exploited in CISA KEV and VulnCheck KEV, despite a medium CVSS of 4.3.
- CVE-2026-120534 (ACF Extended PRO for WordPress, CVSS 9.8) was observed exploited by VulnCheck before CISA — an early warning.
- Four CVSS 10.0 flaws in Linksys and Qihoo 360 devices have public proof of concept, and the vendors did not respond to disclosure.
- Unauthenticated RCE in Quest Foglight for Databases (CVE-2026-92188 and CVE-2026-92189) and a command injection in SolarWinds Dameware (CVE-2026-28336) require prompt attention.
Critical highlights
1
Active exploitation is confirmed by CISA and VulnCheck, so the medium CVSS score understates the real risk. Predictable filenames let an authenticated attacker upload content to a known location on a VPN appliance, a high-value perimeter target; prioritize updating to the fixed versions.
2
CVE-2026-120534◆ VulnCheckCVSS 9.8affects Advanced Custom Fields: Extended PRO Exploitation was observed by VulnCheck before CISA's acknowledgment, so attacks are likely already happening even without official confirmation. Unauthenticated code injection in a widely used WordPress plugin (CVSS 9.8) makes exposed sites an immediate target, even with a 0% EPSS.
3
Improper authentication in the login handler of the Linksys E5600, CVSS 10.0, remotely exploitable with a public proof of concept. The vendor did not respond, so there is no patch to rely on; isolate or replace exposed devices.
4
Hard-coded credentials in the boot script of the Qihoo 360 Whole Home Router M5 allow remote access with a public proof of concept. With no vendor response, the practical mitigation is to restrict remote management access.
5
OS command injection via the 'host' argument in the Qihoo 360 iscm binary, remotely exploitable with a public proof of concept. It could give an attacker full control of the affected devices.
6
Improper cryptographic signature verification in the Qihoo 360 iscm component can undermine firmware integrity and trust. Combined with the other flaws in the same family, it raises the risk of persistent compromise.
7
Command injection in SolarWinds Dameware (CVSS 9.9) can compromise the remotely controlled host, though it requires authentication. In remote-support tools, stolen credentials make this flaw especially dangerous.
8
Affects only WSO2 deployments with Identity Server as Resident Key Manager with database sharing, where a self-registered user can reach the System REST APIs of API Manager. Check whether your configuration matches this scenario to assess real exposure.
9
Remote code execution with no authentication in Quest Foglight for Databases via external control of a file path. Database monitoring tools usually hold privileged access, which raises the impact.
10
Missing authentication in the ForgeMBeanServerSupport module allows unauthenticated remote code execution in Foglight for Databases. Together with CVE-2026-92189, it makes the product a priority for patching and network restriction.
Ransomware today
The emperador group claimed Punta Shopping (Brazil, Retail & E-Commerce) as its most recently discovered victim. Over the last 30 days, the most active groups were N0n (6 victims, all in Brazil), thegentlemen, emperador and qilin (4 each, all in Brazil), followed by Eclipse and incransom (2 each).
Punta Shopping BRemperador · Retail & E-Commerce
N0n 6thegentlemen 4emperador 4qilin 4Eclipse 2incransom 2
Active groups & APTs
Groups with a focus on Brazil lead the activity: lockbit5 has 54 Brazilian victims listed on leak sites, lockbit3 and thegentlemen have 39 each, and ransomhub (of Russian origin) has 35. Akira (24) and arcusmedia (23) complete the list of groups that target the country.
Brazil focus
Recent Brazilian victims span several sectors: Punta Shopping, Animart Pet Stores (Retail & E-Commerce), P&B Textiles and GTL Concreto e Logística (Manufacturing), and bio3g.com, CLIMEDI and Hospital Sírio-Libanês (Healthcare). Universidade de Passo Fundo (Education) also appears. The groups involved include qilin, emperador, thegentlemen and THE SEVEN DEADLY SINS, with healthcare especially exposed.
Punta Shoppingemperador · Retail & E-Commerce
P&B Textilesqilin · Manufacturing
bio3g.comqilin · Healthcare
Animart Pet Storesqilin · Retail & E-Commerce
GTL Concreto e Logística LTDAemperador · Manufacturing
CLIMEDIthegentlemen · Healthcare
Universidade de Passo Fundothegentlemen · Education
Hospital Sírio-LibanêsTHE SEVEN DEADLY SINS · Healthcare
Today’s recommendation: Immediately apply the Ivanti Connect Secure fixes (25.1.1.3 / 22.8R2.6) and update or review the ACF Extended PRO plugin. Remove unpatched Linksys and Qihoo 360 devices from remote exposure and restrict network access to Foglight, Dameware and WSO2 management interfaces.
With active exploitation on one side and unpatched flaws on the other, the real question is whether any of these risks reach your own environment, and only validating your attack surface can answer it.Before an attacker finds it, find it first: run a free initial exposure assessment and see whether your infrastructure is vulnerable to flaws like these.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →