MSP Threat Briefing: November 11, 2026

Microsoft's November updates fix one exploited flaw, in Outlook, that leaks NTLM hashes when a user opens a crafted file. Vates reports active attacks on a Xen Orchestra login bypass that can lead to root on XCP-ng hosts. N-able shipped its first N-central fix for the Able2Shell flaws, and Fortinet published the details behind its October 22 releases.

1. Upgrade Xen Orchestra to 6.9.2 (stable) or 6.10.1 (latest) now, and take it off the internet.
2. Hunt XCP-ng hosts and Xen Orchestra traffic for the indicators Vates published.
3. Upgrade on-premises N-central to 2026.4.1.26. Upgrade Agents first, then Probes.
4. Deploy the November Microsoft 365 Apps and Office LTSC updates so Outlook is patched.
5. Upgrade FortiManager and FortiAnalyzer to the fixed builds, and keep the FGFM port away from untrusted networks.

1. Outlook flaw leaks NTLM hashes, exploited before the fix

Microsoft released its November updates on November 10. Only one flaw is marked as exploited: CVE-2026-124194, an Outlook spoofing flaw rated 6.5 and Moderate. None is marked as publicly disclosed. CISA added it to its exploited list the same day, with a federal deadline of November 24.

An attacker sends a crafted message file and persuades the user to open it. Outlook then connects to a server the attacker controls without its usual external-content warning. That exposes the user's NTLMv2 hash, which can be used to authenticate as the user. Microsoft says the Preview Pane is not an attack vector.

Affected products are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024, in 32-bit and 64-bit editions. Microsoft lists fixed builds 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024.

Who is exposed. Nearly every client running desktop Outlook. Users who open attachments from outside senders are the target.

What to do.

• Push the November Office update and confirm Click-to-Run clients have picked it up. Office channels can lag behind Windows updates.
• Block outbound SMB (TCP 445) to the internet at the firewall, so a hash request cannot leave the network.
• Where the business allows it, add users to the Protected Users group or restrict outgoing NTLM traffic.
• Remind staff that a message file from an outside sender is as risky as any other attachment.

The rest of the release is large. Counts differ by source: Tenable reports 1,093 CVEs, and BleepingComputer reports 1,235. None of the others is marked as exploited. Three deserve early attention on servers:

• CVE-2026-119952, Windows Schannel (8.1, Critical). Unauthenticated remote code execution over the network. Microsoft says it needs specific protocol settings or configurations, but rates exploitation "More Likely".
• CVE-2026-113862, Windows NAT (8.1, Critical). Unauthenticated remote code execution with a crafted packet. The attacker must win a race condition.
• CVE-2026-118207, Exchange Server Subscription Edition (8.8, Critical), and CVE-2026-118146, Active Directory Domain Services (8.8, Critical). Both need a low-privileged login and allow code execution on the server.

2. Xen Orchestra login bypass is exploited to take over XCP-ng hosts

Vates published VSA-2026-062 on November 10. It rates the flaw Critical and says it is actively exploited. There is no CVE or CVSS score yet. A crafted cookie lets an attacker skip the login and act with Admin privileges. Vates says that can lead to code execution on managed pools and "a full XCP-ng node takeover as root."

Xen Orchestra before 6.9.2 (stable) and 6.10.1 (latest) is affected, as is the Xen Orchestra Appliance. The fixed packages are xo-server 5.211.2 on the stable channel and 5.213.1 on the latest channel. Vates says installs built from source should update to the latest master. The flaw was reported by researchers at TDC NET Security.

A second advisory, VSA-2026-063, covers a VM import path the same attacker used with Admin access. It affects 6.10.1 and earlier, and its fix is still in progress. Vates says to restrict VM import to Admin users. It also says to disable users holding the vm.import, sr/import:vm, network/action:create or network/action:update privilege.

Who is exposed. Clients and MSP labs running XCP-ng with Xen Orchestra, especially where the Xen Orchestra web interface is reachable from the internet.

What to do.

• Upgrade to 6.9.2 or 6.10.1 now.
• Move Xen Orchestra onto a dedicated management network. Do not expose it to the internet.
• Apply the VSA-2026-063 privilege change until its fix ships.
• Block the addresses below inbound and outbound, and block Tor traffic from the management network.
• On XCP-ng hosts, look for a VM named pivot2 and for VMs whose platform settings include hvm_serial: file. Check /var/log/xensource.log* for -serial file:.
• Look for /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5, /.ustar6, and an unexpected /etc/ld.so.preload.
• If Xen Orchestra was compromised, rotate every secret it held: backup remote credentials, root and pool secrets, user passwords, OTP secrets and mail settings. Vates recommends a full reinstall after a confirmed compromise.

Vates warns that Xen Orchestra keeps no log of the unauthenticated access. Detection relies on network capture or a reverse proxy. These indicators cover only the campaign seen so far.

3. Update: N-able ships a first N-central fix for Able2Shell

The November 10 briefing covered the 33 N-central flaws published with exploit code. N-able released N-central 2026.4 Hotfix 2, build 2026.4.1.26, on November 10. It calls the release a critical security update.

The hotfix fixes seven CVEs: CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882 and CVE-2026-91000. They cover XXE, OGNL injection, SSRF, stored XSS, a path traversal leading to code execution, and two routes to root. Tenable lists the highest score as CVSSv4 9.3. N-able has not mapped the seven CVEs to the 33 published findings, and Tenable reports that a follow-up hotfix is planned.

The hotfix also removes legacy mobile device management. Built-in remote control is disabled for now; Take Control still works.

N-able's status page reports "scanning activity associated with the published proof-of-concept code," as quoted by Huntress. N-able says it has no evidence that any customer environment was exploited. Huntress says it has not seen exploitation in its partners' environments. N-able has upgraded all hosted servers.

Who is exposed. On-premises N-central servers not yet on 2026.4.1.26. Hosted and on-premises customers alike still need to upgrade Agents and Probes.

What to do.

• Upgrade on-premises servers to 2026.4.1.26. Keep any server that is not upgraded offline.
• Supported upgrade paths start at 2025.4. Older servers must first move to a supported version.
• Upgrade Agents first, then Probes. An upgraded Probe cannot talk to Agents that have not been upgraded.
• Keep reviewing logins, new admin accounts, scripts and remote sessions from November 8 onward. After patching, also check file repository uploads.
• Watch the N-able status page for the follow-up hotfix.

4. Fortinet publishes the CVEs behind its October 22 fixes

The October 25 briefing covered Fortinet shipping fixes before saying what they fixed. On November 10 it published the advisories. Fortinet marks none of them as exploited. Three are rated Critical:

• CVE-2026-126261, FortiManager FGFM (FG-IR-26-275), CVSS 9.0. An unauthenticated attacker who can reach the FGFM port can run code or commands. Fixed in 8.0.1, 7.6.8, 7.4.6 and 7.2.9.
• CVE-2026-126229, FortiManager and FortiAnalyzer dmserver (FG-IR-26-244), CVSS 9.1. An authenticated administrator can reach other VDOMs with crafted HTTP requests. Fixed in 8.0.2, 7.6.8 and 7.4.12; all 7.2 versions must migrate to a fixed release.
• CVE-2026-126253, FortiOS OSPF (FG-IR-26-267), CVSS 9.3. An unauthenticated attacker on an adjacent network can inject OSPF routing updates. Fixed in 8.0.2, 7.6.8, 7.4.13 and 7.2.14, the versions named in October.

The PSIRT page lists at least 12 more advisories from the same day, most rated High and most affecting FortiManager and FortiAnalyzer.

Who is exposed. MSPs that run a shared FortiManager or FortiAnalyzer for several clients, and any FortiGate still below the October builds. The dmserver flaw matters most where one admin should not see another client's VDOM.

What to do.

• Upgrade FortiManager and FortiAnalyzer, including cloud instances, to the fixed builds.
• Allow FGFM (TCP 541) only from your managed FortiGates.
• Confirm every FortiGate is on 8.0.2, 7.6.8, 7.4.13 or 7.2.14 or later.
• Where OSPF runs, use OSPF authentication and limit it to the interfaces that need it.

Quick hits

Update: Barracuda and Chrome flaws join CISA's exploited list. On November 10 CISA added the two Barracuda flaws covered on November 10, CVE-2026-116606 and CVE-2026-111560, with a federal deadline of November 13. It also added the Chrome flaw CVE-2026-125350, due November 24. Nothing else changed. Confirm the Barracuda patches are installed and Chrome is at 157.0.8103.50 or later.

Sources

• Microsoft: CVE-2026-124194, Microsoft Outlook Spoofing Vulnerability
• CISA: CISA adds six known exploited vulnerabilities to catalog, November 10, 2026
• Tenable: Microsoft's November 2026 Patch Tuesday addresses 1,093 CVEs
• BleepingComputer: Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
• Vates: VSA-2026-062, empty-object login token
• Vates: VSA-2026-063, crafted keys through XO vm.import privilege
• N-able: N-central 2026.4 HF2 release notes
• Tenable: Able2Shell frequently asked questions
• Huntress: N-able disables cloud services following disclosure of Able2Shell exploit chains
• Fortinet: FG-IR-26-275, FortiManager FGFM
• Fortinet: FG-IR-26-244, dmserver authorization bypass
• Fortinet: FG-IR-26-267, FortiOS OSPF authentication bypass
• Fortinet: PSIRT advisories