9th November – Threat Intelligence Report

Linked advisories

• CVE-2026-58868Google Android: Schreiben außerhalb des zugewiesenen Speichers (Out-of-bounds Write)
• CVE-2026-111560Barracuda: Betriebssystem-Befehlsinjektion
• CVE-2026-58868Android Patchday November 2026 (Google Android, Automotive OS and XR): Mehrere Schwachstellen
• CVE-2026-19868SonicWall SonicOS SSLVPN: SAML / MFA bypass via alternate auth (CVE-2026-19868, CISA KEV) — SNWLID-2026-0014 batch
• CVE-2026-58868OSV-Eintrag
• CVE-2026-58868Android November 2026 bulletin: critical Framework RCE with no user interaction (CVE-2026-58868)
• CVE-2026-19868SonicWall SonicOS: Mehrere Schwachstellen
• CVE-2026-123158OpenBSD OpenSSH — OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
• CVE-2026-123158CVE-2026-123158 affecting OpenSSH on Linux
• CVE-2026-123158sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpreta…
• CVE-2026-116606An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configurat…
• CVE-2026-58868Samsung Products Multiple Vulnerabilities
• CVE-2026-19868An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypas…
• CVE-2026-123158OpenSSH Security Restriction Bypass Vulnerability
• CVE-2026-19868SonicWall SonicOS Multiple Vulnerabilities
• CVE-2026-123158Alpine Linux sshd password authentication bypass lets anyone log in to key-only accounts (CVE-2026-123158)
• CVE-2026-111560Barracuda Networks Multiple Products — Barracuda Networks Multiple Products OS Command Injection Vulnerability
• CVE-2026-123158sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
• CVE-2026-123158OpenSSH: Schwachstelle ermöglicht Erlangen von Administratorrechten
• CVE-2026-123158OpenBSD OpenSSH: Umgehung der Authentifizierung
• CVE-2026-116606Barracuda Networks Barracuda Email Security Gateway (ESG) — Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2026-111560Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allow…
• CVE-2026-111560Barracuda Networks Email Security Gateway und Web Application Firewall: Mehrere Schwachstellen
• CVE-2026-111560Barracuda fixes pre-auth authorization bypass and command injection that can yield root
• CVE-2026-19868SonicWall SonicOS SSLVPN — SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
• CVE-2026-58868In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with…
• CVE-2026-58868Google Android: Schreiben außerhalb des zugewiesenen Speichers (Out-of-bounds Write)
• CVE-2026-58868Android Multiple Vulnerabilities
• CVE-2026-19868SonicWall SonicOS: Sicherheitslücke
• CVE-2026-116606Barracuda Email Security Gateway (ESG): Umgehung der Authentifizierung über alternativen Pfad

Affected vendors and products

• Android Platform/frameworks/av
• Barracuda Networks
• Barracuda Networks
• Google Google Android
• Google Android 14
• Google Android 15
• Google Android 16
• Google Android 17
• Google Android Automotive OS
• Google Android Xr
• OpenBSD OpenBSD OpenSSH
• Open Source Openssh

More on November