Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation

thehackernews.com Nov 12, 2026

Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation

Curated by Shubham · TechCapsules · Nov 12, 2026

AI-summarised brief · reviewed before publication

Zoom has issued patches for two Windows‑specific flaws in its Zoom Workplace client. The critical vulnerability, CVE‑2026‑108187, affects versions prior to 7.1.5 and allows an unauthenticated remote attacker to elevate privileges on the host system. A second issue, CVE‑2026‑108186, impacts versions from 7.1.0 up to but not including 7.1.8, also enabling privilege escalation without prior access. Both bugs can be exploited without special permissions, potentially giving attackers full control of affected machines. Earlier in July, Zoom released a fix for CVE‑2026‑53412, a high‑severity input‑validation error that could let unauthenticated users hijack accounts. Zoom has not reported active exploitation, and it urges users to install the latest updates immediately.

💡 Why It Matters

· Unpatched privilege‑escalation bugs give attackers direct control over corporate endpoints, turning a video‑call tool into a covert entry point for broader network compromise.

Capsules Cybersecurity

Read full article on thehackernews.com

Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam…

Threat actors targeted Qlik Sense servers in October 2026, attempting to deliver PowerShell reverse shells to multiple EU customers within a three‑minute window. The activity mirrors a November 2023 CACTUS ransomware campaign that exploited the same Qlik vulnerabilities, now patched in August–September 2023. Cynet’s analysis revealed a one‑line reverse shell to 45.115.26.23:4455, followed by a Windows Go reverse shell to 45.115.26.23:4456 for reconnaissance and persistence. The malware also sought ActiveMQ processes, collected Linux credentials, and installed OpenSSH via scheduled tasks. An exposed directory on the same IP hosts a custom Go backdoor, ActiveMQ exploit, and a modified Veeam toolchain, suggesting preparation for broader attacks.

💡 The reuse of previously patched Qlik flaws shows attackers’ persistence and the risk of incomplete fixes. The discovery of a multi‑stage backdoor and exploitation of other enterprise tools signals a coordinated effort to expand lateral movement and persistence across diverse environments.

thehackernews.com · Nov 11

Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

The U.S. Cybersecurity and Infrastructure Security Agency added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE‑2026‑111793 in Cisco BroadWorks and CVE‑2026‑20320 in Openwave Messaging Webtop Media Transcoder. Evidence shows attackers used the BroadWorks flaw to upload malicious files and harvest sensitive data, while an AI‑driven campaign, Operation Snowball, exploited the Openwave flaw to enumerate assets, steal credentials, and exfiltrate subscriber records from a European telecom provider. Both exploits involved advanced reconnaissance, autonomous tool development, and persistent web shells. The vulnerabilities were patched, yet exploitation continued, prompting urgent patching for federal agencies by November 24, 2026.

💡 The incidents reveal that AI‑assisted attackers can autonomously orchestrate multi‑stage breaches, turning known software flaws into large‑scale data theft. This underscores the need for rapid patch deployment and enhanced AI‑aware threat detection in critical infrastructure.

thehackernews.com · Nov 11

Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem

Check Point Research identified three espionage clusters—SilentDelivery, OceanGate, and DarkWire—linked through the Sparrow malware ecosystem, operated by the China‑nexus group CopperDragon. The campaigns targeted telecoms, government, military, research, and critical infrastructure across Latin America, Asia, and Europe. Attacks used varied initial techniques, including watering holes, JavaScript injection, and phishing with disguised LNK files. The malware suite delivers backdoors such as SparrowDoor, SquadC, and kernel‑level tools, enabling persistence, lateral movement, and data exfiltration.

💡 The unified Sparrow framework demonstrates a coordinated, multi‑vector threat capable of infiltrating diverse sectors worldwide, underscoring the escalating sophistication of state‑backed cyber espionage.

thehackernews.com · Nov 11

Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access

French firm Vates VMS has identified a critical authentication bypass flaw in Xen Orchestra, tracked as VSA-2026-062, that allows attackers to send a crafted cookie and gain admin privileges. The vulnerability exploits REST cookie parsing, enabling arbitrary code execution and full root takeover of XCP‑ng nodes. Vates reports active exploitation from a specific IP and TOR domain, though the start date is unclear. The flaw is fixed in Xen Orchestra 6.9.1, 6.10.0, and xo‑server 5.211.2, 5.213.1. Immediate patching or mitigations are advised.

💡 The flaw exposes critical infrastructure to total compromise, underscoring the urgency for timely updates in virtualized environments.

thehackernews.com · Nov 11

Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

Git has patched a critical vulnerability (CVE‑2026‑111760) that allowed malicious repositories to execute code on systems performing recursive clones with submodules. The flaw stemmed from an integer truncation in Git’s index handling; an excessively long path could bypass safety checks, be shortened to “.git”, and replace a submodule’s .git file with a symlink to attacker‑controlled hooks. When Git later accessed the submodule, the malicious hooks ran automatically. The issue was addressed in Git 2.56.1 and back‑ported to 2.50.2 through 2.55.1, which now reject overly long paths before truncation. GitHub applied the fixes across its services, including GitHub.com, Enterprise Cloud, and upcoming updates for Desktop, Copilot, Codespaces, and Actions. Users are urged to upgrade to patched versions or follow mitigation steps.

💡 A repository can become a silent drop‑point for code execution, turning routine cloning into a supply‑chain attack. Rapid adoption of the fix is vital to protect the billions of developers who rely on Git’s default cloning behavior.

thehackernews.com · Nov 10

SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution

SAP released its November Security Patch Day updates, fixing four critical CVSS 10.0 vulnerabilities that allow remote code execution without authentication. Three flaws reside in the SAP NetWeaver application server—two in the Internet Communication Manager (ICM) and Web Dispatcher, and one in the SAML 2.0 service provider—while the fourth affects SAP Gateway. The ICM and Web Dispatcher bugs, identified as ICM2SHELL, enable memory corruption and OS command execution; the Gateway flaw, PROXYGATE, permits an attacker to impersonate a trusted server and run commands as the system administrator. SAP recommends immediate application of the individual patch notes, particularly for kernels 7.40 through 7.89, and advises upgrading unsupported kernels. The patches address vulnerabilities that could lead to full system compromise and potentially affect connected SAP environments.

💡 The fixes eliminate high‑risk entry points that could let attackers gain unrestricted control over SAP systems, a critical concern for enterprises relying on SAP for core operations. Prompt patching is essential to prevent exploitation that could disrupt business continuity and expose sensitive data.