Threat intelligence: vulnerabilities and ransomware from 6 to 12 November 2026

From 6 to 12 November 2026 there were 374 ransomware claims on leak sites, 47% above the average of the previous four weeks, and CISA added 11 exploited vulnerabilities to its KEV catalog, including a Barracuda email gateway and the SonicWall VPN. The bulletin covers vulnerabilities, the most active groups and sectors, Italian and European advisories and the questions to put to applicants.

Threat intelligence from 6 to 12 November 2026 · by cybercoverinsurance

In brief

Ransomware claims published on leak sites reached 374, against an average of 254 over the previous four weeks. Most of the increase comes from two bulk publications: 67 claims by the N0n group on 9 November and about fifty by INC Ransom on 12 November (ransomware.live).
CISA added 11 entries to its catalog of exploited vulnerabilities (KEV), against an average of 7 a week. Two concern perimeter products: the Barracuda Email Security Gateway and the SonicWall SSL VPN (CISA KEV).
In Italy CERT-AGID counted 187 malicious campaigns targeting Italy in the week from 31 October to 6 November 2026, 98 of them themed around fines (CERT-AGID).

Exploited vulnerabilities

Barracuda Email Security Gateway: two chained flaws

On 10 November 2026 CISA added CVE-2026-116606 and CVE-2026-111560 to the KEV (CISA KEV). The first, on the Email Security Gateway (ESG) only, lets an attacker without credentials who can reach the administration interface import a modified configuration (CVSS 4.0: 9.3). The second lets an administrator run commands as root and also affects Load Balancer ADC, Message Archiver, Web Application Firewall, WAF Control Center and Web Security Gateway (CVSS 4.0: 8.6). Together, the two flaws give root access to the appliance (Barracuda, Mandiant).

Barracuda published the advisory on 2 November 2026 and on 9 November added that it had observed exploitation against a small number of organisations. Patches may not have been applied automatically: Barracuda asks customers to check each appliance, apply missing patches by hand and remove the administration interface from the internet. EPSS puts the probability of exploitation of CVE-2026-116606 in the next 30 days at 10.9%, in the top 4% of known vulnerabilities (FIRST EPSS).

SonicWall SSL VPN: SAML authentication and MFA can be bypassed

On 6 November 2026 CISA added CVE-2026-19868 to the KEV. On the SonicOS SSL VPN, a user with valid credentials for an alternative authentication method can bypass the SAML check and, with it, multi-factor authentication enforced through SAML (CVSS 3.1: 7.5). Affected versions are SonicOS Gen7 up to 7.3.3-7015 and Gen8 up to 8.2.2-8015 (NVD, SonicWall). The CISA deadline for US federal agencies is 20 November 2026.

OpenSSH on some Linux systems

On 9 November 2026 CISA added CVE-2026-123158, an OpenSSH authentication bypass on Linux, to the KEV (CISA KEV). According to the release notes, it concerns password authentication on systems built without PAM, such as those based on the musl library, and is fixed in version 10.6p2 of 5 November 2026 (OpenSSH). EPSS puts the probability of exploitation at 18.9%. The CVSS score was not available on NVD at the time of collection.

Other entries

CVE-2026-123218, IBM Aspera Faspex, file transfer software: an authenticated user can escalate privileges (CVSS 3.1: 9.8) (IBM).
CVE-2026-124194, Microsoft Outlook: allows spoofing over the network without warning the user of an unsafe action (CVSS 3.1: 6.5) (Microsoft).
CVE-2026-125350, Google Chromium: code execution inside the sandbox through a web page, also affecting Edge and Opera (CVSS 3.1: 8.8) (Google).
CVE-2026-20320, Cisco BroadWorks: reading of confidential configuration without credentials (CVSS 3.1: 7.5) (Cisco).
CVE-2026-116779, SignalWire FreeSwitch, VoIP switching: command execution and access to credentials (GitHub).
CVE-2026-102895, GPUStack, AI model management: administrator access without credentials (CVSS 3.1: 9.8) (GitHub).
CVE-2026-111793, Openwave Webtop Media Transcoder: conversion of unintended document types by an authenticated user (CVSS 3.1: 4.3).
According to CISA, none of the 11 entries is known to be used in ransomware campaigns.

Ransomware

From 6 to 12 November 2026 ransomware.live recorded 374 claims on the leak sites of criminal groups, against an average of 254 over the previous four weeks. These are statements by the groups, not verified incidents (ransomware.live).

Groups. N0n is the most active with 98 claims, against an average of 26: 67 were published on 9 November and 75 concern US (61) and Canadian (14) companies (ransomware.live). INC Ransom has 46 in the weekly count, against an average of 5, almost all published on 12 November (ransomware.live). Next come The Gentlemen (22), Climax Inc (17) and Qilin (16).
Sectors. Manufacturing 40, healthcare 35, professional services 35, technology 32, retail 29 (average 15). For 105 claims the sector is not stated.
Countries. United States 166 (average 86), Canada 25 (average 7), Germany 14, United Kingdom 12.

Italy and Europe

Claims in Italy. Five: one in healthcare and one unclassified (N0n), one in energy (Settra), one in professional services (Nightspire), one unclassified (Shiba) (ransomware.live).
Phishing. In the week from 31 October to 6 November 2026 CERT-AGID counted 217 campaigns, 187 targeting Italy: the previous week there were 121, of which 76 targeting Italy. The fines theme accounts for 98, almost all using the SEND brand. The most widespread malware are AgentTesla and Remcos, and 1,097 indicators of compromise were shared (CERT-AGID).
Fake INPS site. On 11 November 2026 CERT-AGID reported a fake site of INPS, the Italian social security institute, spread by SMS, inviting users to download a fake "INPS Mobile" Android app outside the official stores. The file was not malicious at the time, but the setup allows it to be replaced at any moment with a malicious app (CERT-AGID).
ENISA. No news published in the period.

For insurers

Impact for insurersMedium

Ransomware claims rose by 47% and two perimeter products have exploited flaws, but most of the rise in claims comes from two bulk publications and none of the new vulnerabilities is linked to ransomware campaigns.

With exploited flaws on an email gateway and a VPN in the same week, it is worth checking how many insureds in the portfolio use Barracuda and SonicWall: a large-scale attack on one of these products would hit many of them at once (accumulation risk).