zero-day

Patch now · Disclosed · ○No patch yet · since 12 Nov 2026 · updated 13 Nov 2026

A new Windows zero‑day, named SignDrop, was disclosed that allows attackers to obtain SYSTEM privileges through a signature‑validation flaw. The vulnerability is unpatched and rated critical.

Do:Monitor for signs of SignDrop exploitation and apply mitigations.

Patch now · Exploited · ●Patched · since 10 Nov 2026 · updated 11 Nov 2026 · CVE-2026-124194

Microsoft addressed a heavily exploited zero-day vulnerability in Outlook during its November 2026 Patch Tuesday updates. The flaw is part of a broader batch of security fixes released by the vendor.

Do:Apply the latest security updates provided by Microsoft for Outlook.

Patch now · Exploited · ◐Partly patched · since 6 Nov 2026 · updated 11 Nov 2026 · CVE-2026-125350

An anonymous report disclosed a high-severity use-after-free flaw in Google Chrome's XML component. The vulnerability is currently being exploited in active attacks in the wild.

Do:Update Google Chrome to the latest version immediately.

Research · since 9 Nov 2026 · updated 13 Nov 2026

N-able took hosted N-central environments offline after a researcher published over thirty alleged zero-day flaws. The vendor also advised on-premises customers to shut down their servers.

Do:Disable the Legacy API or restrict its exposure to the public internet on on-premise N-central servers.

Patch now · Exploited · ●Patched · since 4 Nov 2026 · updated 5 Nov 2026 · CVE-2026-107441, CVE-2026-7273

Zyxel patched a zero-day flaw in its GS1900 series switches that attackers actively exploited to compromise nearly 1,000 devices. The breach allowed attackers to exfiltrate configuration files and credentials.

Do:Update Zyxel GS1900 series switches to the latest firmware immediately.

Breaches & attacks · Exploited · since 28 Oct 2026 · updated 29 Oct 2026

Patch now · Exploited · ●Patched · since 27 Oct 2026 · CVE-2026-86950