Afternoon Review in IT Security — November 10, 2026

The cybersecurity landscape continues to face mounting pressure as critical vulnerabilities emerge across major infrastructure software platforms. Today's threat intelligence reveals active exploitation campaigns targeting widely deployed systems, alongside a growing roster of zero-day flaws that demand immediate patching attention from enterprise security teams.

Critical Apache Airflow RCE Flaw Allows Attackers to Execute Code Without Authentication

A critical remote code execution vulnerability has been identified in Apache Airflow that permits attackers to execute arbitrary code on worker nodes without requiring authentication credentials, a valid DAG, or access to the scheduler. The vulnerability, tracked as CVE-2026-68982 and classified under CWE-306 for missing authentication on critical functions, requires only write access to the Celery message broker to facilitate the attack. Source: Critical Apache Airflow RCE Flaw Allows Attackers to Execute Code Without Authentication. Organizations running vulnerable versions of Airflow are advised to prioritize patching efforts immediately, as the attack vector is straightforward and requires minimal prerequisites for exploitation.

CISA Confirms Hackers are Exploiting SSHole, the OpenSSH Vulnerability

The Cybersecurity and Infrastructure Security Agency has confirmed active exploitation of SSHole, an OpenSSH authentication bypass vulnerability tracked as CVE-2026-123158. This flaw enables remote attackers to gain unauthorized access to specific Linux accounts without presenting valid passwords or SSH keys, affecting systems with certain server configurations. The vulnerability carries a CVSS severity score of 8.1 and was formally added to CISA's Known Exploited Vulnerabilities catalog on November 9, 2026, with a deadline of November 12 for remediation. Source: CISA Confirms Hackers are Exploiting SSHole, the OpenSSH Vulnerability. The confirmation of active exploitation underscores the urgent need for system administrators to apply patches across their infrastructure.

Chrome Zero-Day Whack-A-Mole Continues as 2026 Tally Hits 8

Google has patched another memory corruption vulnerability in Chrome, marking the eighth zero-day flaw addressed in 2026, though attackers had already obtained working exploits before the patch became available. The newly patched vulnerabilities are tracked as CVE-2026-125346 and CVE-2026-125350. Source: Chrome zero-day whack-a-mole continues as 2026 tally hits 8. The persistent discovery of zero-day flaws in Chrome demonstrates the ongoing challenge of securing widely deployed browser software against sophisticated threat actors.

SAP Patches ICM2SHELL and PROXYGATE Maximum Severity Flaws

SAP released critical security updates addressing 35 vulnerabilities in its November 2026 patch cycle, including four maximum-severity issues affecting NetWeaver, Web Dispatcher, and Gateway software. The maximum-severity vulnerabilities include CVE-2026-120017, CVE-2026-44756, CVE-2026-58231, and CVE-2026-76964, alongside additional critical flaws tracked as CVE-2026-89103, CVE-2026-89111, and CVE-2026-89126. Source: SAP patches ICM2SHELL and PROXYGATE maximum severity flaws. These maximum-severity flaws enable unauthenticated remote code execution, making timely deployment of patches essential for organizations relying on SAP infrastructure.

Security teams face a critical window to address these vulnerabilities before threat actors develop and deploy weaponized exploits at scale. Prioritizing patches for Apache Airflow, OpenSSH, and SAP systems should take precedence in today's threat environment.