November 11, 2026 brings critical security disclosures affecting major enterprise infrastructure. Fortinet has released patches for severe remote code execution vulnerabilities, Microsoft has confirmed active exploitation of an Outlook zero-day, and the monthly Patch Tuesday cycle addresses over 1,300 vulnerabilities. Additionally, security researchers have uncovered coordinated espionage campaigns targeting critical sectors globally.
Fortinet disclosed critical security vulnerabilities affecting FortiManager, FortiAnalyzer, and FortiOS on November 10, 2026. The flaws include weaknesses in management APIs, device communication services, routing, and specific high availability configurations that could allow attackers to execute code without authentication. Eight CVE identifiers have been assigned to these vulnerabilities, including CVE-2026-126170, CVE-2026-126229, CVE-2026-126253, CVE-2026-126254, CVE-2026-126259, CVE-2026-126260, CVE-2026-126261, and CVE-2026-126262. Attack requirements vary depending on enabled features and network access levels, making exposure assessment dependent on individual deployment configurations. Source: Critical Fortinet Flaws Expose FortiManager and FortiAnalyzer to Remote Code Execution Without Login
Microsoft has confirmed active exploitation of an Outlook zero-day vulnerability tracked as CVE-2026-124194. The spoofing vulnerability allows attackers to expose Windows authentication information when users open malicious files, potentially leading to credential theft. Microsoft patched the flaw on November 10, 2026 and marked it as "Exploitation Detected," indicating that threat actors are actively leveraging the vulnerability in the wild. The vulnerability was not publicly disclosed prior to the patch release. Source: Microsoft Confirms Hackers Are Exploiting Outlook 0-Day to Steal Windows Authentication Hashes
Microsoft released its November 2026 security update addressing 1,328 vulnerabilities across multiple products. The release includes 60 vulnerabilities marked as critical, with 45 of those carrying remote code execution potential. The patch cycle encompasses numerous CVE identifiers spanning critical infrastructure and widely deployed enterprise software. Source: Microsoft Patch Tuesday for November 2026 — Snort rules and prominent vulnerabilities
Check Point Research has identified three distinct threat activity clusters with shared infrastructure and malware code similarities targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe. The campaigns, tracked under names including SilentDelivery, utilize a malware ecosystem encompassing CopperDoor, Crowdoor, HemiGate, SparrowDoor, SparroWocky, SquadC, SquawkDoor, and TernDoor. The coordinated espionage activity demonstrates sophisticated nation-state targeting of critical sectors over the past year. Source: Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem
Security teams should prioritize patching critical Fortinet and Microsoft vulnerabilities while monitoring for indicators of compromise related to the newly disclosed espionage campaigns. The combination of active zero-day exploitation and high-volume patch requirements underscores the elevated threat landscape facing organizations today.
Source articles and extracted indicators (defanged where appropriate).
