Actively Exploited Vulnerabilities: What to Patch Now (November 2026)

The short version

If you run any of the products below, patch them (install the vendor's fix) before anything else on your list. Every one of them has been used in real attacks. Most are edge devices: equipment that faces the internet and sits in front of your network. Remote access gateways and firewalls are the favorite way in for ransomware gangs (criminals who lock or steal your data and demand payment). A missed patch here is far more dangerous than a missed patch on a laptop.

At a glance: what to patch

Share this table with your IT team or provider. Each CVE is the public ID number for one flaw, and the last column shows the version that fixes it.

Citrix NetScaler zero-days (CVE-2026-88771 and CVE-2026-88772)

NetScaler is a Citrix device many companies use for remote access to their network. Citrix made both flaws public on 27 September 2026. It confirmed they were zero-days: flaws attacked before a fix existed. CVE-2026-88771 lets an attacker run commands with no login, and it works in the default setup. CVE-2026-88772 is a memory overflow that matters when DTLS is on, which is the default on VPN virtual servers. Both are rated 9.5 (CVSS v4).

Attackers have used them to run commands on the device and plant PHP web shells, hidden pages that let them get back in later. Palo Alto Networks Unit 42 counted roughly 50,000 exposed devices.

• Fix: upgrade to 14.1-73.37 or 13.1-64.23 or later (FIPS and NDcPP builds have their own fixed versions).
• Then: look for web shells and unexpected files. Change the passwords, keys and session tokens that passed through the device.
• Also: a related flaw for SAML setups, CVE-2026-88779, followed in early October. It can knock the device offline (denial of service) and needs a further upgrade.

Ivanti Connect Secure attack chain

Ivanti Connect Secure is a VPN gateway that lets staff connect to the company network from outside. Attackers combined three of its flaws as zero-days: a login bypass, a way to gain higher rights and a predictable ID issue. Together they gave full control (root) of devices that were fully patched at the time. Volexity saw attacks from 3 October 2026. The attackers also changed logs, which helps them avoid Ivanti's Integrity Checker Tool.

The first fixes were not enough. You need 22.8R2.6 or 25.1.1.3. If your device was exposed in October, treat it as possibly breached. Patching does not remove an attacker who is already inside. Look for signs of a break-in and change passwords and keys.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

PHP is the programming language behind WordPress and many other websites. PHP2Shell is two memory-handling flaws in PHP itself, fixed on 21 October 2026 and added to CISA's KEV catalog on 26 October. They let an attacker run code on the server with no login (CVSS v4 9.2). Amazon saw an attack attempt four days before the flaws were made public. Apache with mod_php is seen as the highest-risk setup. Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP.

Read our full explainer: PHP2Shell: what it is and how to fix it.

OpenSSH "SSHole" (CVE-2026-123158)

OpenSSH is the standard tool admins use to log in to servers remotely. This one moved fast. OpenSSH 10.6p2 shipped on 5 November. A public exploit (ready-made attack code) appeared about four hours later, and the first successful attacks came two days after that. It only affects Linux systems built with musl libc and PAM disabled. That mainly means Alpine Linux, which is common in containers. Debian and Ubuntu are reported as unaffected.

Read our full explainer: SSHole: what it is and how to fix it.

Palo Alto, Cisco, SonicWall: more edge devices

These are firewalls, email filters and VPNs that sit at the edge of your network. Each one needs a firmware or software update.

• PAN-OS CVE-2026-0322 (disclosed 14 October): PAN-OS runs Palo Alto firewalls. Anyone with admin login details who can reach the admin page can take full control (root). Palo Alto reports very limited attacks. Patch, and make sure the admin page can only be reached from trusted IP addresses. Cloud NGFW and Prisma Access are not affected.
• Cisco Secure Email Gateway CVE-2026-76519 (exploited, confirmed 14 October): a path traversal flaw in the AMP feature, rated 9.8. A crafted email attachment gives the attacker full control (root). It is the second exploited flaw in this product since mid-September.
• SonicWall SSL VPN CVE-2026-19868 (added to KEV 6 November): attackers who already have a valid password can skip MFA. That is the second login check, such as a code on your phone. Only devices that use SAML login are affected. There is no workaround, so upgrade the firmware.

Outlook and Chrome: user-side zero-days

These two flaws hit ordinary staff computers, so they matter even if you run no servers.

Outlook CVE-2026-124194 was fixed in the November 2026 Patch Tuesday (Microsoft's monthly update day) and is being used in attacks. Opening a crafted message file makes classic Outlook connect to an attacker's server. It then leaks the user's NTLMv2 hash, a scrambled form of their Windows password. The attacker can use that to pose as the user. The Preview Pane is not an attack path. Apply the November updates. Where you can, also block outbound SMB and restrict NTLM.

Chrome CVE-2026-125350 is a memory flaw (use-after-free) in XML handling. Google says it is being used in attacks. It is the eighth exploited Chrome zero-day of 2026. Make sure browsers have actually restarted onto 157.0.8103.50 or later. An update that is waiting for a restart does not protect anyone.

What this tells us about 2026

1. Edge devices are the main target. VPNs, gateways and firewalls from almost every major vendor had exploited flaws within a few weeks.
2. The gap between fix and attack is now hours. Plan to patch internet-facing systems within 24 to 48 hours in an emergency.
3. The number of fixes has exploded. Microsoft fixed well over a thousand CVEs in October alone. Many were found with the help of AI tools. Only a handful are used in attacks, which is why you should fix those first.
4. Patching is not the end. For exploited edge devices, check for a break-in and change passwords and keys after you patch.

Need help making this a routine? See our vulnerability management guide and what a zero-day vulnerability is.