Issue of Nov 7, 2026

Flaws worth knowing

SonicWall SSL-VPN: the MFA bypass is being exploited, and CISA set a deadline. CVE-2026-19868 lets an attacker holding valid credentials for an alternate authentication method bypass SAML authentication controls on the SSL-VPN service, including SAML-enforced MFA. SonicWall PSIRT investigated a report of exploitation, and CISA added the flaw to its KEV catalog on November 6 with a November 20 deadline for federal agencies. Affected: SonicOS Gen7 up to 7.3.3-7015 and Gen8 up to 8.2.2-8015 when SSL-VPN uses SAML. Fixed in 7.3.4-7013 and 8.2.3-8015, no workarounds available. The full advisory sheet publishes today.

Barracuda ESG: the remote-access chain just became pre-authentication. The advisory published November 2 for CVE-2026-116606 was revised on November 5: exploitation no longer requires administrative access, only that the appliance's Admin UI is reachable by the attacker. That moves the ESG mail gateway, the anti-phishing layer in front of the front desk and reservations, from an insider-adjacent risk to an internet-facing one. Confirm the Admin UI is never reachable from the internet and apply build 9.4.017 or later.

WatchGuard AuthPoint: four flaws published, one rated 9.2. Four vulnerabilities hit the AuthPoint Gateway, WatchGuard's MFA server: unauthenticated deletion of the directory-sync configuration (CVE-2026-121639, 9.2), forgeable LDAP authentication results (8.9), interception through a certificate-validation flaw (9.1) and capture-replay authentication bypass (9.1). Deployments backed by an LDAP or Active Directory provider are most exposed. Fixed in AuthPoint Gateway 7.6.0.

Johnson Controls Control Cures: system credentials readable in logs. CVE-2026-106019 (8.8), published November 6 by the vendor itself, leaks sensitive information into the logs of the C-CURE 9000 and Victor access-control platform, enough to enable use of known operating-system credentials. CVE-2026-106020 (8.6) separately hits the EasyIO Neo IO Manager used in building-management deployments. C-CURE runs hotel groups and mixed-use properties, which makes those log files loot. No exploitation reported to date.

Trends

Hotel cold chains land in US federal guidance. CISA and partner agencies published joint guidance on November 5: malicious activity is targeting electronic temperature controllers and cold-storage monitoring systems, following the October waves that forced European freezers to 50 degrees. Kitchen cold rooms, spa storage, plant control: ask your refrigeration contractor for a written inventory of its remote-access paths and cut the ones nobody uses.

nginx: the patch wave reaches hosting providers. Ubuntu builds shipped November 5 (USN-8955-1 and -2) fix October's three critical flaws, two of them heap overflows rated 9.2 reachable on common alias and map configurations. nginx fronts a large share of hotel booking endpoints and microsites. Ask your host what runs in production: 1.30.6 or 1.31.7 minimum, or the distro equivalent.

On the wire

Turning Stone: five days without cards, the cash-contingency lesson. The November 2 cyberattack took networks, phones, ATMs and card payments down across Turning Stone Enterprises (Oneida Nation) properties: casinos, hotels, gas stations and convenience stores. Card acceptance was only restored on November 5, with some operations cash-only through the weekend, and no confidential-data compromise is assumed to date. The reference scenario for any property: fallback payment procedure, autonomous phones, a deferred-processing queue for reservations.

Quest Hotels: the final count on the third-party breach lands. The Australian aparthotel operator closed its forensic investigation of the August 17 incident: 1,991,613 customers affected, including 46,727 card numbers with CVV and 104,268 passport or driver-licence numbers. The third-party technology provider behind the vulnerability remains unnamed. The logical follow-on: targeted phishing waves against guests, and a question to ask every vendor that holds your booking data.

Lightspeed: payout delays for L and K series merchants. An incident opened November 5 warns of possible delays to November 4 payouts for a subset of L and K series merchants, while two inventory incidents hit the X and C ranges on November 6. Hotel food-and-beverage outlets running Lightspeed should reconcile their weekend deposits.

Ruckus: first matrix on the brotli flaw family. Bulletin of November 6: standalone access points and ICX and FastIron switches are assessed not vulnerable; for RUCKUS One and RUCKUS AI, no exploitable Brotli decode path has been identified in the services reviewed to date, with precautionary image updates underway. SmartZone and Unleashed remain under examination, the matrix finalizes next tick.

Omni Hotels: the leak-site claim climbs to 1.4 terabytes. The Redact group, which listed Omni Hotels & Resorts on November 5, now claims the full customer reservation database: names, phones, emails, addresses and booking dates. No Omni statement confirms or denies as of today. Until the operator speaks, the file stays rumor status; guest and staff phishing vigilance is justified right now regardless.