Podcast Detail

SANS Stormcast Tuesday, November 10th, 2026: SAP NetWeaver Webshells (CVE-2025-31324); N-able N-central Offline; Chrome XML 0-Day (CVE-2026-125350); Outlook DMARC Required

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10172.mp3

previous
Podcast Logo
SAP NetWeaver Webshells (CVE-2025-31324); N-able N-central Offline; Chrome XML 0-Day (CVE-2026-125350); Outlook DMARC Required
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Today's episode covers attackers hunting SAP NetWeaver webshells from CVE-2025-31324, N-able taking N-central offline after dozens of unpatched flaws, a Chrome XML use-after-free zero-day, and Outlook rejecting mail without DMARC.

Attackers Searching for SAP NetWeaver Webshells
ISC honeypots are seeing probes for ant.jsp and related paths tied to SAP NetWeaver CVE-2025-31324, a CVSS 10 unauthenticated file-upload flaw attackers still use to plant webshells even after recent patches. Watch /irj/servlet_jsp/irj/root/ and other upload endpoints for leftover shells.
https://isc.sans.edu/diary/Attackers%20Searching%20for%20SAP%20Netweaver%20Webshells/33502

N-able N-central Critical Security Incident
N-able took Hosted N-central offline after public disclosure of roughly 30+ critical vulnerabilities with no patches yet, and advises on-premises customers to take servers offline if not isolated; no exploitation observed so far, with remediation said to be on track.
https://uptime.n-able.com/
https://labs.beazley.security/advisories/BSL-A1242

Google Chrome Zero-Day Patch (CVE-2026-125350)
Chrome stable updates fix nine vulnerabilities, including CVE-2026-125350, a use-after-free in the XML parser that Google says is already exploited in the wild. Update promptly; the advisory does not confirm a sandbox escape.
https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html

Strict Outlook DMARC Policies
Outlook is rejecting mail with 550 errors when the sending domain lacks a DMARC record, even if SPF and DKIM pass. Publish at least a DMARC record (for example p=none) alongside SPF and DKIM.
https://learn.microsoft.com/en-us/answers/questions/6063865/550-5-7-1-message-rejected-message-lacks-spf-dkim

SANS Difference Makers Vote
https://www.sans.org/go/difference-makers-awards-2026

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Podcast Transcript

 Hello and welcome to the Tuesday, November 10, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Washington, D.C. And this episode is brought to you by
 the SANS.edu Graduate Certificate Program in
 Cybersecurity Engineering. Well in Diaries today we do
 have web shells. This time the web shell that sort of caught
 my attention was one that looks like it was placed via
 an SAP Netweaver vulnerability. Not a new
 vulnerability, has a 2025 CVE but still something that
 apparently still gets exploited even if you did
 patch it recently. Well take a look at the web shells being
 planted here. Fairly standard stuff it looks like like ant
 .JSP is the file name. Now it's not the only
 vulnerability they're going after. They're also going
 after a number of other vulnerabilities, PHP
 vulnerabilities and the like. But this SAP Netweaver was the
 one that sort of really stuck out somewhat here. So as
 always keep looking for web shells. That's one of the top
 ways how attackers take advantage of vulnerabilities
 in web applications. In particular in this case this
 Netweaver vulnerability is basically just a simple upload
 vulnerability. So an attacker may upload any file to the
 system. And with that of course an obvious way to
 exploit the vulnerability is uploading a web shell. So
 N-able today announced that it took down its n-central hosted
 environments. This came after someone did publish I believe
 30 different vulnerabilities that affect the current
 version of N-able. And there are no patches at this point
 available for this. So of course the problem comes up if
 you're self hosting N-able or n-central really. You probably
 want to take it down as well and follow here N-able's lead
 what it did with its cloud environment. On the other hand
 they also suggest if you sufficiently secured it
 meaning you isolated it. You should be fine. They haven't
 yet detected any exploitation of these vulnerabilities. But
 of course the vulnerability details have been made
 available publicly. So it's probably just a matter of a
 little bit of time to see these vulnerabilities
 exploited. They also don't sort of have a timeline at
 least at the time at which I'm reading this. When their
 hosted environment will be enabled again. But they do
 state that the remediation is on track. And they hope to
 soon have in their hosted environment these
 vulnerabilities mitigated. And then be able to again enable
 public access to the n-central hosted environment. That of
 course doesn't mean that they immediately will have patches
 for these vulnerabilities. So your on-premise version of n
 -central may need to stay down a little bit longer. Google
 updated the stable channel for Google Chrome fixing nine
 different vulnerabilities. One of which is already being
 exploited. So we got a zero day here. This vulnerability
 is a use after free vulnerability in the XML
 parser. And yes with that can probably be exploited to
 execute arbitrary code. They don't really say anything
 about a possible sandbox escape or such. So there may
 be a little bit more work to be done to actually sort of
 get to a full compromise from this particular vulnerability.
 Well and if all of a sudden you're seeing rejected emails
 from Outlook 365 with a 550 message rejected error. This
 points to you probably missing a DMARC policy. In the past
 Microsoft only required that you have a valid SPF and DKIM
 record. Well now you also must have a DMARC record in order
 to have your email accepted by Outlook 365. So definitely
 take a look at that and check if you're all set with this.
 This has become more and more sort of the standard where you
 must have SPF, DKIM and DMARC. Where DMARC of course tells
 the recipient what to do if your SPF or DKIM policy is not
 aligned with a particular email that you send. Well this
 is it for today. So thanks for listening. Thanks for liking.
 Thanks for recommending this podcast. And special thanks if
 you can find the five minutes to vote for me in the
 Difference Maker Award. There's a link to the voting
 page in the show notes. So thanks and talk to you again
 tomorrow. Bye.