Podcast Detail

SANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119618); Fortinet FortiMail Criticals; Ivanti EPM SQLi (CVE-2026-121653); Windows SignDrop CLFS; N-able N-central HF2

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10176.mp3

previous
Podcast Logo
Apache mod_http2 RCE (CVE-2026-119618); Fortinet FortiMail Criticals; Ivanti EPM SQLi (CVE-2026-121653); Windows SignDrop CLFS; N-able N-central HF2
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

This episode covers leftover Patch Tuesday issues: a critical remote code execution flaw in Apache HTTP Server's mod_http2 module (CVE-2026-119618), Fortinet's 89 advisories with 17 critical vulnerabilities especially in FortiMail, Ivanti's November 2026 update including an Endpoint Manager SQL injection and a Cloud Services Application certificate issue, an unpatched Windows Common Log File System privilege escalation called SignDrop, and N-able's N-central 2026.4 Hotfix 2.

Apache HTTP Server mod_http2 Remote Code Execution (CVE-2026-119618)
Apache released HTTP Server 2.4.71, fixing a critical heap overflow in the mod_http2 assign_headers function that can lead to remote code execution. No public working exploit is available yet; disabling HTTP/2 can mitigate the issue, but proxies that translate to HTTP/2 still need to watch for HTTP request smuggling.
https://httpd.apache.org/security/vulnerabilities_24.html

Fortinet November Advisories
Fortinet published 89 advisories addressing more than 100 vulnerabilities across its product portfolio, including 17 rated critical. FortiMail received the most critical fixes, and several of the critical issues may allow unauthenticated arbitrary code execution. Fortinet used AI as part of the vulnerability discovery work behind this release.
https://www.fortiguard.com/psirt

Ivanti November 2026 Security Update
Ivanti's November 2026 security update includes a SQL injection in Endpoint Manager (EPM) that may be leveraged for remote code execution, tracked as CVE-2026-121653, and a vulnerability in Ivanti Cloud Services Application (CSA) that allowed unauthenticated alteration of trusted EPM Core certificates (CVE-2026-121683).
https://www.ivanti.com/blog/november-2026-security-update

Windows SignDrop CLFS Privilege Escalation
Researcher Nightmare Eclipse (MSNightmare) released SignDrop, a local privilege escalation in the Windows Common Log File System (CLFS) that abuses the HMAC-based log-file authentication Microsoft added about a year ago, along with symlink and timing tricks. A regular user can escalate to SYSTEM on Windows 11 26H2 and Windows Server 2025. A proof-of-concept is on GitHub; Microsoft has not confirmed the issue, there is no CVE, and disabling CLFS log authentication is not a recommended workaround because it would restore older CLFS attacks.
https://github.com/MSNightmare/SignDrop

N-able N-central 2026.4 Hotfix 2
N-able has released N-central 2026.4 Hotfix 2, and the release notes identify three CVE numbers addressed in the update, after N-able earlier shut down its hosted infrastructure in response to the reported vulnerabilities. The initial public reports described around 30 vulnerabilities, and attackers are already probing leaked paths. Shadowserver's count of exposed N-central servers dropped from about 1,338 to around 148. On-premises operators should apply the hotfix before bringing a server back online and still avoid exposing it if possible.
https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Podcast Transcript

 Hello and welcome to the Thursday, November 12, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich. We're recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in
 Cybersecurity Engineering. And as so often after a Patch
 Tuesday, we have a bit of a cleanup episode here today
 covering issues that we may have missed. Apache, for
 example, today released an update fixing a critical
 vulnerability in mod_http2. The vulnerability allows for
 remote code execution. The problem here is that during
 stream processing, the assign_headers function is used to
 assign request headers to specific streams. That's where
 a heap overflow happens. And well, that of course, then
 could potentially be used to trigger remote code execution.
 No working exploit has been made public yet. Disabling
 HTTP/2 can be used to mitigate the issue. Of course, you may
 run into other issues. If you, for example, have proxies
 translating to HTTP/2, you have always to be careful with HTTP
 request smuggling in this case. And Fortinet published
 89 different advisories addressing more than 100
 different vulnerabilities across its product portfolio.
 17 of these vulnerabilities are considered critical, FortiMail
 being sort of the product with the most critical
 vulnerabilities being addressed in this update. Now,
 several of the critical issues may lead to arbitrary code
 execution without authentication. Too many
 vulnerabilities really to talk in detail on about each
 particular vulnerability. But well, if you have Fortinet
 products in your environment, there's probably a patch that
 you must apply. And now for these product. And as
 listeners probably expect when they hear about that many
 vulnerabilities all of a sudden popping up. Yes, AI
 took a part in discovering these vulnerabilities. And
 Ivanti also released its November 2026 security update.
 Now in this update, there is one patch for another SQL
 injection vulnerability, in Endpoint Manager. This SQL
 injection vulnerability may be leveraged to accomplish remote
 code execution. And then we also have a vulnerability in
 Ivanti CSA that allowed altering trusted EPM Core
 certificates without authentication. And then we
 got another, well, Saturday, Wednesday after patch Tuesday,
 thanks to Nightmare Eclipse. Nightmare Eclipse released
 what they're calling SignDrop. SignDrop is a privilege
 escalation vulnerability in the Windows Common Log File
 System. What makes this kind of interesting is that about a
 year ago, Microsoft added HMAC based authentication to CLFS
 log files to make it harder to abuse them in response to some
 of the vulnerabilities in this overall system. While SignDrop
 abuses exactly that new feature with some symlink and
 timing tricks, a regular user can escalate to system on
 Windows 11, 26H2 and Windows Server 2025. A proof of
 concept exploit has been posted to GitHub. So far,
 Microsoft has not confirmed the issue. There is no CVE
 number. I have not seen any reports of it being exploited.
 And as tempting as it may be, disabling CLFS log
 authentication is probably not a good workaround. Again, that
 was specifically established to prevent other security
 issues. It would bring back some of these older CLFS
 attacks that before that feature was introduced. And a
 quick follow up to the N-able N-central story from earlier
 this week. N-able has now released the 2026.4 hotfix 2 for
 N-central. And with that release notes explaining what
 they're fixing here. They're identifying three different
 CVE numbers that are addressed in this update. Now, if you
 remember N-able shut down actually its own sort of cloud
 -based infrastructure in response to these
 vulnerabilities being reported to N-able. And yes, now we get
 the patch for it. The initial news release, I think, talked
 about like 30 vulnerabilities. So not sure if these are just
 the sort of the critical ones they're patching here. They're
 actually being exploited right now. Or if they sort of
 consolidated some of these vulnerabilities. There are
 some reports that attackers are already probing for
 vulnerable paths that were leaked. Of course, there have
 been a lot of issues with N-able N-central in the
 past. This could be also some older stuff. The good news,
 many of you appear to have listened. Shadowserver's count
 of exposed N-central servers dropped from about 1,338 to
 around 148. So almost like a factor of nine or 10 here. If
 you run N-central on premise, apply the hotfix before you
 bring the server back online. And probably still avoid
 exposing it if you can help it. Well, and that's it for
 today. Thanks for listening. Thanks for liking. Thanks for
 subscribing. And talk to you again tomorrow. Bye. You