Four critical flaws in one week, one already exploited. Patch SAP first

Start with SAP

ICM2SHELL is a heap memory-corruption bug in the SAP Kernel's WebSocket reassembly process, and SAP rates it CVSS 10.0, the maximum score. An unauthenticated attacker can execute operating system commands as the SAP admin user. It affects NetWeaver AS ABAP on kernel 7.40 and later, and SAP Web Dispatcher, including the dispatcher embedded in SAP HANA XS. A 10.0 that needs no login and reaches the admin account is the first thing on the list, whatever else the week holds. m:…5850

No public exploitation of ICM2SHELL had been reported as of November 14, 2026, according to Ostorlab's research, which is the good news and also the reason to move now rather than after the first report. Patched components must be restarted to load the updated kernel binary, so the patch is not done until the restart is done. Disabling WebSocket support is a workaround, but it breaks certain Fiori and integration scenarios. SAP released 43 new and updated security notes in November 2026, and ICM2SHELL is the one to clear first. m:…5850

Already being exploited

The UnrealIRCd flaw is the one already in use. CVE-2026-114713 is a command injection flaw in the labelled-response module that lets ordinary users inject server-to-server commands, which then run with server authority. CISA added it to the Known Exploited Vulnerabilities catalog on November 13, 2026, and exploitation is active according to CISA's SSVC record. m:…5853

Versions 6.0.0 to 6.2.7 are affected, and the fix is 6.2.7.1, with a hot-patch released on November 7, 2026. The flaw needs two or more linked servers to be exploitable, because the injected command has to be relayed to a peer before it is parsed as a trusted server command, and a single unlinked server is not exposed to that path. That limits the blast radius, but any linked network running an affected version should treat this as an active incident, not a scheduled patch. m:…5853

The other two, plus the bait

SeaDoc's flaw is the quietest and possibly the nastiest for smaller teams. CVE-2026-129167, rated CVSS 9.2, affects SeaDoc versions 2.0.4 to 2.0.10 and 3.0.0 to 3.0.7. An anonymous holder of a public share link can write a Python package into the converter's library path and execute it, because the converter uses an attacker-controlled filename as an absolute path during ZIP extraction. The official Docker Compose deployment runs the converter as root, which raises the impact of a successful attack. The fix is Haiwen's patched server component, released November 2, 2026. m:…5851

Dropbear SSH has a restriction bypass with no CVE assigned as of November 14, 2026. It enforces per-destination restrictions for TCP forwarding but not for unix-socket forwarding, checking only the coarse no-port-forwarding flag. Researcher knell scores it 9.9 when the account can reach the Docker socket, because the Docker API can start a container with the host filesystem mounted, which is host root. All releases through 2026.94 are affected. Administrators can mitigate it by adding no-port-forwarding to every key that carries permitopen or permitlisten, or by starting the server with flags that disable forwarding entirely. m:…5852

Finally, Huntress found 2,223 unauthorised ScreenConnect sessions across 118 servers, with operators revisiting servers every 151 seconds to create or reconnect sessions. Huntress suspects the sessions are bait for CVE-2026-84869, a critical flaw that lets malicious guests trigger unauthorised file-transfer actions on technician workstations. The advice is to upgrade ScreenConnect host clients to 26.6.5 or later. The campaign does not match the pattern of a malware sandbox, and Huntress found no overlap with the SCKit worm indicators, so this is a live operation with a purpose. m:…8840