Seven patch items from advisories of 3 and 4 November 2026 belong on this week’s patch list. The ranking uses four tests in order. First comes a CISA KEV listing, then whether an unauthenticated remote attacker can reach the flaw, then the vendor’s own score. Last is what falls if the flaw is used, such as a management plane, keys or credentials.
Scores are quoted as each primary source gives them. Where a source gives none, we say so and rank on what is published. Key Manager Plus (21 August) and NoMachine (14 September) shipped their fixes before 4 November, and the advisories are what is new. A summary table with the fixed versions closes the post.
1. Citrix Scout and XenServer: a KEV flaw in Scout, a critical bug in XenServer
CERT-FR advisory CERTFR-2026-AVI-1449 covers Citrix bulletins CTX697256 and CTX697300, which it dates 3 November 2026. It lists remote code execution and privilege escalation as the risks. Affected are Scout Cloud Gateway On-Prem without fix 2605.1-3, UniconOS Management (Scout) On-Prem without 2609.1, and its LTSR branch without 2508 CU2 LTSR. XenServer 8.4 and 9 are affected with Workload Balancing earlier than 2026.1.1 or Conversion Manager earlier than 2026.2.0.
CERT-FR lists nine CVEs, and the Citrix bulletins map them. CTX697300, first published on 30 October 2026, says Unicon eLux Scout is impacted by CVE-2026-111497, a flaw in the Google Brotli decoder, and that CVE is in KEV.
CTX697256 rates the XenServer update Critical and covers the other eight CVEs. CVE-2026-98432 lets an unauthenticated attacker on the management network compromise the host and its Workload Balancing or Conversion Manager appliances. It needs no KEV entry to earn a place here. Google scores it 9.2 on CVSS 4.0, and NVD’s own CVSS 3.1 score is 9.8.
- Listed in CISA KEVYesAdded 27 October 2026, federal due date 10 November 202627 Oct 2026
- Exploitation, CISA SSVC entryYesThe CISA Coordinator entry lists exploitation as active23 Oct 2026
- Used in ransomware campaignsUnknownThe KEV field reads Unknown4 Nov 2026
- Fixed Brotli versionsYes1.0.10, 1.1.1 and 1.2.1, from the Google CNA record22 Oct 2026
KEV’s note says the flaw sits in a library that different products can embed. That is our reason to look beyond Citrix: inventory every product that bundles Brotli and compare it with the fixed versions. Our entry on the CISA KEV catalogue explains how due dates work.
2. HPE Networking Fabric Composer: hardcoded passwords on a management plane
HPE bulletin HPESBNW05172, severity Critical, lists 46 CVEs for Fabric Composer: 3 Critical, 20 High, 18 Medium and 5 Low. CVE-2026-95731 is a set of hardcoded passwords in the command-line interface that let an unauthenticated remote attacker gain administrative access. HPE scores it 9.8 on CVSS 3.1, and the record holds no CVSS 4.0 score.
Two adjacent-network flaws, CVE-2026-95732 and CVE-2026-95733, score 9.6 each and allow code execution. Versions 7.4.0 and below and 7.3.4 and below are affected. Fixes are 7.4.1 and 7.3.5 or later. HPE’s workaround is to confine the CLI and web management interfaces to a dedicated layer 2 segment or VLAN, or to firewall policies.
CERT-FR advisory AVI-1451 covers both HPE bulletins, 55 CVEs in all. The second, HPESBNW05173, concerns the Virtual Intranet Access (VIA) client 4.7.8 and below. It lists 9 CVEs, 7 High and 2 Medium, fixed in 4.7.9, with no workaround. HPE says it is not aware of public discussion or exploit code for either bulletin.
3. NoMachine: unauthenticated code execution on port 4443
ZDI advisory ZDI-26-786 describes a heap-based buffer overflow in the NoMachine web service, which listens on TCP port 4443 by default. An unauthenticated remote attacker can run code as the service account. The record for CVE-2026-114549 scores it 9.8 on CVSS 3.0 and holds no 3.1 or 4.0 score.
ZDI reports it fixed in 10.1.7, 9.9.6 and 8.27.1, and says it told the vendor on 24 July 2026 and published on 22 October 2026. NoMachine’s update page dates those releases 14 September 2026 and describes security patches for server-side components and web sessions, without naming this CVE. Many installs may therefore be patched already; check any host that exposes port 4443. It ranks below item 2 because its fix has been out since September.
4. ManageEngine Key Manager Plus: keys and certificates behind a login
ManageEngine’s advisories say builds up to 7150 are affected and build 7151 fixes the issues, with a fix date of 21 August 2026. CVE-2026-77690 lets a user with certificate deployment privileges run commands on a deployment target. It scores 8.8 on CVSS 3.1 from the CNA, with no CVSS 4.0 score.
CVE-2026-77779 lets a low-privilege user export keys outside their scope, which ManageEngine says could include other users’ private keys. It scores 7.7. The release notes for build 7151 list further fixes, including CVE-2026-77691. Both CVEs need a login, so this rank rests on the keys: ManageEngine says an export could enable impersonation or signature forgery, which we weigh above a LAN-only flaw.
5. Zyxel GS1900 switches: a crafted web request to the CGI program
Zyxel’s advisory for CVE-2026-107441 describes an out-of-bounds write in the CGI program of GS1900 firmware. An unauthenticated attacker on the adjacent network can send a crafted HTTP request and potentially run OS commands. The CVE record scores it 8.8 on CVSS 3.1, and Zyxel lists no workaround.
Ten models are affected, each fixed by a firmware ending in .3, for example 2.90(AAHH.3)C0 for the GS1900-8. Zyxel says patches cover only models still in their vulnerability support period. Because the attack is adjacent, keep switch web interfaces off user networks until the update is done.
6. Zyxel access points, FWA7 and a router: privilege escalation from the LAN
A second Zyxel advisory, for CVE-2026-76955, covers a buffer overflow in the zdp_wtp binary that lets a LAN-based attacker escalate privileges. The record scores it 8.8 on CVSS 3.1. Zyxel lists 42 models: 38 access points, 3 FWA7 units and the USG LITE 60AX security router.
Most fixed builds are the affected build with the next number after the dot, such as 7.40(ACPJ.2)C0 for the IAP500BE. The WAC500H gets a hotfix on request, and the USG LITE 60AX is updated by cloud to V2.40(ACIP.0)C0. Zyxel credits Jinpyo Lee.
7. MongoDB C driver: two flaws fixed in 1.30.15 and 2.5.8
The Canadian Centre for Cyber Security advisory AV26-1122, dated 4 November 2026, lists the MongoDB C Driver before 1.30.15 and before 2.5.8. It names two flaws by ticket title only: a failure to parse an OP_COMPRESSED reply that can leak (CDRIVER-6521), and mongoc_gridfs_bucket_download_to_stream, which may abort on bad metadata (CDRIVER-6494).
The advisory page lists no CVE id or score. MongoDB’s tickets show both fixes released on 3 November 2026 and mark the first Major (P3) and the second Minor (P4). It ranks last because no score is published, not because the risk is low. Applications that link the driver need a rebuild with a fixed version.
How Do the Seven Compare?
| Rank | Product | Fixed in | Reach | Score as published | In KEV |
|---|---|---|---|---|---|
| 1 | Citrix Scout and XenServer | Scout Cloud Gateway 2605.1-3; Scout 2609.1 and 2508 CU2 LTSR; latest XenServer 8.4 and 9 update; Workload Balancing 2026.1.1; Conversion Manager 2026.2.0 | Scout: crafted Brotli stream; XenServer: management network, no login (CVE-2026-98432) | Brotli CVE: 9.2 (4.0), 9.8 (3.1) | Brotli CVE yes |
| 2 | HPE Fabric Composer and VIA | Composer 7.4.1, 7.3.5; VIA 4.7.9 | Remote, no login (95731) | 9.8 (3.1) | No |
| 3 | NoMachine | 10.1.7, 9.9.6, 8.27.1 | Remote, no login | 9.8 (3.0) | No |
| 4 | Key Manager Plus | Build 7151 | Login needed | 8.8 and 7.7 (3.1) | No |
| 5 | Zyxel GS1900 | Firmware .3 build per model | Adjacent, no login | 8.8 (3.1) | No |
| 6 | Zyxel APs, FWA7, router | Per model in the advisory | Adjacent | 8.8 (3.1) | No |
| 7 | MongoDB C driver | 1.30.15, 2.5.8 | Not stated | None published | No |
The KEV column reflects catalogue version 2026.11.04 for the CVEs named in this post. For the method behind a ranking like this, see our entry on vulnerability prioritization and the comparison of CVSS, EPSS and KEV signals. Our exploited vulnerability response playbook covers what to do when a KEV entry matches your estate.