Podcast Detail

SANS Stormcast Friday, November 13th, 2026: GPUStack Auth Bypass Scans (CVE-2026-102895); ConnectWise ScreenConnect Advisory; N-able N-central Exploits; Microsoft 365 Outage

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10178.mp3

previous
Podcast Logo
GPUStack Auth Bypass Scans (CVE-2026-102895); ConnectWise ScreenConnect Advisory; N-able N-central Exploits; Microsoft 365 Outage
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

This episode covers scans for a GPUStack authentication bypass, a ConnectWise ScreenConnect security advisory, public exploits for N-able N-central, and a Microsoft 365 outage.

GPUStack Authentication Bypass Scans (CVE-2026-102895)
Johannes writes up scans against GPUStack, open-source software that manages clusters of GPUs for AI workloads. An attacker can spoof the X-GPUStack-Real-IP header with the loopback address to bypass authentication. A fixed version was released in July, the CVE was assigned about a week ago, and exploitation is trivial on an exposed system.
https://isc.sans.edu/diary/Exploit%20Attempts%20for%20GPUStack%20Authentication%20Bypass%20%28CVE-2026-102895%29/33514
https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr

ConnectWise ScreenConnect Security Advisory
ConnectWise released another ScreenConnect advisory about an ongoing investigation into the compromise of some customer and partner sites. The company is looking at 400 compromised environments and has disabled a set of third-party plugins; users should update the ScreenConnect client to version 26.6.5, which also fixes a vulnerability still being used to spread malware after those compromises.
https://www.connectwise.com/company/trust/advisories

N-able N-central Public Exploits
Public exploits are now available for at least three of the N-able N-central vulnerabilities that were disclosed last week without first notifying the vendor. The code is in a GitHub repository that Johannes has not yet verified, so treat it with caution; if you are running an exposed unpatched N-able system, upgrade immediately and assume compromise.
https://github.com/MSPNightmare/CVEs/tree/main/0-Days/N-Central%20N-Able

Microsoft 365 Downtime
Microsoft had a significant availability event in which large parts of Microsoft 365, including Exchange and Outlook, were unreachable, and the disruption also affected sites that rely on Microsoft 365 single sign-on, including Entra. Microsoft said it was bringing systems back online, but service was still unavailable for many Microsoft 365 Business and Enterprise users at the time of recording.
https://status.cloud.microsoft/m365/

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Podcast Transcript

 Hello and welcome to the Friday, November 13, 2026
 edition of the SANS Internet Storm Center's
 Stormcast. My name is Johannes Ullrich, recording today from
 Jacksonville, Florida. This episode is brought to you by
 the SANS.edu Bachelor's Degree Program in Applied
 Cybersecurity. Well and in diaries today I wrote up some
 attacks that we're seeing against GPUStack. GPUStack
 is a system that allows you to essentially make available
 clusters of GPU for AI workloads. As often these
 proxies that are in front of some of these systems have
 their issues and that's again sort of what hits us here. Now
 in this particular case we do have a special header that's
 being added by the proxy X-GPUStack-Real-IP. Many other
 proxies have similar headers and they always come with the
 big caveat, well it's possible for an attacker to spoof those
 headers. In this particular case if an attacker spoofs
 that the real IP is the loopback IP address, well in
 that case the attacker is being given access to the
 system and allowed to bypass authentication. So very
 straightforward to exploit vulnerability. Makes you
 wonder why it took them so long to really scan for it on
 a larger scale. No idea how many of these systems are
 actually exposed. Now a little bit tricky to sort of date
 this vulnerability. Apparently the fixed version of GPUStack
 was released back in July. The actual CVE number appears to
 have been assigned about a week ago. So I guess anywhere
 sort of in that time frame. There was also a GitHub page
 that had details about this vulnerability that's also sort
 of a couple months old. Again exploitation is trivial. No
 real sort of exploit really required. Just that specific
 header and of course an exposed system. And
 ConnectWise released another ScreenConnect security
 advisory. Now this one is less about a specific vulnerability
 in ScreenConnect, but more about an ongoing security
 investigation that ConnectWise is running given the
 compromise of some of their customer and partner sites. So
 they're looking currently at 400 compromised environments.
 They think they have it narrowed down to a number of
 third party plugins that may be responsible for some of
 these issues. And they disabled them now. Not really
 clear what the user is supposed to do here other than
 making sure that you do have the latest ScreenConnect
 client. That's version 26.6.5. That particular version does
 also fix a vulnerability in ScreenConnect itself that is
 still being employed by these compromises in order to then
 further spread malware and compromise additional systems
 in your network. Remember ScreenConnect is often used
 by support functions to actually reach out to remote
 systems. And that's essentially sort of what they
 are abusing here. Definitely make sure that you're up to
 date and also take a look at this latest advisory from
 ConnectWise as it has additional details as to what
 to look for in your particular environment as well as the
 list of the third party extensions. And that have now
 been disabled. And while I already talked twice in the
 last week about N-able and about the patches that were
 released now and that are available to patch
 vulnerabilities that sort of had been made public without
 first notifying N-able. We now have exploits publicly
 available for at least three of these vulnerabilities.
 There is a GitHub repository that has the code for these. I
 haven't verified them yet. So as always treat them with
 caution. Never really know what they are doing and
 haven't really looked at them close enough to tell you that
 they're safe to the person running them. But if you're
 running N-able definitely you must upgrade at this point.
 It's kind of at the point where you probably want to
 assume compromise if you have an exposed unpatched N-able
 system connected. And Microsoft today had a
 significant availability event where good parts of Microsoft
 365 were not reachable. This did affect Exchange, Outlook,
 lots and lots of different parts of Microsoft 365 that
 were not available. As I'm recording this, they say that
 they're bringing systems back online, but it's still
 unavailable for a lot of users. This also spilled over
 to many other sites. For example, if you relied on
 logging in via Microsoft 365's single sign-on system, Entra
 and such. This apparently was also affected by this outage.
 Even the Microsoft status page I heard was at times
 unavailable. Maybe just because of the high load being
 directed at that particular site, even though that's
 actually a cloud hosted site. So not sure if this is part of
 the outage or part of the high load. So if you're running
 Microsoft 365 Business or Enterprise, that's why your
 email wasn't working today. And hopefully by the time
 you're listening to this podcast, things will look
 better. Well, and that's it for today. Thanks for
 listening. Thanks for liking. Thanks for recommending. And
 thanks for subscribing to this podcast and talk to you again
 on Monday. Bye. Bye.