WAF Weekly: Outlook zero-day, Apache HTTP/2 RCE, MSP exploits, Nov 6-13

Patch Tuesday opened with an exploited Outlook flaw that leaks authentication hashes. Apache patched a critical HTTP/2 bug that Anthropic and Google found. An MSP tool vendor raced to fix zero-days exploited within hours of disclosure. The week rewarded teams that treat disclosure as exploitation.

Outlook zero-day leaks NTLM hashes in November Patch Tuesday

Microsoft fixed 1,094 vulnerabilities on November Patch Tuesday, including 63 rated critical. The one to patch first is CVE-2026-124194, an Outlook zero-day rated only 6.5 on CVSS but already exploited. A crafted Office file makes Outlook contact an attacker-controlled location without the usual warning, leaking the user's NTLMv2 hash for later impersonation. CISA confirmed active exploitation. SAP patched its own critical memory corruption flaw, ICM2Shell, in the same cycle.

The low score is a trap. This flaw needs one user click and pays out authentication material, so patch priority should ignore CVSS here. The WAF angle is indirect. An email gateway and training reduce exposure, but only the Microsoft update removes the leak, and stolen hashes feed NTLM relay attacks later in the chain.

Apache patches critical HTTP/2 RCE found by Anthropic and Google

Apache patched CVE-2026-119618, a critical race condition in the mod_http2 module that lets an unauthenticated attacker execute code on servers with HTTP/2 enabled. Anthropic and Google researchers found the flaw. The fix lands in Apache HTTP Server 2.4.71, and many vulnerable servers remain reachable over the internet. Wordfence issued a separate explainer for WordPress site owners who run Apache.

This flaw sits in the exact path most WAF deployments protect. A WAF cannot patch a server library, so the control is inventory: know which component terminates HTTP/2 and track its version instead of the application's patch level.

N-able N-central zero-days exploited within hours

Researcher Sean Bales disclosed more than 30 N-central zero-days and proof-of-concept exploits over the weekend. N-able patched the unauthenticated ones on November 10, then Bales released two more on November 12. One, 4EverAble2Shell, chains an Apache Axis flaw (CVE-2026-90436) with a privilege escalation for unauthenticated root on N-central. It was exploited within hours, deploying cryptocurrency miners on at least 21 systems, 19 running the latest update.

RMM tools sit one step above the perimeter, so this breach class bypasses every customer WAF. The attacker already holds the management plane. Disable legacy APIs, isolate management networks, and treat public disclosure as public exploitation.

Ivanti patches pre-auth SQL injection in management products

Ivanti's November updates fix CVE-2026-121653, a 9.8-rated SQL injection in Endpoint Manager Core before 2024 SU8 that gives unauthenticated remote code execution. Cloud Services Application carries CVE-2026-121683, rated 9.4, where missing authentication lets a remote attacker alter trusted certificate entries. EPMM and Sentry share a 7.2-rated command injection flaw. Ivanti reports no known exploitation before publication, but unauthenticated services stay urgent.

Ivanti management products are a recurring target, and the pattern is the same as N-able: the damage happens in management infrastructure that customer-facing WAFs never see. Dual network interface guidance helps, but only patching closes the door.

Chrome patches its eighth zero-day of 2026

Google's Chrome 157 update fixes nine vulnerabilities, including CVE-2026-125350, a high-severity use-after-free in the XML component that is already exploited in the wild. The report arrived anonymously on November 6. It is the eighth Chrome zero-day exploited this year, and CISA has not added it to the Known Exploited Vulnerabilities catalog yet.

Eight in one year is a pattern, not bad luck. The browser is the attack surface that edge filtering cannot reach. Rolling out the stable channel update is the control.

Check Point WAF gains FedRAMP authorization

Check Point expanded its FedRAMP-certified packages to include Check Point WAF, adding web application and API protection, bot mitigation, DDoS defense and GenAI application security to a platform already authorized for US federal use. The company cites 2,680 attacks per government organization per week in 2025, up 17 percent year over year.

FedRAMP authorization is a procurement gate, not a security rating. It lets Check Point sell its WAF into federal contracts that require it, widening the shortlist of approved WAAP options.

Also notable

• A Windows SignDrop zero-day gives attackers SYSTEM privileges and is already exploited. BleepingComputer

WAFplanet take

Three of this week's headline flaws live in management and infrastructure layers, not in web applications. Outlook, N-central, EPM and Chrome share one trait: their attacks never touch a customer WAF. Patching cadence and management-plane hygiene are the real controls. The Apache flaw sits in the delivery path WAF teams claim to protect. Know your full stack.

We also read

• Wordfence shipped 9.1.0 with an in-product security news feed, faster rules and smarter alerts. Wordfence
• Wordfence explains what the critical Apache HTTP/2 flaw (CVE-2026-119618) means for WordPress site owners. Wordfence
• Wordfence Intelligence's weekly report covers WordPress vulnerabilities from November 2 to 8. Wordfence
• CrowdSec shows how to fill any firewall's empty external-list slot: a curated IP feed URL, a refresh rate, TLS trust and a deny rule. CrowdSec
• Criminal IP launched a TI Feed app on Splunkbase that correlates threat intelligence with firewall traffic logs in Splunk. GBHackers
• Imperva added Palo Alto Networks to its SSL Integration Center for bring-your-own-CA setups. Imperva