Microsoft Confirms November 2026 Patch Tuesday Updates Trigger Windows Activation Failures with Error 0x80041008

Check Point Releases Emergency Hotfixes for Zero-Day CVE-2026-123039 Exploited for Root Access

Check Point has issued emergency hotfixes to address a high-severity local privilege escalation vulnerability tracked as CVE-2026-123039. The flaw resides in the DynamicCLI IPC interface of Gaia OS and has been actively exploited since late October to obtain root privileges and maintain persistence on affected devices. Attackers first compromised the Mobile Access portal via the PHP2Shell vulnerability before chaining it with CVE-2026-123039 to escalate privileges. They then deployed webshells, the TSGA backdoor, and TSProxy malware previously linked to Ivanti appliance attacks, pivoted to VMware ESXi hosts, and installed destructive wiper malware. Check Point observed the exploit targeting several dozen customers across its Firewall, Security Gateway, and Security Management Server products. Temporary mitigation involves stopping the dynamic_server process, while indicators of compromise include unusual system() sink usage and non-Clish commands. This marks the third zero-day campaign against Check Point products in recent months, following earlier exploitation of CVE-2026-93616 and CVE-2026-85102.

Citrix Patches Nine Critical NetScaler ADC and Gateway Flaws Plus One in Console

Citrix has released patches addressing 28 vulnerabilities across NetScaler ADC, NetScaler Gateway, and NetScaler Console. Nine of the issues in ADC and Gateway are rated critical and originate from memory overflow conditions in Packet Processing, SMPP traffic, DNS and DNS-over-HTTPS, NetScaler Push, Email OTP authentication, Endpoint Analysis, and ICA proxy. These flaws can trigger unpredictable behavior or denial-of-service conditions. A separate critical vulnerability in NetScaler Console, tracked as CVE-2026-120869 with a CVSS score of 9.4, allows unauthenticated attackers to bypass access controls. The remaining defects are mostly high-severity and affect similar functionality. Patches are available for NetScaler ADC and Gateway versions 14.1-73.57 and later, 13.1-64.39 and later, plus corresponding FIPS and NDcPP builds. Citrix recommends immediate updates and has disclosed precondition details for several of the issues.

Nightmare Eclipse Releases SignDrop Zero-Day Exploit Abusing Windows CLFS for Local Privilege Escalation

Security researcher Abdelhamid Naceri, known as Nightmare Eclipse, has published a zero-day exploit called SignDrop that targets the Windows Common Log File System (CLFS). The exploit enables a local attacker to escalate privileges to SYSTEM by exploiting flawed logic in how clfs.sys handles authentication file creation for .cnpf container files. Microsoft introduced CLFS logfile authentication last year to verify file integrity, yet SignDrop bypasses this mechanism by coercing Windows Defender to open attacker-specified log files during signature updates. The proof-of-concept has been successfully tested on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental, covering an estimated 80 percent of Windows installations older than 90 days. Cyderes independently compiled and verified the PoC, finding no evidence of in-the-wild exploitation to date. Microsoft has been contacted for comment but has not yet responded.