InfoSecBulletin Cybersecurity for mankind
Apple, SAP, and Ivanti have published security updates that fix several flaws with messaging, Bluetooth, enterprise servers, and endpoint management systems.
The disclosures show flaws that could let remote attackers get into private iMessage chats, skip security checks, run unauthorized code, alter trusted certificates, and leak sensitive data. The biggest concerns are four SAP issues rated CVSS 10.0 and serious problems with Ivanti Endpoint Manager and Cloud Services Appliance (CSA).
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
Apple Fixes iMessage Group Chat Privacy Vulnerabilities
Apple has released security updates for its Messages app. These updates fix two problems that could harm the privacy of iMessage group chats. The first problem, called CVE-2026-113961, is about authorization. It could let a hacker join an iMessage group chat and see its messages without permission. Apple fixed this by improving validation.
The second vulnerability, CVE-2026-113960, could allow a user added to an iMessage group to access messages sent before they joined the conversation. Apple resolved this issue by removing the vulnerable code.
The company has not disclosed whether either vulnerability has been exploited in real-world attacks.
The flaws are fixed in Apple’s iOS and iPadOS 27.2.1 security update. The same fixes also apply to macOS Golden Gate 27.2.1. Apple also solved a problem in Google’s Brotli compression library, labeled as CVE-2026-111497. This out-of-bounds write issue could let bad input mess up memory. CISA put this problem in its Known Exploited Vulnerabilities (KEV) list on October 27, 2026.
SAP Patches Four Maximum-Severity Vulnerabilities
SAP has fixed four serious security problems rated CVSS 10.0, the highest score possible, during its November 2026 Security Patch Day.
The weak spots impact SAP NetWeaver, SAP Web Dispatcher, SAP Gateway, and other related parts for enterprise authentication. All four can be attacked from afar without needing the attackers to log in, based on what the company says. The biggest problems are:
CVE-2026-76964: SAP Internet Communication Manager (ICM): A memory corruption vulnerability that could allow an attacker to execute operating-system commands or disrupt the affected service.
CVE-2026-89126: SAP Web Dispatcher: A memory corruption vulnerability that could enable remote code execution against affected systems.
CVE-2026-120017: SAP SAML 2.0 Service Provider: A missing authentication vulnerability that could allow attackers to impersonate users on affected systems using SAML single sign-on.
CVE-2026-89103: SAP Gateway: A broken access-control vulnerability that could allow attackers to impersonate internal servers and perform unauthorized actions.
SAP recommends that customers review the relevant security notes and prioritize installing the available patches.
Ivanti Addresses Multiple Vulnerabilities Across Enterprise Products
Ivanti has shared its November 2026 security updates for Endpoint Manager (EPM), Endpoint Manager Mobile (EPMM), Sentry, Cloud Services Appliance (CSA), and User Workspace Manager (UWM).
The flaws include remote code execution, SQL injection, bypassing authentication, changing trusted certificates, leaking information, and denial-of-service problems.
Critical Endpoint Manager and CSA Vulnerabilities
One major weakness is CVE-2026-121653, with a CVSS score of 9.8. This SQL injection flaw impacts Ivanti Endpoint Manager Core versions before 2024 SU8 and might let attackers run code from afar without needing to log in.
Ivanti also addressed CVE-2026-121683, a critical vulnerability rated CVSS 9.4 affecting Cloud Services Appliance version 5.0.8. The flaw involves missing authentication and could allow remote attackers to add or delete arbitrary trusted Endpoint Manager Core certificate entries. Ivanti released version 5.0.8.1 to address the issue.
