SANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119618); Fortinet FortiMail Criticals; Ivanti EPM SQLi (CVE-2026-121653); Windows SignDrop CLFS; N-able N-central HF2
MentionsApache Software FoundationFortinetIvantiMicrosoftMicrosoft Windows
Runs 6:09. Streams from traffic.libsyn.com only when you press play.
This episode covers leftover Patch Tuesday issues: a critical remote code execution flaw in Apache HTTP Server's mod_http2 module (CVE-2026-119618), Fortinet's 89 advisories with 17 critical vulnerabilities especially in FortiMail, Ivanti's November 2026 update including an Endpoint Manager SQL injection and a Cloud Services Application certificate issue, an unpatched Windows Common Log File System privilege escalation called SignDrop, and N-able's N-central 2026.4 Hotfix 2.
Show notes from SANS Internet Storm Center StormCast.
Explained
The technology and terms in this story. Learn more
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- WeaknessSQL injectionSlipping database commands into input an application passes to its database.
- ConceptPatch TuesdayMicrosoft's monthly security update day, the second Tuesday of every month.
- AttackPrivilege escalationGoing from limited access to more powerful access, such as from a normal user to administrator.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')Two operations race on shared state, and an attacker wins the timing window between check and use.
- CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Input is concatenated into a database query, letting attackers read or change data they shouldn't.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.