SANS Stormcast Friday, November 13th, 2026: GPUStack Auth Bypass Scans (CVE-2026-102895); ConnectWise ScreenConnect Advisory; N-able N-central Exploits; Microsoft 365 Outage
MentionsConnectWiseMicrosoftMicrosoft 365ScreenConnectGitHub
Runs 6:43. Streams from traffic.libsyn.com only when you press play.
This episode covers scans for a GPUStack authentication bypass, a ConnectWise ScreenConnect security advisory, public exploits for N-able N-central, and a Microsoft 365 outage. GPUStack Authentication Bypass Scans (CVE-2026-102895) Johannes writes up scans against GPUStack, open-source software that manages clusters of GPUs for AI workloads. An attacker can spoof the X-GPUStack-Real-IP header with the loopback address to bypass authentication. A fixed version was released in July, the CVE was assigned about a week ago, and exploitation is trivial on an exposed system.
Show notes from SANS Internet Storm Center StormCast.
Explained
The technology and terms in this story. Learn more
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
- CWE-287Improper AuthenticationThe system doesn't properly prove who a user is, so attackers get in as someone else.
- CWE-290Authentication Bypass by SpoofingThe system trusts something an attacker can fake, such as a source address or header.
- CWE-346Origin Validation ErrorThe software doesn't verify where a message really came from, so forged messages are trusted.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.