Comparing 2 November 2026 with the previous day 1 November 2026.
The warning indicates an ongoing targeted attack on political officeholders in Germany that goes beyond general patch information and suggests state actors as the perpetrators.
The report shows that Chinese actors are using AI-powered penetration-testing frameworks for automated attacks against hundreds of organizations, increasing the scalability of state-supported campaigns.
The report adds to patch information only the insight that exploitation requires local access and a concurrent privileged module unload, and no active campaign is known.
The report describes an attack path without any software vulnerability: help-desk impersonation over Teams combined with misconfigured AD CS certificate templates (ESC1/ESC8) leads all the way to DCSync execution on a domain controller.
The report documents an ongoing exploitation campaign: according to Volexity's analysis, the Ivanti Connect Secure attacks have been running since early October and only became widely visible through the CISA KEV listing, while Synology DSM flaws are being actively abused in parallel.
The BSI advisory aggregates multiple vulnerabilities without CVE IDs; specific CVSS scores and exploitation status remain unclear, which complicates prioritization.
The report provides no CVE ID or exploit status, which limits operational prioritization.
No changes in this category.
No changes in this category.
Exploiting dangling COM registrations enables local privilege escalation on Windows; a public exploit discloses technical details and makes verification of the incomplete fix necessary.
The report adds the attack vector beyond patch information: it is not the viewer that must be compromised; the remotely controlled host can attack the controlling client.