Daily brief 2026-11-08: CVE-2026-123551 and what businesses should patch

CVE-2026-123551 (CVE-2026-123551): OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that all. Severity CRITICAL, CVSS 10, EPSS n/a.

CVE-2026-123549 (CVE-2026-123549): OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-regis. Severity CRITICAL, CVSS 9.3, EPSS n/a.

CVE-2026-123550 (CVE-2026-123550): OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 serv. Severity CRITICAL, CVSS 9.3, EPSS n/a.

CVE-2026-123614 (CVE-2026-123614): imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allo. Severity CRITICAL, CVSS 9.3, EPSS n/a.

CVE-2026-50679 (microsoft windows 11 24h2): Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized atta. Severity HIGH, CVSS 7.8, EPSS 0.5%.

Microsoft Windows & Windows Server: CVE-2026-50679. See the Business Apps page for what to ask your provider.

Prioritize anything in CISA KEV and anything internet-facing (VPNs, firewalls, web servers, remote-support tools). Confirm patch status across every client tenant, and kill active sessions after patching gateway appliances.

No web-application entries lead today. Keep CMS cores, plugins and themes on auto-update and protect admin logins with MFA.

Ask your IT provider which of these products you run, and get written confirmation they are patched or mitigated.

Enforce MFA, keep tested offline backups, and make sure remote access is not exposed without protection.