SGRC Daily Cyber Brief - 06 Nov 2026

Read sourced cyber advisories and next steps, or connect your agent to check which entries match your software.

Issue date
Reference
SGRC-DCB-20261106
Last updated
Source checks recorded
Entries
6

Bottom line

  • In this issue. 6 entries: 1 vulnerability, 4 incidents and 1 campaign.
  • Vulnerabilities. 1 of 1 is on CISA's Known Exploited Vulnerabilities list. 1 has passed the US federal due date. The oldest was October 20, 2023.
  • Fix status. 0 of 1 lists a fixed version in these records. Not listed does not mean no fix exists, so check the vendor advisory.
  • Incidents. 4 listed: 3 cite the California Attorney General, 1 cites the oag.ca.gov.
  • Campaigns. 1 report, from Microsoft Security.
  • Canada. No entry carries a cited Canadian source. That does not establish that Canadian organizations are unaffected.

Findings

Open a row for affected versions, fix steps, checks and sources.

6 of 6 entries

Sorted by Issue order.

  1. Number 1Cisco IOS XE Web UICVE-2023-20198Widely deployedThe attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination.CVSS 10EPSS 99.6%Deadline passedCISA due Oct 20, 2023, passed

    What happened

    The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination.

    Who can attack it

    Someone who can reach it over a network, up to and including the internet. They need no account or rights on the affected product, and no one else has to do anything, such as open a file or click a link.

    From the CVSS vector in the NVD record, scored by NIST.

    How to fix

    1. Upgrade to the fixed release for your product and branch (fixed versions per the NVD record): allen-bradley stratix 5200 firmware: 17.12.02; allen-bradley stratix 5800 firmware: 17.12.02; ios xe: 16.12.10a, 17.3.8a, 17.6.6a or 17.9.4a.
    2. CISA KEV required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA. Federal due date 2023-10-20.
    3. Follow the vendor advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z

    How to check

    Exposure check: Nuclei template https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20198.yaml (community template; tests exposure, not compromise).

    Log detection: Sigma rule https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-20198/cisco_syslog_cve_2023_20198_ios_xe_web_ui.yml (community rule; test before use).

    Network detection: ET Open Suricata rule sid 2048936 in https://rules.emergingthreats.net/open/suricata-7.0/emerging-all.rules (community rule; test before use).

    Vendor guidance: "Indicators of Compromise" section at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z

    Affected versions

    • before 17.12.02
    • 16.12 up to, not including, 16.12.10a
    • 17.3 up to, not including, 17.3.8a
    • 17.6 up to, not including, 17.6.6a
    • 17.9 up to, not including, 17.9.4a

    Risk record

    Response
    Immediate
    Added to KEV
    Oct 16, 2023

    Sources

  2. Number 2DreamHost: security incident noticeoag.ca.gov published a notice about a security incident. Read it for what happened and what to do.CVSS Does not applyEPSS Does not applyIncidentCISA due Does not apply

    What happened

    oag.ca.gov published a notice about a security incident. Read it for what happened and what to do.

    What to check

    1. Read the notice from oag.ca.gov: https://oag.ca.gov/system/files/DreamHost%20-%20Data%20Security%20Breach%20Notice%20Letter%20%28USA%20other%20than%20MA%29%20261102.1.pdf

    Sources

  3. Number 3Yu Ming Charter School: breach notice filed with the California Attorney GeneralYu Ming Charter School reported a data breach to the California Attorney General on 2026-11-04. The breach date it listed is 2026-05-22. The filed notice is the source for details.CVSS Does not applyEPSS Does not applyIncidentCISA due Does not apply

    What happened

    Yu Ming Charter School reported a data breach to the California Attorney General on 2026-11-04. The breach date it listed is 2026-05-22. The filed notice is the source for details.

    What to check

    1. Read the notice from California Attorney General: https://oag.ca.gov/ecrime/databreach/reports/sb24-632412

    Sources

  4. Number 4Hoag Memorial Hospital Presbyterian: breach notice filed with the California Attorney GeneralHoag Memorial Hospital Presbyterian reported a data breach to the California Attorney General on 2026-11-04. The breach date it listed is 2026-10-08. The filed notice is the source for details.CVSS Does not applyEPSS Does not applyIncidentCISA due Does not apply

    What happened

    Hoag Memorial Hospital Presbyterian reported a data breach to the California Attorney General on 2026-11-04. The breach date it listed is 2026-10-08. The filed notice is the source for details.

    What to check

    1. Read the notice from California Attorney General: https://oag.ca.gov/ecrime/databreach/reports/sb24-632407

    Sources

  5. Number 5RevSpring, Inc.: breach notice filed with the California Attorney GeneralRevSpring, Inc. reported a data breach to the California Attorney General on 2026-11-04. The breach dates it listed are 2026-05-15 and 2026-06-01. The filed notice is the source for details.CVSS Does not applyEPSS Does not applyIncidentCISA due Does not apply

    What happened

    RevSpring, Inc. reported a data breach to the California Attorney General on 2026-11-04. The breach dates it listed are 2026-05-15 and 2026-06-01. The filed notice is the source for details.

    What to check

    1. Read the notice from California Attorney General: https://oag.ca.gov/ecrime/databreach/reports/sb24-632404

    Sources

  6. Number 6Threat actors use agentic AI tooling to find and abuse exposed secretsMicrosoft Threat Intelligence has observed threat actors using the agentic offensive security framework ARTEX to search GitHub for OAuth application secrets, which can be used to compromise the associated OAuth application and perform...CVSS Does not applyEPSS Does not applyCampaignCISA due Does not apply

    What happened

    Microsoft Threat Intelligence has observed threat actors using the agentic offensive security framework ARTEX to search GitHub for OAuth application secrets, which can be used to compromise the associated OAuth application and perform...

    What to check

    1. Read the report from Microsoft Security: https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/

    How to check

    The report includes at least 5 hunting queries. Microsoft Security: https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/

    Sources

Sources

Citations by publisher across this issue. Each row lists its own links. Sources checked November 6, 2026 at 07:30 a.m. EST.

Authorities
  • California Attorney General3
  • CISA KEV1
  • CVE Program1
  • GitHub Advisory Database1
  • NVD API1
  • oag.ca.gov1
Vendors
  • Cisco1
Research teams
  • Microsoft Security1
Press
  • BleepingComputer1
  • SANS ISC1
  • The Hacker News1

Coverage is limited to the entries shown. Canadian context requires cited Canadian evidence; worldwide incident and campaign collection is still being expanded. The JSON Feed includes the matching data and original verification timestamps.