Skip to main content
Change Risk Intel
Menu
Cybersecurity

This Week in Change Risk — Week of Nov 9, 2026

Ben Ennis Founder, Ennis Studio · Editor, Change Risk Intel · 9 min read

This weekly digest is operational intelligence for change and risk owners. No affiliate links appear in this post.

Welcome to This Week in Change Risk for the week of November 9, 2026. This was a busy KEV week, with Patch Tuesday landing on the same day as six new entries. The thread running through everything else is the planned change that behaved differently in production: a database migration, a provider control plane, and an API limit that started saying no.

Two posts went up this week. Monday’s November Patch Tuesday CAB plan has since been updated with Microsoft’s actual release figures, and Wednesday’s europe-west2 incident report lessons covers Google’s full write-up.

KEV additions this week

CISA’s KEV catalog added 11 entries from November 6 to 10. Six of them carry a three-day deadline under BOD 26-04, and all six carry the forensic triage flag. The catalog had no further additions through November 12.

The four entries CISA added on November 9 were all due November 12, all triage flagged:

  • OpenSSH, CVE-2026-123158: an authentication bypass on Linux. This is the Alpine issue from last week’s recap, now with a CVE ID. The OpenSSH 10.6p2 release notes from November 5 scope it to Linux builds that use musl libc with PAM disabled, and say sshd now avoids the bypass even though the root cause sits outside sshd.
  • GPUStack, CVE-2026-102895: improper authentication that can give an unauthenticated attacker admin access, including creating persistent API keys and reading cloud-provider secrets, per the GPUStack advisory.
  • SignalWire FreeSWITCH, CVE-2026-116779: code injection that can expose configuration and credentials and allow command execution (FreeSWITCH advisory).
  • IBM Aspera Faspex, CVE-2026-123218: an authorization bypass that allows privilege escalation by an authenticated user (IBM bulletin).

The six entries added on November 10 split into two tracks:

  • Barracuda, CVE-2026-116606 and CVE-2026-111560: due today, both triage flagged. Chained, they bypass authorization and give root on the device. The Barracuda advisory says exploitation needs access to the admin interface and that it has seen “a small number of organizations” affected. The command injection affects ESG, Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway.
  • Microsoft Outlook CVE-2026-124194, Google Chromium CVE-2026-125350, Cisco BroadWorks CVE-2026-20320 and Openwave Webtop Media Transcoder CVE-2026-111793: 14-day deadlines, due November 24, no triage flag. The Outlook spoofing bug is this month’s Patch Tuesday zero-day.

SonicWall’s SonicOS SSLVPN bug, CVE-2026-19868, landed on November 6 after last Friday’s recap. It lets a user with valid credentials for another authentication method bypass SAML, including SAML-enforced MFA (SonicWall advisory). It is due November 20.

The change-window implication is in the calendar. The November 9 batch ran its three days across Veterans Day. The November 24 deadline lands two days before US Thanksgiving, when many teams start a change freeze, so the Outlook and Chromium fixes need to clear CAB next week rather than slip into the freeze.

Barracuda says its patches “may be applied automatically,” and customers who turned off automatic delivery should turn it back on. Auto-delivery does not close the change record. Confirm the patch ID on each appliance, because Barracuda also notes that a device several firmware versions behind may need more than one update. The same rule applies to OpenSSH: confirm the running sshd is the fixed build, not just the installed package.

The live KEV tracker has every entry.

Cloud incidents worth noting

GitHub’s November 9 Actions incident ran from 18:07 to 18:59 UTC and affected an average of 28% of workflow runs, peaking at 65%. GitHub says it “occurred during a planned migration of a core Actions database from GitHub’s datacenter to a new cloud region.” After the migration, traffic moved to the new region and “exceeded the capacity and rate limits configured there.” Webhooks, Pages and Copilot code review took secondary hits.

GitHub rolled part of the traffic back, raised capacity and limits, and then shifted again gradually. Its fix is to validate capacity and limits before shifting traffic in the remaining migrations, in smaller steps. For a CAB reviewing a region or database migration, that gives two concrete questions: were the target’s quotas and rate limits checked against peak production load, and is the cutover staged with a defined point to stop and roll back?

The same morning, a separate GitHub incident delayed webhooks from 09:23 to 11:40 UTC, some by up to 3.5 hours. A degraded host had been slowing a Kafka broker since November 7, and “the broker stopped reporting the metrics our alerts rely on.” Silence read as health. GitHub has added an alert that pages within 30 minutes for this pattern. If your post-change monitoring treats missing data as a pass, this is the case for alerting on absent metrics.

The weakness is the same one we flagged last week: two more critical incidents, Git Operations and Pull Requests on November 10 (16:10 to 17:55 UTC) and Actions, Pages and Copilot on November 11, still say a detailed root cause “will be shared as soon as it is available.”

Cloudflare had a different kind of outage. From 16:15 UTC on November 9 to 01:46 UTC on November 10, creating, editing and deleting Workers was disrupted, while deployed Workers kept running. That is roughly nine and a half hours in which customers could not ship a fix through the normal path. The status page gives no root cause. A follow-on issue, in which Worker changes did not produce Event Subscription events, was still marked “identified” when we checked. If your emergency change procedure assumes the provider’s deploy API is up, write down what you do when it is not. Our cloud status heatmap tracks providers over time.

Vendor moves

Atlassian is extending configuration-limit enforcement to more Jira Cloud REST API calls. Per the Jira Cloud platform changelog, affected operations now return HTTP 422 when a request would exceed a limit. These include creating custom field options, priorities, permission schemes and issue security schemes, plus issue edits that would add components past a space’s limit. Atlassian is explicit that “some requests that previously succeeded will now be rejected.” The planned rollout start was November 11 to 12.

The weakness is timing and visibility. The entry sits under November 13 on the changelog, at or after the start of the rollout window, so an integration that provisions fields or schemes could start failing before its owners read about it. Atlassian also warns against retrying the same request. Check any scripts or ITSM sync jobs that write Jira configuration, and treat a new 422 as a limit to fix, not a transient error.

ServiceNow announced agentic continuous control monitoring for its Integrated Risk Management product on November 10. (Disclosure: Ben works at ServiceNow; see his author page.) AI agents configure control checks, interpret results and, when a control fails, can open a ticket and “remediate automatically within defined policies,” across 100+ third-party integrations.

There are two weaknesses. General availability is now expected in Q1 2027, while ServiceNow’s earlier Autonomous Security announcement listed December 2026 for the same capability. And an automated fix to a failed control is itself a change to a production system. Before turning on auto-remediation, decide whether those actions run as standard changes with their own records, or your audit trail will show controls fixed with no approved change behind them.

Compliance and regulatory

NIST’s draft SP 800-221 Revision 1, Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio, is open for comment until December 7. The revision reflects OMB’s 2026 update to Circular A-123, aligns with NIST IR 8286r1, and recognizes several ways to quantify risk across disciplines. Its core idea is that ICT risk registers feed the enterprise risk profile.

For change owners, that is where CAB risk acceptances and deferred patches belong. A KEV fix pushed past its deadline is a risk decision, and this draft is a reasonable model for recording it where senior leadership will see it. This is a summary of published guidance, not compliance advice.

Chart of the week

Two-panel chart. Left: KEV additions per ISO week W38 to W46 of 2026, split by 3-day and 14-day deadlines: W38 7 and 0, W39 12 and 0, W40 5 and 1, W41 5 and 0, W42 9 and 0, W43 5 and 3, W44 6 and 4, W45 1 and 2, W46 6 and 4 through November 10. Right: entries since September 14 by deadline and forensic triage flag: 3-day with triage 50, 3-day without triage 6, 14-day without triage 14, 14-day with triage 0

This week’s KEV list made the link between deadline and triage flag hard to miss, so we checked it across the catalog JSON. Of 70 entries added from September 14 to November 10, all 50 with the forensic triage flag got a three-day deadline. No entry with a 14-day deadline carried the flag. Six three-day entries had no flag.

For a CAB, the flag is a reliable early signal. When CISA marks an entry for forensic triage, plan for an emergency change and an investigation in the same three days, not a patch you can batch into the next window.

The left panel updates the weekly series. Week 45 finished at three after the SonicWall entry on November 6. Week 46 has 10 entries through November 10, and 14-day deadlines account for 13 of the 31 entries in the last four weeks, after just one in the five weeks before.

The newsletter

If you want this digest in your inbox every Friday, subscribe to the changeriskintel newsletter and get the week’s KEV additions, cloud incidents and change-management lessons without the noise.

More weekly analysis lives on our cybersecurity pillar.

Sources

#weekly-recap #cisa-kev #cloud-incidents #change-management #vulnerability-management #patch-management

Published November 13, 2026.