3 vulnerabilities across 2 products scored HIGH or above on November 15, 2026.

  • 🟠 HIGH: 3

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-115934 (craftcms/cms) — F1: exploitable → itw, AAS: 10.5 → 12.5 (HIGH → CRITICAL). Originally in 2026-11-09 bulletin.

🟠 [HIGH] apache_software_foundation/apache_shiro

1 CVE | CVSS 4.0: 9.1 | AAS 10.5

  • cpe:2.3:a:apache:apache_shiro:*:*:*:*:*:*:*:* (< 3.0.1)

Apache Shiro — Critical Authentication Bypass in LDAP Realm (1 CVE)

A high-severity vulnerability in Apache Shiro’s DefaultLdapRealm allows complete authentication bypass when authentication caching is enabled. After a legitimate user logs in once, an attacker who knows that username can subsequently authenticate with any arbitrary password. This occurs because cached authentication skips the LDAP bind verification, and the default AllowAllCredentialsMatcher accepts any credentials without validation. All Apache Shiro versions through 3.0.0 are affected when using DefaultLdapRealm or JndiLdapRealm with caching enabled. This carries a CVSS 4.0 score of 9.1 and is considered exploitable with low complexity, requiring no special tooling.

Organizations using Apache Shiro for LDAP-based authentication should immediately review whether authentication caching is enabled on DefaultLdapRealm or JndiLdapRealm and apply patches or mitigations as soon as they become available. As a temporary workaround, disabling authentication caching on LDAP realms eliminates the vulnerable code path. Consult the vendor advisory at the Apache mailing list link for official remediation guidance.

Vendor Advisory

🟠 [HIGH] d-link/dir-600l

2 CVEs | CVSS 4.0: 9.3 | AAS 9.7

  • cpe:2.3:a:d-link:dir-600l:*:*:*:*:*:*:*:* (>= 2.17)

D-Link DIR-600L — Stack-Based Buffer Overflow in Authentication Handler (2 CVEs)

Two high-severity vulnerabilities affect the D-Link DIR-600L router running firmware versions 2.17 and 2.17b02, including multiple stack-based buffer overflow flaws in the authentication.cgi handler. An attacker can remotely exploit these by sending crafted id or password arguments, potentially achieving full device compromise without authentication. Public proof-of-concept exploit code is already available, making known exploitation activity likely. These carry a maximum CVSS 4.0 score of 9.3.

The DIR-600L is an end-of-life product and D-Link is unlikely to release firmware patches. Organizations still running this hardware should replace it with a currently supported model immediately. If immediate replacement is not possible, restrict management interface access to trusted networks only and disable any remote administration features. Do not expose this device’s web interface to the internet under any circumstances.

Vendor Advisory