{"id":4238,"date":"2026-11-13T06:49:56","date_gmt":"2026-11-13T14:49:56","guid":{"rendered":"https:\/\/cyber.mag212.com\/mag212-cyber-daily-2026-11-13-check-point-esxi-ncentral-netscaler\/"},"modified":"2026-11-13T06:49:56","modified_gmt":"2026-11-13T14:49:56","slug":"mag212-cyber-daily-2026-11-13-check-point-esxi-ncentral-netscaler","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/mag212-cyber-daily-2026-11-13-check-point-esxi-ncentral-netscaler\/","title":{"rendered":"MAG212 CYBER Daily \u00b7 13 novembre 2026\u00a0: Check Point Gateway contre ESXi Wiper, N-central Zero-Day, NetScaler et Microsoft 365"},"content":{"rendered":"\n
\n
Download the PDF (16 pages)<\/a><\/div>\n<\/div>\n\n\n\n

MAG212 CYBER \u00b7 Daily Cyber Intelligence \u00b7 Friday, November 13, 2026 \u00b7 Research cutoff 07:00 PT.<\/strong> From the edge to the hypervisor. Check Point detailed intrusions that went from an unpatched VPN portal to root on the firewall, a hidden implant and a wiper on VMware ESXi. N-able\u2019s N-central was exploited on its newest build within hours of a public exploit, with no fix yet. Citrix shipped 28 NetScaler fixes, and Microsoft 365 entered a second day of disruption.<\/p>\n\n\n\n

What needs attention today<\/h2>\n\n\n\n
#<\/th>Action<\/th>How<\/th><\/tr><\/thead>
1<\/td>Check Point: apply the November Jumbo Hotfix and hunt<\/strong><\/td>Internet-facing Mobile Access gateways first. Look for upload_progress_pwn<\/code> session files, zz*.tpl<\/code> templates and a CPconfigdaemon<\/code> process; check ESXi for SSH logins from gateways. Any hit means rebuild.<\/td><\/tr>
2<\/td>N-central: keep servers offline or Legacy API off, and check for miners<\/strong><\/td>No fix yet; Hotfix 2 is vulnerable. Look for xvd.service<\/code> and \/tmp\/.xvd<\/code>; treat a hit as full compromise.<\/td><\/tr>
3<\/td>NetScaler: upgrade every ADC and Gateway, then Console<\/strong><\/td>14.1-73.57 or 13.1-64.39 (FIPS 14.1-73.58 \/ 13.1-37.293), Gateway and AAA first; Console 14.1-74.34, management networks only.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Read the full stories<\/h2>\n\n\n\n