Skip to content
Threat Feed
Subscribe
medium threat exploited PoC

GPUStack, ConnectWise, N-able, and M365 Security and Availability Updates

This brief summarizes reports regarding GPUStack authentication bypass scans, a ConnectWise ScreenConnect security advisory, public exploit code for N-able N-central, and a Microsoft 365 availability incident.

CVE search metadata

CVE search record: CVE-2026-102895. Severity: critical. CVSS: 9.8. EPSS: 0.52%. KEV: yes. Product: GPUStack, Microsoft 365, N-able N-central, ScreenConnect. Brief: GPUStack, ConnectWise, N-able, and M365 Security and Availability Updates. Brief link: https://feed.craftedsignal.io/briefs/2026-11-gpustack-n-able-screenconnect-cve-2026-102895/

Triage facts

Revision 1
Applicability
GPUStack, Microsoft 365 +2
Evidence
Confirmed activeHigh confidence
Severity
Medium
Sources
6 public sources
Freshness
Revision 1Nov 13, 04:36 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
C2Likely

Recent reports cover several security and service disruptions:

  • GPUStack (CVE-2026-102895): Scans are targeting a vulnerability where an attacker can spoof the X-GPUStack-Real-IP header with the loopback address to bypass authentication.
  • ConnectWise ScreenConnect: The company is investigating the compromise of approximately 400 customer and partner sites and has disabled certain third-party plugins.
  • N-able N-central: Public exploit code has been released for at least three N-central vulnerabilities that were previously disclosed without vendor notification.
  • Microsoft 365: A significant availability event impacted services including Exchange, Outlook, and related single sign-on functions like Entra.

Impact

Active scanning is occurring for the GPUStack authentication bypass. ConnectWise is investigating compromises in hundreds of environments. Unverified public exploit code exists for N-able N-central. Microsoft 365 users experienced service disruptions.

Recommendation

Organizations using affected platforms should review the respective vendor advisories and monitor official status pages for updates and remediation guidance.

Detection coverage 1

GPUStack Authentication Bypass Header Detection

medium

Detects the presence of the X-GPUStack-Real-IP header set to loopback addresses, which is associated with the documented authentication bypass.

sigma sources: webserver

Detection queries are available on the platform. Get full rules →