Weekly Security Bulletin #3: SonicWall MFA bypass, WordPress and Ivanti under active exploitation

In short

• CVE-2026-19868 in SonicWall SonicOS’s SSLVPN service lets someone get around MFA on SAML-protected logins. It was added to KEV on November 6. News reports give the fixed versions as 7.3.4-7013 and 8.2.3-8015, and there is no workaround.
• A flaw in WordPress core (4.7 through 7.1.3) allows unauthenticated code execution during a core upgrade. It joined KEV on November 3. The fix is in 7.1.4.
• Two more Ivanti Connect Secure flaws (CVE-2026-118527 and CVE-2026-111357) join the CVE-2026-104935 chain we covered in #1. Both were added to KEV on October 30.
• GitLab’s CVE-2026-97229 (CVSS 10.0) was added to KEV on October 29, and the PHP2Shell flaws on October 26.
• Chrome 157 shipped with 213 security fixes, 7 of them critical. Android’s November bulletin covers fixes up to patch level 2026-11-05.

• 13 · New KEV additions · Oct 26 - Nov 6, 3 in the last 7 days
• 213 · Security fixes in Chrome 157 · 7 critical, 77 high
• 1,471 · New Red Hat CVE records · Oct 25 - Nov 6, 5 rated “critical”
• 2 · New Ivanti KEV entries · Oct 30, two flaws in the chain
• 10.0 · GitLab CVE-2026-97229 score · Added to KEV on Oct 29

SonicWall SonicOS SSLVPN: CVE-2026-19868

When SSLVPN logins use SAML, someone with valid credentials for a different authentication method can get around the SAML checks, including MFA enforced through SAML. The CVE record lists SonicOS 7.3.3-7015 and earlier on Gen7 and 8.2.2-8015 and earlier on Gen8 as affected. SonicWall published SNWLID-2026-0014 on November 6, CISA added the flaw to KEV the same day, and federal agencies have until November 20. The vendor’s CVE record has no score; CISA-ADP gives 7.5 (CVSS 3.1). We took the fixed versions (7.3.4-7013 and 8.2.3-8015) and the lack of a workaround from news coverage, because SonicWall’s advisory page could not be read for this issue. Confirm them in the advisory before you roll out. Mostly organizations are affected: SonicWall firewalls that use SAML-based SSLVPN for remote access.

WordPress core: CVE-2026-119977

The temporary paths used during a core upgrade are predictable and reachable from the web. An unauthenticated attacker can run code on the server in the short window while the upgrade is in progress (CVSS 3.1: 8.1, per Wordfence). The CVE record lists versions 4.7 through 7.1.3 as affected. WordPress released 7.1.4 on October 28, and sites with background updates enabled get it automatically. The release post gives no CVE number for this flaw and says fixes for older branches are still being backported. CISA added it to KEV on November 3. Home users who host their own site and organizations are both affected; sites that turned off automatic updates should upgrade by hand.

Ivanti Connect Secure: CVE-2026-118527 and CVE-2026-111357

CVE-2026-104935 (authentication bypass), which we covered in #1, did not stay alone. According to CISA’s KEV entries, CVE-2026-118527 (a predictable file name that lets an authenticated attacker write content to disk, CVSS 4.3) and CVE-2026-111357 (privilege escalation to root, CVSS 7.0) can be chained with it, and their KEV listing shows all three are used in real attacks. Both were added to KEV on October 30. The CVE-2026-118527 record gives the fixes as 22.8R2.6 and 25.1.1.3, and 25.1.3.0 and later for CVE-2026-104935. Ivanti’s advisory page did not load for this issue, so the fixed version for CVE-2026-111357 comes only from news reports (the same two builds). CISA warns that Ivanti’s Integrity Checker may not show CVE-2026-104935 exploitation because the commands run in memory. Organizations are affected.

• Oct 12 · GitLab 19.4.2, 19.3.5 and 19.2.8 released · Fix for CVE-2026-97229
• Oct 26 · Apple iOS 27.2, iOS 26.7.2, iOS 18.7.11 and macOS updates · Date from Apple’s release list
• Oct 28 · WordPress 7.1.4 released · Fix for the upgrade flaw
• Oct 29 · GitLab and Cisco ASA/FTD flaws added to KEV
• Oct 30 · Two Ivanti flaws added to KEV
• Nov 2 · Android November bulletin published · Updated to version 1.1 on Nov 6
• Nov 3 · Chrome 157 reaches the stable channel · WordPress flaw added to KEV
• Nov 6 · SonicWall SNWLID-2026-0014 and KEV entry · Due date Nov 20

Weekly Security Bulletin #2

Weekly Security Bulletin #1

Order of priority

• Check SonicWall · If you use SAML for SSLVPN, move SonicOS to 7.3.4-7013 (Gen7) or 8.2.3-8015 (Gen8). Confirm the versions in SonicWall’s SNWLID-2026-0014 advisory.
• Bring WordPress to 7.1.4 · Upgrade by hand if you turned off automatic updates. If you are on an older branch, check for the security release for your branch.
• Update Ivanti Connect Secure · 22.8R2.6, 25.1.1.3 or newer. If you suspect a compromise, follow the recovery steps CISA recommends. The 22.8 branch reaches end of life on January 31, 2027.
• Check GitLab · You need 19.4.2, 19.3.5 or 19.2.8 and later. Ruby applications that compile a regex from user input need Ruby 4.0.9, 3.4.12 or 3.3.13.
• PHP, Brotli and Adobe Commerce · PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12; Brotli 1.0.10, 1.1.1 or 1.2.1; the July 2026 patches for Adobe Commerce.
• Update browsers and phones · Chrome 157.0.8103.38 or later, Android patch level 2026-11-05, and on Apple devices iOS 27.2 / 26.7.2 / 18.7.11 and macOS 26.7.2. Then restart the browser.
• Cisco ASA/FTD and VMware ESX · Confirm the fixed versions in the Cisco and Broadcom advisories.

• What does being in KEV mean? · CISA has confirmed the flaw is used in real attacks. Federal agencies usually get between three days and two weeks to patch.
• Why is a flaw scored 2.7 in KEV? · A CVSS score rates technical severity. KEV asks whether attackers use the flaw. A low-scoring flaw is still useful to an attacker if it, say, hides their tracks.
• I do not use SAML. Does the SonicWall flaw affect me? · The CVE record and news reports say it affects setups where SSLVPN logins use SAML. If you are on a version older than 7.3.4-7013 / 8.2.3-8015, updating is still the right call.
• Did my WordPress site update itself? · If background updates are on, it should already be on 7.1.4. Check the version on the Updates screen or in the About window.
• When is the next bulletin? · Every week. The status of this issue’s flaws will appear in the next issue.