Audience: Vulnerability Managers, Security Operations, CISOs, DevSecOps Teams
Reading Time: Approximately 10 minutes

Subscribe to get these articles directly to your inbox when published

This Week's KEV Additions

Note: EPSS scores are as published by FIRST.org at time of writing and are not updated after publication; scores change daily.

Analysis

CVE-2026-19868 — SonicWall SonicOS

• What it is: SonicWall SonicOS SSLVPN contains an authentication enforcement vulnerability allowing a user with valid credentials for an alternate method to bypass SAML authentication controls and multi-factor authentication (MFA).

• Affected versions: SonicOS Gen7 and Gen8 firmware versions prior to vendor patches.

• Exploitation status: Confirmed active exploitation in the wild, added to CISA KEV on November 6, 2026.

• Patch available: Yes, upgrade SonicOS Gen7 to 7.3.4-7013 and Gen8 to 8.2.3-8015 or later.

• CISA due date: 2026-11-27

• Operational risk: Threat actors leveraging compromised alternate credentials can completely bypass perimeter MFA protections, gaining unauthorized remote access to internal corporate networks and driving lateral movement.

CVE-2024-27834 — Apple Multiple Products

• What it is: An improper authentication vulnerability in Apple WebKit across iOS, iPadOS, macOS, Safari, tvOS, and watchOS that permits an attacker with arbitrary read/write capability to bypass Pointer Authentication (PAC) memory protections.

• Affected versions: Versions of iOS, iPadOS, macOS, Safari, tvOS, and watchOS prior to security updates.

• Exploitation status: Actively exploited in the wild; added to CISA KEV on November 4, 2026.

• Patch available: Yes, apply latest Apple software updates.

• CISA due date: 2026-11-25

• Operational risk: Weakens hardware-based memory security barriers, facilitating sophisticated multi-stage exploitation chains when combined with other memory-corruption flaws.

CVE-2026-119977 — WordPress Core

• What it is: A time-of-check time-of-use (TOCTOU) race condition vulnerability in WordPress Core upgrade handling that allows unauthenticated remote attackers to execute code during the core update window.

• Affected versions: WordPress versions 2.7.0 through 7.1.3.

• Exploitation status: Confirmed active exploitation; added to CISA KEV on November 3, 2026.

• Patch available: Yes, update to WordPress 7.1.4 or later.

• CISA due date: 2026-11-24

• Operational risk: Unauthenticated attackers can win the update race window to inject malicious configuration or execute arbitrary code, yielding full site takeover and server compromise.

Exploitation Context

This week's CISA KEV additions underline a diverse mix of perimeter gateway attacks and software supply-chain update vulnerabilities. Attackers continue to target foundational trust mechanisms—such as VPN multi-factor authentication and application-level update routines—to bypass security boundaries.

The inclusion of critical edge and web application flaws like SonicWall's SAML/MFA bypass and WordPress's upgrade-window TOCTOU flaw demonstrates that adversaries are heavily weaponizing operational transitions and administrative workflows to achieve initial foothold or privilege escalation.

Remediation Priorities

Detection and Monitoring Guidance

• CVE-2026-19868 (SonicWall):

  • Log Sources: SonicOS SSLVPN access logs, authentication logs, firewall session logs.

  • Behavioral Indicators: Successful SSLVPN sessions established via alternate authentication methods without corresponding SAML/MFA challenge validations.

  • Monitoring Gap / Detection Artifacts: Lack of visibility into alternate authentication fallbacks when primary SAML enforcement is bypassed.

• CVE-2024-27834 (Apple):

  • Log Sources: Endpoint telemetry, MDM security logs, browser exploit telemetry.

  • Behavioral Indicators: Abnormal WebKit crashes or unauthorized memory read/write anomalies preceding privilege escalation.

  • Monitoring Gap / Detection Artifacts: Low-level pointer authentication bypasses leave minimal application logs, requiring robust endpoint protection platforms.

• CVE-2026-119977 (WordPress):

  • Log Sources: Web server access logs (Apache/Nginx), WordPress core update logs, file integrity monitoring (FIM).

  • Behavioral Indicators: Rapid, unauthenticated HTTP requests targeting staging file paths precisely during active core upgrade windows.

  • Monitoring Gap / Detection Artifacts: Standard web application firewalls may miss race conditions unless configured to inspect staging path access during maintenance intervals.

Hackerstorm Analysis

The inclusion of CVE-2026-19868 and CVE-2026-119977 highlights a recurring offensive playbook: exploiting trust boundaries during state transitions or authentication checks. Security operations teams must prioritize perimeter network assets and ensure automated patch management windows are tightly monitored to mitigate race-condition and authentication bypass vectors before exploitation scales.

What you should do next

Ensure you understand the latest KEV additions to cover off any potential gaps in your remediation activities.  View all weekly reports here

Further Reading

The following resources offer technical analysis to help integrate CISA KEV data into operational triage workflows and stay aligned with updated mitigation guidance.

About This Report

Attribution Note

This analysis is based on publicly available reporting and security research summaries. Some technical details may change as additional information becomes available. 

Author Information

Timur Mehmet | Founder & Lead Editor

Timur is a veteran Information Security professional with a career spanning over three decades. Since the 1990s, he has led security initiatives across high-stakes sectors, including Finance, Telecommunications, Media, and Energy. Professional qualifications over the years have included CISSP, ISO27000 Auditor, ITIL and technologies such as Networking, Operating Systems, PKI, Firewalls. For more information including independent citations and credentials, visit our About page.

Contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Standards

This article adheres to Hackerstorm.com's commitment to accuracy, independence, and transparency:

• Fact-Checking: All statistics and claims are verified against primary sources and authoritative reports
• Source Transparency: Original research sources and citations are provided in the References section below
• No Conflicts of Interest: This analysis is independent and not sponsored by any vendor or organization
• Corrections Policy: We correct errors promptly and transparently. Report inaccuracies to This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Policy: Ethics, Non-Bias, Fact Checking and Corrections

Learn More: About Hackerstorm.com | FAQs

Source Transparency

• CVE-2026-19868:

  • Rescana (Threat Intelligence) — [https://www.rescana.com/post/sonicwall-sonicos-cve-2026-19868-sslvpn-saml-mfa-bypass](https://www.rescana.com/post/sonicwall-sonicos-cve-2026-19868-sslvpn-saml-mfa-bypass)

  • Aviatrix Threat Research (Vendor Advisory Report) — [https://aviatrix.ai/threat-research-center/sonicwall-ssl-vpn-mfa-bypass-cve-2026-19868-exploited-in-attacks/](https://aviatrix.ai/threat-research-center/sonicwall-ssl-vpn-mfa-bypass-cve-2026-19868-exploited-in-attacks/)

• CVE-2024-27834:

  • Security Affairs (Threat Intelligence Analysis) — [https://securityaffairs.com/202464/hacking/u-s-cisa-adds-apple-flaw-to-its-known-exploited-vulnerabilities-catalog.html](https://securityaffairs.com/202464/hacking/u-s-cisa-adds-apple-flaw-to-its-known-exploited-vulnerabilities-catalog.html)

• CVE-2026-119977:

  • Picus Security (Threat Research) — [https://www.picussecurity.com/resource/blog/cve-2026-119977-when-updating-wordpress-becomes-the-vulnerability](https://www.picussecurity.com/resource/blog/cve-2026-119977-when-updating-wordpress-becomes-the-vulnerability)

Analyst Notes

• No ransomware attribution was publicly associated with this week's KEV additions at the time of publication.
• No confirmed threat actor attribution was available beyond CISA's confirmation of active exploitation for the majority of entries.
• Where vendor advisory details or EPSS values were unavailable at publication time, placeholders were retained pending analyst validation and vendor updates prior to final publication.