Exploited CVEs Nov 2-8, 2026: WordPress, Apple, SonicWall

Three CVEs entered the CISA KEV catalog between November 2 and 8, 2026, according to VulnTracker, and each had a vendor fix out before the listing. WordPress Core's upgrade-window flaw was listed six days after its patch, SonicWall's SSLVPN bypass 17 days after the first Gen 7 fix, and Apple's WebKit bug 905 days after Apple fixed it. Scores run from 5.5 to 8.1 and EPSS from 0.6% to 1.5%. The due dates split into one three-day deadline, November 6, and two 14-day deadlines, November 18 and 20. We covered each of these in its own post this week, and this is the week in one place.

Tuesday, November 3: WordPress Core

CVE-2026-119977 is a time-of-check time-of-use race condition (CWE-367) in WordPress Core's full-package update. During the update the new release is unpacked into a staging directory, and Wordfence describes the staging paths as predictable and web-accessible, so an unauthenticated request can reach the staged installer and run code. It affects WordPress 4.7 through 7.1.3 and is fixed in 7.1.4, released October 28. CISA added it on November 3 with a due date of November 6. VulnTracker scores it 8.1 High from Wordfence, with EPSS at 1.2% and SSVC Active, Not automatable, Total impact.

Attackers do not need to catch the update, they poll for it. THN reported Wordfence blocking 62,969 attacks in one 24-hour period and, after the KEV listing, more than 18,500 requests aimed at staged setup-config.php paths in the first 21 hours after disclosure. Those figures count attempts, not compromises.

Wednesday, November 4: Apple WebKit

CVE-2024-27834 is a pointer authentication bypass in WebKit. Apple fixed it on May 13, 2024 in Safari 17.5, iOS and iPadOS 17.5 and 16.7.8, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5, and WebKitGTK and WPE WebKit fixed it in 2.44.2. CISA added it on November 4, 905 days after the patch, with a due date of November 18. VulnTracker scores it 5.5 Medium with EPSS at 1.5% and SSVC Active, Not automatable, Partial impact, and lists nine products across four vendors, Fedora among them.

The listing follows a Sekoia report published November 4 that attributes a campaign to APT29 with moderate to high confidence. One of its iOS chains pairs CVE-2025-43529, a WebContent remote code execution flaw, with this bug as the pointer authentication bypass, and ends in a JavaScript cookie stealer. Victims arrived through compromised sites, lookalike domains and a supply chain compromise of the Plerdy SEO Tracker script between August 27 and September 3, 2026.

Friday, November 6: SonicWall SonicOS

CVE-2026-19868 is an authentication enforcement flaw in the SonicOS SSLVPN service (CWE-308). A user with valid credentials for an alternate authentication method can bypass SAML controls, and successful exploitation may also bypass SAML-enforced MFA. Gen 7 builds 7.3.3-7015 and older and Gen 8 builds 8.2.2-8015 and older are affected. SonicWall's notice lists 7.3.4-7013 and above for Gen 7, available since October 20, with 7.3.4-7015 on November 5, and 8.2.3-8015 for Gen 8, scheduled for November 6. CISA added it on November 6 with a due date of November 20. VulnTracker shows 7.5 High from CISA-ADP, EPSS at 0.6% and SSVC Active, Not automatable, Partial impact.

THN reports that SonicWall "investigated a report indicating potential exploitation of this vulnerability" and disclosed no detail on the attack or the actor, and THN lists the score as 7.1 and 7.5. It also lists other high-severity flaws SonicWall patched, among them CVE-2026-107155 and CVE-2026-107154, two management interface issues rated 8.8, and CVE-2026-82308, a pre-authentication heap overflow in the SSL-VPN service rated 7.5 that could cause denial of service. None of those is reported as exploited.

The fix came first every time

A KEV listing does not mean the bug is new, and this week the patch date sat before every listing. For a new flaw the gap is a race. WordPress sites that update automatically passed through the exposure window by themselves, and attackers were polling for exactly that moment. For an old flaw the gap is inventory. Apple's bug was fixed in May 2024, yet Sekoia describes it as the bypass in an exploit chain used against visitors in 2026, so any device still below the fixed versions was missing the fix for that chain. SonicWall sits between the two, with a Gen 7 fix 17 days old and the Gen 8 build scheduled for the day CISA listed the flaw.

The first question for each entry is therefore not how severe it is but whether your systems already run the fixed version.

Reading it on VulnTracker

This is how the three records look on VulnTracker for November 2 to 8, newest KEV entry first, with EPSS as of November 9.

All three show SSVC exploitation as Active and Not automatable, and all three sit below 2% EPSS, so go by the KEV flag and not by the EPSS number. The three-day deadline went to the one Total impact entry, WordPress, and the 14-day deadlines went to the two Partial impact entries. Last week identical tags landed in both bands, so one week is a coincidence to watch, not a rule.

Check where each score comes from before comparing. WordPress's 8.1 is from Wordfence, SonicWall's 7.5 is from CISA-ADP while THN also lists 7.1, and Apple's 5.5 is from CISA-ADP. The Apple remediation guide is still empty, so take fixed versions from Apple's advisories listed below.

What to do

The WordPress deadline has passed, so start there, then work toward November 18 and 20.

1. WordPress Core. Update to 7.1.4 or the fixed release for your branch and check the version afterward, because background updates can be switched off by wp-config.php or by your host. Deny web access to wp-content/upgrade/ and look for requests to PHP files in that directory, especially setup-config.php.
2. Apple and WebKit. Update iOS, iPadOS, macOS, Safari, tvOS and watchOS to the newest release for each model, with 17.5, 16.7.8, Sonoma 14.5 and watchOS 10.5 as the floor. Confirm any iOS 16 device is on 16.7.8, update WebKitGTK and WPE WebKit to 2.44.2 or later, and pull the distribution build, such as the Ubuntu webkit2gtk 2.44.2 packages or the Fedora update.
3. SonicWall SonicOS. Upgrade Gen 7 to 7.3.4-7013 or later and Gen 8 to 8.2.3-8015, and confirm in your SonicWall portal that the build is available for your model. The notice lists no workaround, so as a precaution review SSLVPN sessions that did not go through your SAML identity provider and reset credentials for accounts you cannot account for.

Federal agencies must follow each KEV required action under BOD 26-04.

Takeaway

This week's three entries share one fact: the fix existed before CISA's listing, by six days, 17 days and 905 days. That moves the useful question from how severe each bug is to which of your systems still run a version below the fix, starting with anything internet-facing. A 5.5 Apple bug and an 8.1 WordPress bug ended up on the same list for the same reason, which is that attackers use what is unpatched.

To follow how these three records change as EPSS, SSVC fields and remediation guides fill in, add them to your Track List on VulnTracker.

References

• Vendor: WordPress 7.1.4 security release, Wordfence advisory for WordPress Core 4.7.0 - 7.1.3, Apple Safari 17.5, Apple iOS 17.5 and iPadOS 17.5, Apple iOS 16.7.8 and iPadOS 16.7.8, Apple macOS Sonoma 14.5, WebKitGTK WSA-2024-0003, SonicWall SonicOS 7.3.4 and 8.2.3 notice, SonicWall PSIRT SNWLID-2026-0014
• NVD: CVE-2026-119977, CVE-2024-27834, CVE-2026-19868
• CISA: KEV entry for CVE-2026-119977, KEV entry for CVE-2024-27834, KEV entry for CVE-2026-19868, BOD 26-04
• Analysis: The Hacker News on the WordPress attacks, The Hacker News on the Apple KEV listing, Sekoia on APT29 watering holes