SonicWall

Weekly Digest

Exploited CVEs Nov 2-8, 2026: WordPress, Apple, SonicWall

Three exploited CVEs entered CISA KEV last week: WordPress Core, Apple WebKit and SonicWall SonicOS. Each had a vendor fix before the listing, from six days to 905 days earlier. Here is the week in one place, with deadlines and what to patch first.

SonicWall

CVE-2026-19868: SonicWall SonicOS SSLVPN SAML Bypass Added to CISA KEV

CISA put a SonicOS SSLVPN flaw on KEV the day its CVE was published. A valid credential for an alternate login method can bypass SAML and MFA. Here is who is affected, the fixed builds, and what to do.