CISA’s Known Exploited Vulnerabilities (KEV) Catalog received three new additions this week. The vulnerabilities affect SonicWall SonicOS SSLVPN, multiple Apple products and WordPress Core.
Although the number of additions is relatively small, the affected technologies deserve attention. They cover three important areas of enterprise security: remote access authentication, endpoint security and web application infrastructure.
Let’s look at what changed this week.
1. SonicWall SonicOS SSLVPN – CVE-2026-19868
Added to KEV: November 6, 2026
CWE: CWE-308 – Use of Single-factor Authentication
CISA remediation deadline: November 20, 2026
The latest addition concerns SonicWall SonicOS SSLVPN and an authentication weakness that could undermine SAML-based access controls.
CVE-2026-19868 allows a user with valid credentials through an alternate authentication method to bypass SAML authentication controls. More importantly, the weakness could also bypass multi-factor authentication enforced through SAML.
This is particularly concerning for organisations that rely on SSLVPN as their primary remote access gateway. An authentication architecture may appear to enforce MFA, but an alternate authentication pathway can undermine that security boundary.
SonicWall has acknowledged reports of potential exploitation and released security updates.
What organisations should do:
- Identify SonicWall appliances running affected SonicOS versions.
- Review SSLVPN deployments configured for SAML authentication.
- Validate that alternate authentication methods cannot bypass MFA enforcement.
- Upgrade to the vendor-recommended fixed releases.
- Review authentication logs for suspicious access patterns.
Remote access infrastructure remains a high-value target. Authentication controls must be consistently enforced across every available access path.
2. Apple Multiple Products – CVE-2024-27834
Added to KEV: November 4, 2026
CWE: CWE-287 – Improper Authentication
CVSS: 5.5
CISA remediation deadline: November 18, 2026
The second addition is an older vulnerability that has now entered the KEV catalog following evidence of exploitation.
CVE-2024-27834 affects multiple Apple product families, including iOS, iPadOS, macOS, Safari, tvOS and watchOS.
The vulnerability could allow an attacker who already possesses arbitrary read and write capabilities to bypass Pointer Authentication.
Pointer Authentication is a hardware-backed security mechanism designed to protect control-flow integrity by validating pointers. Bypassing this protection can weaken an important security boundary within Apple’s platform security architecture.
The vulnerability was addressed through Apple’s security updates in 2024. Its inclusion in the KEV catalog in November 2026 is a reminder that older vulnerabilities can remain relevant when exploitation evidence emerges.
What organisations should do:
- Identify Apple devices that have not received the relevant security updates.
- Validate operating system and browser patch levels.
- Include managed Apple endpoints in vulnerability compliance reporting.
- Prioritise devices that remain on vulnerable software versions.
The age of a vulnerability should never be the deciding factor in remediation. Exploitation evidence changes its operational priority.
3. WordPress Core – CVE-2026-119977
Added to KEV: November 3, 2026
CWE: CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition
CVSS: 8.1
CISA remediation deadline: November 6, 2026
The third vulnerability affects WordPress Core and introduces a security risk during the software upgrade process itself.
CVE-2026-119977 is a race-condition vulnerability that could allow an unauthenticated attacker to execute code on the web server during a WordPress core update.
The issue involves the temporary staging area used during full-package upgrades. Under specific conditions, an attacker may be able to access files during the upgrade window and exploit the timing gap.
The interesting aspect is that the attack surface is not necessarily the publicly accessible WordPress application functionality. It is the maintenance and upgrade mechanism.
WordPress addressed the vulnerability in version 7.1.4 and released fixes for supported earlier branches as well.
The vulnerability has been added to CISA’s KEV catalog based on evidence of active exploitation.
What organisations should do:
- Identify WordPress installations running vulnerable versions.
- Upgrade to the appropriate fixed release.
- Review exposure of the wp-content/upgrade directory.
- Restrict public access to temporary upgrade files.
- Review web server logs for suspicious requests targeting upgrade paths.
For organisations hosting multiple WordPress websites, this deserves attention across the entire hosting environment rather than just the primary website.
What Security Teams Should Prioritize
This week’s additions highlight why vulnerability management cannot depend entirely on CVSS scores.
Three different technologies introduce three different security concerns.
Remote access security: SonicWall demonstrates how alternate authentication pathways can undermine MFA enforcement.
Endpoint security: Apple’s older vulnerability reinforces the need to maintain patch compliance across the entire device ecosystem.
Application infrastructure: WordPress demonstrates that software maintenance mechanisms can themselves become attack surfaces.
For security and vulnerability management teams, the immediate actions should be:
- Reconcile all three CVEs against the enterprise asset inventory.
- Identify internet-facing SonicWall SSLVPN appliances and vulnerable WordPress installations.
- Validate Apple endpoint patch compliance.
- Prioritise remediation based on confirmed exploitation and asset exposure.
- Review relevant authentication, endpoint and web server logs.
- Track remediation through the vulnerability management dashboard.
CISA’s remediation deadlines apply to US Federal Civilian Executive Branch agencies. Other organisations can use these dates as prioritisation references rather than mandatory compliance deadlines.
Prioritise what is being exploited. Understand where you are exposed. Remediate before the weakness becomes an incident.
