SonicWall SonicOS SSL VPN Authentication Bypass Vulnerability Under Active Exploitation
SonicWall has disclosed multiple vulnerabilities in its SonicOS operating system used in physical firewalls and virtual appliances. The company published security advisory SNWLID-2026-0014 on November 6, 2026, detailing seven issues, one of which is already under active exploitation.
The most critical finding is CVE-2026-19868, an authentication bypass vulnerability in the SSL VPN component. The flaw impacts deployments that have SAML authentication enabled. An attacker who possesses valid credentials obtained through a different authentication method can bypass the SAML-based access controls entirely.
Security researchers note that this bypass also defeats multi-factor authentication (MFA) when MFA is enforced via SAML. The vulnerability received a CVSS v3.1 base score of 7.1. SonicWall stated it is investigating reports of in-the-wild exploitation and strongly recommends immediate application of the available patches.
Related articles
WordPress Core Update Flaw Draws Over 240,000 Attack Attempts Since Patch Release
Wordfence has blocked more than 240,000 attack attempts targeting a race condition vulnerability in the WordPress core update process, tracked as CVE-2026-119977 with a CVSS score of 8.1. The attempts began on October 28, the same day WordPress issued the fix, with a single-day peak exceeding 74,000 blocked requests. The flaw allows attackers to exploit predictable temporary upgrade files during the automatic core update, enabling them to complete an installation, create an administrator account, and upload malicious PHP code without any existing credentials. The vulnerability affects branches from version 4.7 through 7.1.3, with the fix available in 7.1.4 and backported releases for older lines. Because automatic updates are enabled by default on most sites, the exposure window opens silently during routine maintenance. Security researchers emphasize that the high volume of attempts does not confirm successful compromises, urging administrators to review user lists and modified files after any core update since late October.
Multiple Critical Vulnerabilities Found in OpenAM Identity Platform
Open Identity Platform disclosed 18 vulnerabilities in its OpenAM identity management platform on October 22, 2026. Three of these issues received the highest severity rating of Critical. The vulnerabilities were fixed in the OpenAM 16.1.4 release. One Critical flaw tracked as CVE-2026-123551 affects the WebSocket notification service used for session start and end events. Attackers can bypass authentication checks on WebSocket connections to leak user session tokens, enabling full session hijacking including for administrator accounts. V ulnCheck assigned a maximum CVSS v4.0 base score of 10.0 to this issue.
Analysis of 284 Major Russian Sites Reveals Widespread DMARC Misconfigurations, Outdated Libraries and Subdomain Takeover Risks
An automated scan of 284 large Russian websites found that 24 percent allow easy email spoofing because DMARC records are either missing or set to p=none. Nearly one quarter of readable sites still load JavaScript libraries such as jQuery versions from 2013-2016 that carry publicly known CVEs. Half the sites transmit visitor IP addresses and cookies to foreign analytics services despite privacy policies claiming otherwise. Five abandoned subdomains point to AWS and DigitalOcean addresses that could be claimed for phishing. Government sites performed no better than commercial ones on most checks. The researcher released the open-source Suveren tool so any organization can run the same tests against its own domains.
Top Cybersecurity Articles of the Week: Linux Kernel TCP Flaw Leads Security NEXT Rankings
Security NEXT has published its weekly ranking of the most-read articles for the period of November 1 to November 7, 2026. The list is dominated by critical vulnerability disclosures and patches across widely used platforms. Leading the chart is a severe flaw in the Linux kernel's IPv4 TCP connection handling that has already attracted proof-of-concept reports. Other prominent entries include remote code execution issues in WordPress, hundreds of fixes in Chrome 157, and multiple critical vulnerabilities in pgAdmin 4. The ranking also highlights confirmed exploitation of Apple product vulnerabilities and a network intrusion at Japan's Ministry of Foreign Affairs that may have exposed personal data.