SonicWall CVE-2026-19868 + 3 more

The top priority is CVE-2026-19868, a flaw in the SonicWall SonicOS SSLVPN. Possible exploitation has been reported, and CISA added it to its KEV catalog (the list of vulnerabilities known to be exploited) on November 6. It affects you only if SAML is enabled for SSLVPN logins. If that applies, update Gen7 to 7.3.4-7013 or later, and Gen8 to 8.2.3-8015 or later. The vendor lists no workaround. Microsoft Entra Device Registration CVE-2026-109469 has a CVSS of 10.0, but Microsoft has already mitigated it and customers need to do nothing. Updates are also out for Craft CMS (CVSS 9.8) and the WordPress plugin payever Checkout (CVSS 9.8).

This digest is based on CISA KEV, the SonicWall PSIRT advisory, MSRC, NVD, GitHub security advisories and Wordfence, all checked on November 7 (JST). JPCERT/CC and IPA had no new alerts between November 6 and 7. Anything not stated is treated as not disclosed. Of today's four items, only the SonicWall one has reported exploitation; no exploitation has been reported for the other three.

According to SonicWall advisory SNWLID-2026-0014 (published November 6), the SonicOS SSLVPN service has an authentication enforcement flaw. A user with valid credentials for an alternate authentication method may bypass SAML authentication controls, and may also bypass SAML-enforced MFA (multi-factor authentication). The vendor rates it CVSS 3.1 7.1, with the weakness type CWE-308 (use of single-factor authentication). NVD also shows a 7.5 score from CISA-ADP.

The vendor says it investigated a report indicating potential exploitation and strongly urges customers to upgrade to the latest release as soon as possible. CISA added it to KEV on November 6 with a due date of November 20.

In plain terms, even if SSLVPN logins use SAML (single sign-on through your company identity provider) and MFA, someone who knows a password for a different authentication method may be able to get in without passing that gate. The advisory states the flaw affects the SSLVPN only if SAML is enabled for SSLVPN logins. If you do not use SAML, this CVE does not affect you.

Affected and fixed versions are as follows.

The vendor provides no workaround. While an update is pending, general precautions include narrowing the exposure of the SSLVPN and management interface to the internet, reviewing SSLVPN login records, and checking whether any users can log in with an alternate method (such as local or LDAP passwords) alongside SAML. These are general hardening steps, not a vendor workaround.

The same advisory contains six other CVEs, fixed by the same versions: CVE-2026-107155 and CVE-2026-107154 (management interface, CVSS 8.8 each), CVE-2026-82308 (pre-auth heap overflow causing an SSL-VPN DoS, 7.5), CVE-2026-77708 and CVE-2026-77709 (TACACS+ client, 5.9 each), and CVE-2026-19703 (weak password hashing on virtual appliances, 5.2). The advisory as a whole is rated CVSS 8.8.

Steps to check your exposure and respond are in SonicWall CVE-2026-19868: impact check and response steps. Official: SonicWall PSIRT SNWLID-2026-0014, NVD

According to MSRC, this is an elevation of privilege vulnerability in Entra Device Registration. An authorization bypass through a user-controlled key (CWE-639) lets an unauthorized attacker elevate privileges over a network. Microsoft rates it CVSS 10.0 (Critical, temporal 8.7); it is not exploited and not publicly disclosed.

The number is the maximum, but MSRC states that Microsoft has already fully mitigated it and there is no action for users of the service to take. The CVE for this cloud service was published for transparency. Even if you use Entra, you do not need to apply a fix or change settings. Official: MSRC CVE-2026-109469

According to NVD and the GitHub advisory (GHSA-qcvp-ggx3-97r6), Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 have an unauthenticated SQL injection in the element search endpoint. The attribute parameter is concatenated without sanitization, and emulated PDO prepares allow stacked statements. Attackers can read and write the database, and gain admin access by setting an admin flag or overwriting password hashes. It is rated CVSS 3.1 9.8 and CVSS 4.0 9.3. No exploitation has been reported.

In plain terms, the site's search feature could be abused to modify the database without logging in. The fixed versions are 4.18.9 and 5.11.2. If you use Craft CMS, ask your web developer to check the version and update. To check it yourself, run the following in the project directory, or look at the version in the control panel utilities.

Official: GitHub advisory GHSA-qcvp-ggx3-97r6, NVD

According to NVD (published November 7) and Wordfence, versions up to and including 4.8.0 of payever Checkout (payever-woocommerce-gateway), a payment plugin for WooCommerce, have an unauthenticated arbitrary file upload flaw that can lead to remote code execution (RCE). Three WooCommerce API callbacks lacked authentication, capability checks and nonces. Wordfence rates it CVSS 9.8. No exploitation has been reported.

The WordPress.org plugin directory shows the latest version as 4.9.0 (updated October 23, 2026) with about 800 active installs. We could not confirm that 4.9.0 is the fixed version. Because 4.8.0 and earlier are affected, update to the latest version and confirm the fixed version in the Wordfence entry. With WP-CLI you can check whether you use the plugin and which version. If you do not use it, you are not affected.

Official: Wordfence, NVD

- Ask your IT person or vendor whether the company has a SonicWall firewall (TZ, NSa, NSsp, NSv). If not, the SonicWall item does not apply
- If you do, check whether SAML is enabled for SSLVPN logins. If so, ask for an update today to 7.3.4-7013 or later (Gen7) or 8.2.3-8015 or later (Gen8)
- Until then, check SSLVPN login records for unfamiliar connections and for users who can log in by a method other than SAML
- Know that the Microsoft Entra (Microsoft 365) item is already mitigated by Microsoft and needs no work on your side
- Ask your web developer whether your site is built on Craft CMS. If so, request an update to 4.18.9 / 5.11.2 or later
- If your site is WordPress with WooCommerce, check whether it uses the payever plugin. If so, update to the latest version

- SonicWall CVE-2026-19868: impact check and response steps
- Vulnerability digest for November 6
- Ivanti Connect Secure CVE-2026-111357: exploitation and response guide
- UTM and firewall costs for small businesses
- Getting started with patch management for small businesses

- SonicWall PSIRT: SNWLID-2026-0014
- CISA: Known Exploited Vulnerabilities Catalog
- NVD: CVE-2026-19868
- MSRC: CVE-2026-109469
- NVD: CVE-2026-123488
- GitHub advisory: GHSA-qcvp-ggx3-97r6 (Craft CMS)
- NVD: CVE-2026-93754
- Wordfence: payever Checkout vulnerability