FlagThis — Daily Cybersecurity Intelligence Briefing

CISA added CVE-2026-19868 to the Known Exploited Vulnerabilities catalog on November 6, setting a November 20 remediation deadline. The vulnerability in SonicWall SonicOS SSL-VPN permits attackers possessing valid stolen credentials to bypass SAML-enforced multi-factor authentication entirely. SonicWall released a patch for Gen 8 devices via advisory SNWLID-2026-0014, but Gen 6 devices are end-of-life and will not be fixed. Active exploitation has been confirmed, leaving unpatched Gen 6 SSL-VPN endpoints permanently exposed and requiring immediate isolation or replacement.

On October 13, 2026, Ivanti disclosed a high‑severity authentication‑bypass zero‑day (CVE-2026-104935) affecting Ivanti Connect Secure VPN appliances. The flaw allows a remote, unauthenticated attacker to spoof authentication and execute arbitrary commands on the device. Active exploitation was observed by Volexity in early October, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog the same day. Affected releases include 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior; patched versions are 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5. Immediate out‑of‑cycle patching and IOC monitoring are required.

In mid‑September 2026 attackers exploited an unauthenticated stack‑based buffer overflow in Fortinet FortiOS SSL‑VPN (CVE‑2022-42475) affecting versions 6.4.x, 6.2.x, and 7.0.x prior to 7.0.11. A crafted POST to /remote/fgt_lang with directory‑traversal in the lang parameter triggers arbitrary code execution, allowing deployment of a web shell that downloads and executes the PivotC2 Remote Access Trojan. The malware establishes HTTP/S C2 to pivotc2‑update.net and secure‑sync.org, enabling credential harvesting, lateral movement via SMB/WMI, and further payload delivery across government, finance, healthcare, and energy sectors worldwide.