Three-day deadlines don't leave room
for a missed email.
CyberComply monitors the CISA KEV catalog 24/7 and alerts you within minutes of every new listing, so the clock never starts without you.
KEV Brief: Edge Access, Pre-Auth RCE, and the Deadlines Already Behind Us
Date: Friday, November 6, 2026
Eight recent KEV entries share one theme: attackers are targeting the systems that gate access to everything else. Remote access gateways, perimeter firewalls, CI/CD servers, and CMS platforms dominate the list. Several deadlines have already passed, one lands today, and a Friday-afternoon addition puts SonicWall's VPN back on the list.
Overdue and Due Today: Unauthenticated Paths to Code Execution
Three entries have deadlines that have already expired or expire today. Treat them as incident-response triggers, not routine patch tickets.
GitLab (CVE-2026-97229) is the most severe. This integer overflow in GitLab CE/EE lets an unauthenticated attacker execute code on the server through a crafted regular expression in a CI/CD configuration. Fixed versions are 19.2.8, 19.3.5, and 19.4.2. The deadline was November 1, so it is overdue. A compromised GitLab server exposes source code, pipeline secrets, runner tokens, and deployment credentials. After patching, rotate CI/CD variables, deploy keys, and tokens, and audit recent pipeline configuration changes and runner activity. Where possible, move instances behind a VPN or an IP allowlist.
WordPress Core (CVE-2026-119977) is a TOCTOU race condition that allows unauthenticated code execution during the upgrade window. During a full-package core upgrade, WordPress unpacks the new files, including its installer, into a predictable, web-accessible folder under wp-content/upgrade/, and an attacker who reaches it in the seconds before cleanup can run code. It affects WordPress 4.7 through 7.1.3 and is fixed in 7.1.4, with security releases for every older branch back to 4.7. The deadline is today, November 6.
Because the vulnerable moment is the upgrade itself, patching opens the window you are trying to close. Wordfence logged about 18,500 exploitation attempts in the first 21 hours after release, so attackers are watching for exactly that moment. The order matters:
- Block web access to
wp-content/upgrade/first, at the web server, WAF, or reverse proxy. - Then update to 7.1.4 or your branch's security release, and confirm the version afterward.
- Then inspect access logs for requests to
wp-content/upgrade/, and check for unexpected PHP files, new admin users, and modifiedwp-config.phpor plugin files.
Sites that auto-update or run on managed hosts deserve scrutiny, since you may not control upgrade timing. Ask your host whether the folder is blocked.
Cisco Secure Firewall ASA and FTD (CVE-2026-76418) is a NULL pointer dereference that lets an unauthenticated remote attacker force a device reload, causing denial of service. The deadline was November 1 and is overdue. Availability matters here because these devices sit in the traffic path. Repeated reloads can degrade or open your perimeter depending on failover design. Patch HA pairs sequentially, verify failover behavior first, and check logs for unexplained reloads or crash files. A KEV listing means someone is exploiting this in the wild, so unexplained reloads should be treated as potential exploitation.
Remote Access Under Pressure: Ivanti and SonicWall
Two vendors with long KEV histories appear again, and the pattern is familiar: VPN and access appliances are attacked through chained or weakened authentication.
Ivanti Connect Secure has two entries, both added October 30. They complete the zero-day chain Volexity disclosed in October, which began with CVE-2026-104935 (added to KEV October 13, deadline October 16).
- CVE-2026-111357 is the privilege escalation that took attackers from the web server account to root, by abusing how the appliance's dsinvoked service trusts its DSCache configuration data. Its deadline was November 2 (overdue).
- CVE-2026-118527 is a predictable-filename issue that lets an authenticated remote attacker write attacker-controlled files to a known disk location. It is due November 13.
The October fix for CVE-2026-104935 did not close these. Ivanti said at the time that the privilege escalation fix would come in a later release, and reporting on the new advisory lists 22.8R2.5, the October build, among the affected versions. Organizations that patched in October need this update too. Reporting points to 25.1.1.3 and 22.8R2.6 as fixed builds, but published version lists conflict, so confirm against Ivanti's current advisory. Apply all fixes in one window rather than following the separate deadlines.
Because this chain was used to steal Active Directory credentials, LAPS passwords, and BitLocker recovery keys from fully patched appliances, assume compromise is possible until you have checked:
- Do not rely on Ivanti's Integrity Checker Tool. The attackers modified code only in memory and restored what they changed, so the tool is unlikely to detect this activity. Network and memory forensics are required.
- Hunt web logs for bursts of requests to
/dana-na/auth/url_default/welcome.cgicarrying anX-DSCGI-PATHheader, and check/tmp/on the appliance. - If compromise is suspected, rebuild the appliance rather than trusting it, rotate credentials and certificates, reset connected identity secrets, and rotate LAPS passwords and BitLocker keys domain-wide.
SonicWall SonicOS SSLVPN (CVE-2026-19868) is a single-factor authentication flaw. A user with valid credentials for an alternate authentication method can bypass SAML controls, including SAML-enforced MFA. It was added today with a deadline of November 20. It requires valid credentials, but that is a low bar given how many stolen credentials circulate. The practical danger is false assurance: your IdP logs may show MFA enforced while the VPN accepted another method.
SonicWall's last MFA bypass is a warning here. With CVE-2024-12802, organizations that installed the firmware fix stayed exposed because the fix also required manual configuration changes, and attackers exploited that gap in early 2026. Read SonicWall's advisory for any configuration steps that go with this patch, not just the firmware version. Until then, disable unneeded local or alternate authentication methods on SSLVPN, review VPN logs for logins that never touched your IdP, and compare them against SAML assertions.
Lower Drama, Real Consequences: Apple and ESX
Two entries are less immediately severe but matter for specific environments.
Apple (CVE-2024-27834) is a pointer authentication bypass affecting iOS, iPadOS, macOS, Safari, tvOS, and watchOS. It requires an attacker who already has arbitrary read/write capability, so it is typically a link in an exploit chain rather than an entry point. The deadline is November 18. Note the year in the CVE number: this is a 2024 flaw, and Apple fixed it in its May 2024 updates. Any device that has received an update since then is already protected. The exposure is devices stuck on old software, such as hardware that can no longer update, unmanaged personal devices, and kiosk or shared iPads. Use MDM compliance reports to find devices still on pre-May-2024 versions, and retire or isolate any that cannot update. Lockdown Mode remains worth considering for the highest-risk individuals.
Broadcom VMware ESX (CVE-2026-41709) is an insufficient logging flaw that lets an administrator perform certain operations without leaving a record. It is due November 11. This is an anti-forensics gap rather than an access vulnerability, but hypervisors are prime ransomware targets and missing logs slow investigations. Forward ESX logs to an external collector, restrict and monitor administrative access to management interfaces, and do not treat the absence of logs on an unpatched host as evidence of no activity.
Priorities
- Today: WordPress Core. Block
wp-content/upgrade/, update, then inspect for post-exploitation artifacts. - Overdue: Close GitLab (CVE-2026-97229), Cisco ASA/FTD (CVE-2026-76418), Ivanti (CVE-2026-111357), and the Linux kernel "Fragnesia" flaw (CVE-2026-46300, due October 31, chained with PHP2Shell to reach root on web servers). For GitLab, Ivanti, and Linux web servers exposed to PHP2Shell, assume possible compromise and hunt, then rotate credentials.
- Next week: Brotli/Node2Shell (CVE-2026-111497) and Adobe Commerce/Magento (CVE-2026-48356), both due November 10; ESX (November 11); and Ivanti CVE-2026-118527 (November 13), alongside its companions.
- By Nov 18-20: Apple and SonicWall.
Under BOD 26-04, each asset's internet exposure drives urgency, and where mitigations are unavailable, discontinue use of the product. Contractors should document exposure assessments and forensic triage results, since patch status alone will not demonstrate compliance.
Sources: CISA KEV Catalog · CISA Binding Operational Directives · SonicWall PSIRT Advisories · BleepingComputer: Hackers Bypass SonicWall VPN MFA Due to Incomplete Patching · Apple Security Releases · Wordfence: WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE · WordPress Security Advisory GHSA-4w3m-c66w-69mg · Ivanti Security Advisories · Volexity: Chained Exploitation of Ivanti Connect Secure Zero-Days · Cisco Security Advisories · GitLab Releases and Security Patches · Broadcom VMware Security Advisories
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — November 5, 2026
Active Exploitation Confirmed Against Siemens Industrial Devices and BTCPay Server Cryptocurrency Infrastructure
Researchers report active exploitation of CVE-2026-58115, a maximum-severity vulnerability in Siemens SIMATIC IoT2050 devices, enabling remote attackers to execute arbitrary code and deploy Linux bot payloads, according to The Hacker News. The flaw affects industrial IoT gateway devices used in manufacturing and critical infrastructure environments, though operational details of successful compromises have not been independently verified. Separately, attackers exploited a vulnerability in BTCPay Server versions 2.4.1 and earlier to steal Bitcoin and Litecoin from hot wallets in ongoing cryptocurrency theft campaigns, The Hacker News reports. BTCPay Server is an open-source cryptocurrency payment processor used by merchants and exchanges, though the number of affected installations and total cryptocurrency losses remain undisclosed. Neither campaign attribution nor overlap with known threat actor clusters has been established.
European Refrigeration Infrastructure Attack and North Korean Cryptocurrency Laundering Activity
Multiple sources report cyberattacks on November 2 altered refrigeration control systems at European supermarkets and French blood banks, forcing stores to discard food and raising concerns about operational technology vulnerabilities. Reuters, RTE, and ABC News documented the incidents, though attribution, technical exploitation methods, and the full scope of affected facilities remain under investigation. Separately, blockchain analysts observed North Korea-linked TraderTraitor group resuming laundering operations for proceeds from the Binance breach, routing ether through THORChain to convert to bitcoin, CoinDesk reports. The activity appears linked to the $6.3 billion Binance compromise reported yesterday, though exact transaction volumes and destination wallets have not been fully mapped.
Additional Exploitation and Compromise Disclosures
CISA added a patched Apple vulnerability (CVE-2024-27834) to its Known Exploited Vulnerabilities catalog after confirming exploitation to deliver information-stealing malware, The Hacker News reports. Security Week documented China-linked actors exploiting PHP2Shell flaws chained with the Fragnesia kernel privilege escalation vulnerability to gain root access on Palo Alto Networks firewalls and deploy webshells. Researchers reported exploitation of Chrome and Qualcomm Adreno GPU driver flaws to infect Android devices through malicious websites, Android Authority reports, though campaign scale and victim counts remain unconfirmed. A French banking firm confirmed experiencing a "sophisticated attack" with reports estimating $133 million stolen, The Record reports, though the bank has not disclosed technical details or attribution. A U.S. federal grand jury indicted two Canadian nationals for allegedly hacking multiple U.S. universities to conduct cryptocurrency mining operations, SC Media reports.
Sources: The Hacker News · The Hacker News · Reuters · RTE · CoinDesk · The Record · Security Week · Android Authority · SC Media
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades
CISA confirms active exploitation of CVE-2026-119977, a WordPress Core TOCTOU race condition that allows unauthenticated attackers to execute code dur...
Meet *sshole, the vulnerability that lets hackers SSH into Linux devices - Ars Technica
Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption...
Hackers Paid $15 to Drain $2.5 Billion From Binance in One Hit - Bloomberg
The hackers who stole $6.3 billion from Binance last week found a way to take 40% of the stolen cryptocurrency in one hit, reducing their chances ...
CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access
... Hacker News via email. "That's an unauthenticated root shell on every install, and it never shows up in a code review." "A compromised ARTEX ...
North Korea's army of world-class hackers is secret weapon that took down Binance
North Korea rewards its top hackers, tasked with heists like the Binance crypto hack that netted a cool $6.3 billion, with perks such as a ...
OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
That * matches the stored * , so sshd accepts the login. The upper end of the range is sshd's own limit of 1,024 bytes per password. Cybersecurity.
Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls
Chinese APT group Warp Panda exploited a VMware ESX zero-day vulnerability to hide their tracks while chaining other exploits to compromise firewall s...
Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets
Attackers exploited a vulnerability in BTCPay Server versions 2.4.1 and earlier to steal Bitcoin and Litecoin from hot wallets in ongoing cryptocurren...
Updated daily