Remote Access Under Pressure: Ivanti and SonicWall

Two vendors with long KEV histories appear again, and the pattern is familiar: VPN and access appliances are attacked through chained or weakened authentication.

Ivanti Connect Secure has two entries, both added October 30. They complete the zero-day chain Volexity disclosed in October, which began with CVE-2026-104935 (added to KEV October 13, deadline October 16).

• CVE-2026-111357 is the privilege escalation that took attackers from the web server account to root, by abusing how the appliance's dsinvoked service trusts its DSCache configuration data. Its deadline was November 2 (overdue).
• CVE-2026-118527 is a predictable-filename issue that lets an authenticated remote attacker write attacker-controlled files to a known disk location. It is due November 13.

The October fix for CVE-2026-104935 did not close these. Ivanti said at the time that the privilege escalation fix would come in a later release, and reporting on the new advisory lists 22.8R2.5, the October build, among the affected versions. Organizations that patched in October need this update too. Reporting points to 25.1.1.3 and 22.8R2.6 as fixed builds, but published version lists conflict, so confirm against Ivanti's current advisory. Apply all fixes in one window rather than following the separate deadlines.

Because this chain was used to steal Active Directory credentials, LAPS passwords, and BitLocker recovery keys from fully patched appliances, assume compromise is possible until you have checked:

• Do not rely on Ivanti's Integrity Checker Tool. The attackers modified code only in memory and restored what they changed, so the tool is unlikely to detect this activity. Network and memory forensics are required.
• Hunt web logs for bursts of requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header, and check /tmp/ on the appliance.
• If compromise is suspected, rebuild the appliance rather than trusting it, rotate credentials and certificates, reset connected identity secrets, and rotate LAPS passwords and BitLocker keys domain-wide.

SonicWall SonicOS SSLVPN (CVE-2026-19868) is a single-factor authentication flaw. A user with valid credentials for an alternate authentication method can bypass SAML controls, including SAML-enforced MFA. It was added today with a deadline of November 20. It requires valid credentials, but that is a low bar given how many stolen credentials circulate. The practical danger is false assurance: your IdP logs may show MFA enforced while the VPN accepted another method.

SonicWall's last MFA bypass is a warning here. With CVE-2024-12802, organizations that installed the firmware fix stayed exposed because the fix also required manual configuration changes, and attackers exploited that gap in early 2026. Read SonicWall's advisory for any configuration steps that go with this patch, not just the firmware version. Until then, disable unneeded local or alternate authentication methods on SSLVPN, review VPN logs for logins that never touched your IdP, and compare them against SAML assertions.

Lower Drama, Real Consequences: Apple and ESX

Two entries are less immediately severe but matter for specific environments.

Apple (CVE-2024-27834) is a pointer authentication bypass affecting iOS, iPadOS, macOS, Safari, tvOS, and watchOS. It requires an attacker who already has arbitrary read/write capability, so it is typically a link in an exploit chain rather than an entry point. The deadline is November 18. Note the year in the CVE number: this is a 2024 flaw, and Apple fixed it in its May 2024 updates. Any device that has received an update since then is already protected. The exposure is devices stuck on old software, such as hardware that can no longer update, unmanaged personal devices, and kiosk or shared iPads. Use MDM compliance reports to find devices still on pre-May-2024 versions, and retire or isolate any that cannot update. Lockdown Mode remains worth considering for the highest-risk individuals.

Broadcom VMware ESX (CVE-2026-41709) is an insufficient logging flaw that lets an administrator perform certain operations without leaving a record. It is due November 11. This is an anti-forensics gap rather than an access vulnerability, but hypervisors are prime ransomware targets and missing logs slow investigations. Forward ESX logs to an external collector, restrict and monitor administrative access to management interfaces, and do not treat the absence of logs on an unpatched host as evidence of no activity.

Priorities

1. Today: WordPress Core. Block wp-content/upgrade/, update, then inspect for post-exploitation artifacts.
2. Overdue: Close GitLab (CVE-2026-97229), Cisco ASA/FTD (CVE-2026-76418), Ivanti (CVE-2026-111357), and the Linux kernel "Fragnesia" flaw (CVE-2026-46300, due October 31, chained with PHP2Shell to reach root on web servers). For GitLab, Ivanti, and Linux web servers exposed to PHP2Shell, assume possible compromise and hunt, then rotate credentials.
3. Next week: Brotli/Node2Shell (CVE-2026-111497) and Adobe Commerce/Magento (CVE-2026-48356), both due November 10; ESX (November 11); and Ivanti CVE-2026-118527 (November 13), alongside its companions.
4. By Nov 18-20: Apple and SonicWall.

Under BOD 26-04, each asset's internet exposure drives urgency, and where mitigations are unavailable, discontinue use of the product. Contractors should document exposure assessments and forensic triage results, since patch status alone will not demonstrate compliance.

Sources: CISA KEV Catalog · CISA Binding Operational Directives · SonicWall PSIRT Advisories · BleepingComputer: Hackers Bypass SonicWall VPN MFA Due to Incomplete Patching · Apple Security Releases · Wordfence: WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE · WordPress Security Advisory GHSA-4w3m-c66w-69mg · Ivanti Security Advisories · Volexity: Chained Exploitation of Ivanti Connect Secure Zero-Days · Cisco Security Advisories · GitLab Releases and Security Patches · Broadcom VMware Security Advisories