CISA added exploited vulnerabilities affecting WordPress Core, Apple products and SonicWall SonicOS SSLVPN to its Known Exploited Vulnerabilities catalog during November 2–8. WordPress exposes an upgrade window to unauthenticated code execution, while the SonicWall flaw can bypass SAML authentication and SAML-enforced multi-factor authentication. Apple’s entry concerns a Pointer Authentication bypass with fixes available across several product lines.
None of the three entries is marked by CISA as known to be used in ransomware campaigns. Their inclusion in KEV establishes exploitation evidence; their CVSS scores describe severity, not the probability of an attack.
The week’s three additions compare with an average of 8.7 per week over the preceding 12 weeks. Two entered KEV within seven days of NVD publication; the Apple vulnerability had been public in NVD for more than a year. The median interval was three days. These intervals measure catalog timing, not when exploitation began.
WordPress Core: code execution during full-package upgrades
CVE-2026-119977 affects WordPress Core versions 4.7 through 7.1.3, according to the NVD description. It is a time-of-check/time-of-use race condition involving predictable staging paths that are accessible over the web during full-package core upgrades.
An unauthenticated attacker can exploit that upgrade window to execute code on the server. The exposure therefore depends on the upgrade process, rather than simply the presence of an affected installation. NVD assigns a CVSS v3 score of 8.1.
CISA added the vulnerability on November 3, three days after NVD publication and four days after its listing in VulnCheck KEV. The federal remediation deadline was November 6, which has already passed as of November 9.
SonicWall: alternate credentials can bypass SAML controls
CVE-2026-19868 affects authentication enforcement in the SonicOS SSLVPN service. A user with valid credentials for an alternate authentication method may bypass SAML authentication controls. Successful exploitation may also bypass MFA enforced through SAML.
That credential prerequisite matters: the described attack requires valid credentials for another authentication method. The NVD CVSS v3 score is 7.5.
CISA added the flaw on November 6, on or before its NVD publication date. The federal remediation deadline is November 20.
Apple: Pointer Authentication bypass with published fixes
CVE-2024-27834 may allow an attacker who already has arbitrary read and write capability to bypass Pointer Authentication. NVD assigns it a CVSS v3 score of 5.5. Its lower score does not negate the exploitation evidence represented by its KEV listing.
According to the NVD description, improved checks address the issue in these releases:
- Safari 17.5.
- iOS 16.7.8 and iPadOS 16.7.8.
- iOS 17.5 and iPadOS 17.5.
- macOS Sonoma 14.5.
- tvOS 17.5.
- watchOS 10.5.
CISA added the vulnerability on November 4, 904 days after NVD publication, and set November 18 as the federal remediation deadline.
What defenders should do this week
Check exposure to all three product families, giving immediate attention to the recently disclosed WordPress and SonicWall entries. For Apple deployments, check remediation against the fixed releases above. None of this week’s entries carries CISA’s known-ransomware-use flag.
For all three vulnerabilities, CISA directs organizations to apply vendor-prescribed mitigations in accordance with BOD 26-04 and its “Forensics Triage Requirements,” assess each asset’s internet exposure, and follow applicable BOD 26-04 guidance for cloud services. CISA’s instruction is to discontinue use if mitigations are unavailable.
The KEV deadlines bind covered US federal civilian agencies under BOD 22-01. Other organizations should use them as prioritization signals: WordPress’s November 6 deadline has passed, followed by Apple on November 18 and SonicWall on November 20.
