Daily briefing · November 6, 2026
SonicOS SAML bypass under active exploitation as WordPress plugin flaws pile up
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — attention2 seen before CISA
The day calls for ATTENTION: three vulnerabilities are under active exploitation and two were observed by VulnCheck before CISA confirmation, though none has yet become a ready-made weapon. The standout is CVE-2026-19868 in SonicOS, which is in both the CISA KEV and the VulnCheck KEV and allows SAML authentication and MFA to be bypassed on the SSLVPN service. Alongside it, a wave of critical WordPress plugin flaws, some weaponized on the very day of disclosure, and two CVSS 10.0 bugs in Entra Device Registration and wanderer demand quick triage.
Today’s brief
- CVE-2026-19868 (SonicOS SSLVPN) is confirmed as actively exploited and can bypass SAML-enforced MFA.
- VulnCheck saw exploitation of CVE-2026-118423 (WP Libre Form, unauthenticated RCE) and CVE-2026-109884 (Elementor) before CISA.
- Two CVSS 10.0 flaws, in Entra Device Registration and wanderer, were published today.
- Several critical WordPress plugins (PoCs available, some weaponized on disclosure day) allow SQLi, command execution and account takeover.
Critical highlights
1
Confirmed active exploitation (CISA KEV and VulnCheck KEV). A user with valid credentials for an alternate authentication method can bypass SAML controls, including MFA, on the SonicOS SSLVPN, undermining remote access protection.
2
Observed by VulnCheck before CISA, CVSS 10.0, with a PoC weaponized on the same day as disclosure. It lets unauthenticated attackers upload PHP files and obtain remote code execution on sites running WP Libre Form 1.5.0.1, a strong sign attackers are prioritizing it.
3
Reflected XSS in Elementor Website Builder (through 4.3.5), already observed in exploitation by VulnCheck ahead of CISA. Given the plugin's huge install base, it is an early warning worth patching promptly.
4
Authorization bypass via user-controlled key in Entra Device Registration, CVSS 10.0, allowing privilege escalation over the network by an unauthorized attacker. Identity infrastructure flaws like this can have far-reaching consequences if exposed.
5
Unauthenticated SSRF in wanderer before 0.20.0 when the instance is not configured as private, enabling requests to internal services and possibly cloud metadata addresses. Self-hosted instances exposed to the internet should be updated and reviewed.
6
CVE-2026-119516CVSS 9.8affects Radius Booking — Booking Calendar for Appointments & Services Insecure deserialization (object injection) in Radius Booking through 1.0.20, CVSS 9.8. Such flaws can lead to full site compromise depending on the available gadget chains; EPSS is currently low.
7
Incorrect privilege assignment in the miniOrange OAuth Single Sign On plugin through 7.1.3, allowing privilege escalation (CVSS 9.8). A flaw in an authentication plugin directly threatens administrative access to the site.
8
CVE-2026-113615CVSS 9.8PoCsame dayaffects GS JWT Authentication for WP REST API Unauthenticated SQL injection in GS JWT Authentication for WP REST API that can yield an administrator session; PoC weaponized on the day of disclosure. The speed of weaponization suggests heightened attacker interest.
9
Unsanitized shell metacharacters in Static Snapshot (through 0.2.1) allow unauthenticated arbitrary command execution on the host. A public PoC exists, so exposed sites should remove or isolate the plugin.
10
Missing capability, nonce and ownership checks on an AJAX action in placester (through 1.4.3) let unauthenticated attackers overwrite any user's email, including an admin's, and take over the account via password reset. A PoC is available and exploitation is trivial.
Ransomware today
Recently discovered victims are almost all Brazilian: MAPFRE Brasil 2026 (Destello), Coemi Imóveis, Solutis Tecnologias and the Secretaria de Estado de Saúde (all thegentlemen), Sistel (Aoqin), Interativa Plasticos/Interplast (medusalocker) and centratamagroup.com (lockbit5). Over the past 30 days, thegentlemen leads with 7 victims, followed by N0n (6), qilin (4) and emperador (4), all with their victims concentrated in Brazil.
MAPFRE Brasil 2026 BRDestello · Financial Services
Coemi Imóveis BRthegentlemen · Retail & E-Commerce
Solutis Tecnologias BRthegentlemen · Technology
Sistel BRAoqin · Technology
Secretaria de Estado de Saúde BRthegentlemen · Government & Defense
Interativa Plasticos (Interplast) BRmedusalocker · Manufacturing
centratamagroup.com BRlockbit5 · Other
thegentlemen 7N0n 6qilin 4emperador 4Eclipse 2incransom 2
Active groups & APTs
Among the groups listed as targeting Brazil, lockbit5 has the most victims in leak sites (55), followed by thegentlemen (42), lockbit3 (39), ransomhub (35, Russian origin), Akira (24) and arcusmedia (23). The weight of the LockBit variants and thegentlemen shows persistent pressure on Brazilian organizations.
Brazil focus
In the last 30 days Brazilian victims span financial services (MAPFRE Brasil 2026), technology (Solutis Tecnologias, Sistel), government (Secretaria de Estado de Saúde), retail (Coemi Imóveis, Punta Shopping), manufacturing (Interplast) and other sectors (centratamagroup.com). The groups involved include Destello, thegentlemen, Aoqin, lockbit5, medusalocker and emperador, showing a broad, multi-sector and multi-actor threat.
MAPFRE Brasil 2026Destello · Financial Services
Solutis Tecnologiasthegentlemen · Technology
SistelAoqin · Technology
Secretaria de Estado de Saúdethegentlemen · Government & Defense
Coemi Imóveisthegentlemen · Retail & E-Commerce
centratamagroup.comlockbit5 · Other
Interativa Plasticos (Interplast)medusalocker · Manufacturing
Punta Shoppingemperador · Retail & E-Commerce
Today’s recommendation: Prioritize patching or mitigating SonicOS (CVE-2026-19868) and review SSLVPN logins for anomalies, and immediately update or remove the exposed WordPress plugins listed, especially WP Libre Form and Elementor. Review exposure of wanderer instances and Entra Device Registration, and reinforce monitoring of administrative accounts.
With exploitation happening in hours and across so many different technologies, the only reliable way to know whether you are affected is to regularly test and validate your own attack surface.New vulnerabilities surface every day — does your defense keep up? Get a free initial review of your attack surface.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →