Exploited vulnerabilities: Week 45, 2026

Analyst notes

CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog between 2026-11-02 and 2026-11-08.

WordPress Core (CVE-2026-119977, added 2026-11-03) is the most urgent for most organisations: a race condition in the core updater allows unauthenticated code execution during a full core upgrade. It is fixed in 7.1.4, and the federal deadline of 2026-11-06 was only three days after listing. Sites that were not on 7.1.4 before 2026-10-30 should be checked for new admin accounts and unknown plugins. Detection guidance: /cve/cve-2026-119977/

Apple Multiple Products (CVE-2024-27834, added 2026-11-04, due 2026-11-18) is a 2024 vulnerability that CISA classifies as improper authentication. A listing two years after disclosure means CISA has seen exploitation evidence recently; the exposure is devices that are not kept on current OS releases.

SonicWall SonicOS SSLVPN (CVE-2026-19868, added 2026-11-06, due 2026-11-20) lets a user with valid credentials for an alternate authentication method bypass SAML and SAML-enforced MFA on SSLVPN. Patch to 7.3.4-7013 or 8.2.3-8015 and correlate VPN logins with IdP sign-ins. Dossier: /cve/cve-2026-19868/

Still active this week: PHP2Shell (/campaign/php2shell/), Node2Shell (/cve/cve-2026-111497/), the Ivanti Connect Secure chain (/campaign/ivanti-connect-secure-chain/), GitLab (/cve/cve-2026-97229/) and Adobe Commerce PolyShell (/cve/cve-2026-48356/).