U.S. CISA adds SonicWall SonicOS SSLVPN vulnerability CVE-2026-19868 to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a SonicWall SonicOS SSLVPN flaw, tracked as CVE-2026-19868 (CVSS score of 7.5), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-19868 is an authentication bypass vulnerability affecting the SSL VPN service in SonicWall SonicOS.

“An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).” reads the advisory.

The flaw occurs when the system does not properly enforce SAML authentication controls. An attacker who already has valid credentials for an alternative authentication method may exploit this weakness to bypass SAML-based authentication.

The impact is particularly serious when organisations rely on SAML to enforce multi-factor authentication (MFA). Successful exploitation may allow an attacker to access the SSL VPN without completing the expected SAML authentication process, potentially bypassing the additional MFA protection.

In practical terms, the vulnerability could weaken an organisation’s remote access security by allowing users with alternative valid credentials to circumvent its intended authentication controls.

It’s important to highlight that this is not an unauthenticated remote access vulnerability. The attacker needs valid credentials for an alternative authentication method, but may then bypass SAML-enforced security controls.

SonicWall’s PSIRT team is investigating a report of possible exploitation of this flaw. The company strongly recommends that customers install the latest available update as soon as possible to reduce the risk of attacks.

“SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks.” reads the advisory.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by November 20, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Ivanti VPN zero-days let attackers gain root access, steal credentials, evade detection, and prepare for wider network compromise.

On October 5, Volexity started investigating suspicious activity at one of its monitoring customers and traced everything back to an Ivanti Connect Secure VPN appliance running version 22.8R2.4, the latest build available at the time. Three chained zero-days gave an unknown attacker unauthenticated root access.

“n the first week of October 2026, Volexity discovered an unknown threat actor, UTA0576, abusing a zero-day exploit chain to compromise a fully patched (at the time, version 22.8R2.4) Ivanti Connect Secure (ICS) VPN appliance.” states Volexity. “This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution. The RCE and authentication bypass vulnerabilities are tracked under CVE-2026-104935.”

The attacker, tracked as UTA0576, had been inside the device since at least October 3, two days before anyone noticed. Ivanti released a patch for two of the three vulnerabilities on October 13; the privilege escalation fix is still coming in a future release.

The first flaw affects welcome.cgi, the public login page. An attacker sends a request to this page that passes the authentication checks but includes the path to a protected internal script in an HTTP header. The system checks the URL to decide whether to allow the request, but uses the header to decide where to send it. This mismatch allows the attacker to bypass authentication.

The attacker then uploads a Perl script disguised as a ZIP file through another endpoint. The server saves the file, checks whether it is a valid ZIP archive, and schedules it for deletion when the check fails. Before the file is deleted, the attacker sends multiple requests to its predictable location on disk. If a request reaches the file in time, the script executes. Both the authentication bypass and the race-condition flaw that enables remote code execution are tracked under CVE-2026-104935.

The third step escalates from the limited web server user to full root. A privileged background service called dsinvoked runs maintenance tasks as root and looks up which programs to execute in a shared configuration store. UTA0576 patches that store in memory, redirects a legitimate task to the Perl interpreter instead, triggers the task, and gets root execution. Then everything gets silently restored to its original state.

Volexity found that the attack changed code in memory but restored the configuration data, which explains why Ivanti’s Integrity Checker Tool did not detect anything suspicious. The tool checks files stored on disk, but this attack left no permanent changes there.

Each time UTA0576 ran a command, the attackers repeated the entire exploit chain. They received the results through normal HTTPS responses instead of using a persistent backdoor or web shell. They also deleted selected entries from Ivanti debug logs and Linux audit logs covering the attack. Temporary files were removed automatically after use. The attackers hid a packet capture tool under a renamed executable in a directory not shown in normal file listings. They also used eight rotating capture files, allowing older network traffic to be overwritten.

Once inside, UTA0576 went straight for credentials. The attacker deployed a custom Python LDAP tool that authenticated to an internal domain controller using the VPN appliance’s own service account and searched Active Directory specifically for LAPS local administrator passwords, BitLocker recovery keys, and any attributes containing passwords in plaintext. Results were compressed and encoded before being exfiltrated back through the same exploit channel.

The attacker also ran a packet capture tool to harvest cleartext credentials from LDAP traffic already flowing through the device, built a custom Kerberos implementation capable of Kerberoasting attacks, and ran password-spraying campaigns against Active Directory accounts.

“Volexity’s forensic investigation revealed that, immediately after exploiting an ICS VPN appliance, UTA0576 began conducting reconnaissance, stealing credentials, and exfiltrating data. Because the operation was detected and disrupted, the threat actor’s ultimate objectives could not be determined.” Volexity continues. “However, Volexity assesses with high confidence that UTA0576’s actions signaled preparation for lateral movement and a broader compromise of the victim network.”

Volexity believes with medium confidence that UTA0576 uses large language models (LLMs) to develop exploits and carry out post-exploitation activities.

That’s not a certain finding, but it’s the kind of attribution detail that’s starting to appear more regularly in incident reports, and it fits the pattern of a single operator producing work that would previously have required a team.

“Volexity’s forensic investigation revealed that, immediately after exploiting an ICS VPN appliance, UTA0576 began conducting reconnaissance, stealing credentials, and exfiltrating data.” concludes the report. “Because the operation was detected and disrupted, the threat actor’s ultimate objectives could not be determined.”

The attackers’ motives remain unclear, but the targets suggest a possible criminal motive rather than espionage. Apply the patches immediately, and don’t assume your appliance is safe just because the Integrity Checker found no problems.

This week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Ivanti Connect Secure FortiMail flaw CVE-2026-104935 (CVSS score of 8.6) to its Known Exploited Vulnerabilities (KEV) catalog.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ivanti)

Japan ‘s Digital Agency disclosed a VPN breach exposing 246,000 government employee records across 23 ministries. Detected June 25, publicly disclosed September 11.

Japan ‘s Digital Agency disclosed that attackers exploited a vulnerability in a VPN device to access its Government Solution Service (GSS), potentially leaking personal information belonging to approximately 246,000 government employees, public officials, and contractors. The breach was detected on June 25 and confirmed as a VPN exploitation on July 9, meaning the public disclosure came 78 days after the initial detection and 63 days after the intrusion method was identified.

“It has come to our attention that, due to unauthorized external access, some files containing personal information handled on the Government Solution Service (GSS), operated by the Digital Agency, may have been leaked to an external party.” reads the advisory. “We have confirmed that the personal information that may have been leaked pertains to employees of various ministries and agencies that use GSS (hereinafter referred to as “GSS user organizations”) and those involved in their work, and does not include personal information of the general public.”

GSS connects 23 Japanese ministries and agencies through shared IT infrastructure. A breach of this platform could potentially affect many government organizations at once.

The attack followed a straightforward path. An outsider exploited a vulnerability in a VPN device that serves the GSS network, accessed the system using a maintenance and operations staff member’s account, and browsed a large number of files on the server. The agency detected the unusual activity on June 25, confirmed the VPN exploitation on July 9, then suspended the maintenance account and cut off external communications from the compromised hardware the same day. A subsequent investigation with external security specialists confirmed that files containing personal information may have been exfiltrated.

“On June 25, 2026, we detected that a large number of files on the server had been accessed using the account of a maintenance and operations staff member, and we began an investigation. On July 9, it was discovered that a third party had exploited a vulnerability in the network connection device (VPN) to infiltrate the system and gain unauthorized access. On the same day, we suspended the maintenance and operations staff member’s account and cut off communication between the compromised equipment and the outside world to prevent further unauthorized access.” continues the report.”As a result of our investigation with the cooperation of an external expert company, we have confirmed that there is a possibility that personal information may have been leaked to an external party.”

The potentially exposed data breaks down to roughly 236,000 names, 231,000 email addresses, 94,000 phone numbers, and approximately 1,000 physical addresses. Of the 246,000 total records, about 189,000 belong to employees of GSS-using organizations and public officials involved in their work, including staff at independent administrative agencies. The remaining 57,000 records relate to businesses and individuals contracted to support those organizations. The data doesn’t include My Number identification numbers, financial institution account numbers, or pension numbers.

The VPN flaw was rated medium severity and wasn’t a zero-day. A patch was already available when attackers exploited it, but the agency hasn’t revealed the VPN product or the flaw.

Japan’s privacy regulator was notified on July 15, six days after the attack was confirmed. The Digital Agency said the delay came from the difficulty of tracing the attack, assessing the affected data, and identifying those involved.

The incident also shows the risk of leaving a known, patchable flaw unaddressed on infrastructure shared by 23 ministries.

No confirmed misuse of the exposed data has been reported. However, the leaked names, email addresses and phone numbers could enable targeted phishing and social engineering, including scams impersonating Japan’s Digital Agency. The agency will contact affected people directly and warns that it will never request passwords or payments by email or phone.

The breach is one in a series of significant cybersecurity incidents affecting Japanese institutions. NISC, Japan’s National Cyber Incident Readiness and Strategy Center, disclosed a breach in 2023 that affected its email system. Japan Aerospace Exploration Agency (JAXA) reported unauthorized access to its systems in 2024. The pattern points to systemic challenges in patching and access management across Japan’s public sector infrastructure rather than isolated failures.

The Digital Agency’s planned remediation includes improved vulnerability management and changes to external connection methods, which are the right responses to the immediate incident. Whether they address the underlying governance question is harder to assess from the public advisory alone.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Two critical Check Point VPN flaws score 9.8 and could enable remote code execution. Patch now and restrict VPN access before exploitation begins.

The Dutch NCSC warns that two critical vulnerabilities in Check Point VPN products, both rated CVSS score of 9.8, could soon be actively exploited. If you use Check Point VPN, you should patch it immediately.

CVE‑2026‑85102 resides in the VPN negotiation process and lets an unauthenticated attacker bypass security checks and run their own code on the gateway. CVE‑2026‑85103 is a heap overflow in the certificate ASN.1 decoder that also leads to remote code execution on Security Gateways and Security Management Servers.

Both vulnerabilities can be triggered by external attackers, and while no public proof‑of‑concept has surfaced yet, the NCSC explicitly rates the likelihood of exploitation and the potential damage as high.

“There are 2 critical vulnerabilities in Check Point VPN products with the attributes CVE-2026-85102 and CVE-2026-85103. These are 2 serious vulnerabilities with a CVSS score of 9.8.” reads the alert. “The NCSC assesses the likelihood of exploitation and potential damage as high and expects that attempts at exploitation will occur soon; therefore, the advice is to install the updates as soon as possible.”

An attacker can take over the system, read or change confidential data, and disrupt operations. In practice, that means your VPN appliance stops being a secure entry point and starts being a beachhead inside your network.

Check Point addressed the flaws on September 9 with the release of the advisories sk1000117 and sk1000118. The affected releases span R81.20, R82, R82.10, R81.10.x and R82.00.x, plus end‑of‑support versions from R80 through R81.10. R82.20 is not affected.

For supported versions, Check Point provides fixes through LivePatch Take 24 or specific Jumbo Hotfix updates, depending on the version you use.

If you use LivePatch with R81.20, R82 or R82.10, your system may already be protected without a reboot. However, you should check your setup to make sure. LivePatch does not cover every version or configuration, so don’t assume you are protected.

The NCSC’s advice is straightforward: install the updates as soon as possible. For organizations using Site‑to‑Site VPN, it also recommends tightening the ruleset: disable implied rules and restrict VPN access to specific, trusted IP addresses instead of leaving it wide open. If you’re not sure whether you’re running a vulnerable version, talk to your IT provider now, not after the first IOC shows up in your logs.

“The NCSC advises installing these updates as soon as possible. For organizations using Site-to-Site VPN, it is recommended to adjust certain VPN rules, such as disabling implied rules and restricting VPN access to specific IP addresses.” concludes the alert. “Contact your IT service provider if you are unsure whether you are using a vulnerable version. If necessary, ask for assistance in implementing the recommended measures.”

This isn’t a “schedule a change window next month” situation. It’s a “verify, patch, restrict, and move on before someone else decides your VPN is their new favorite initial access broker” kind of week.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Check Point)