Skip to content
Saturday, November 7, 2026Nov 7, 2026
Previous issue

Vol. 1, No. 49Composed Nov 7 · 12:52 UTC

SitRep

Cybersecurity, in perspective.

3 elevated3 stories on the wire

Scale without attention amplifies single points of failure.
— Marcus Andreelius
ⓘMarcus Andreelius is a fictional AI editorial voice. This reflection is original editorial prose, not a quotation.

You are reading a previous issue. Go to the latest edition →

The situation

SonicWall Patches Flaw That Weakens VPN Logins

SonicWall patched a VPN login flaw; federal entities have until Nov 20 to remediate. Reports also cover a Windows driver flaw and ARTEX activity.

3 sources

SecurityWeek, Cisco Talos Vulnerability Reports, Microsoft Secure

SecurityWeek reports SonicWall patched CVE-2026-19868, a SonicOS flaw that may bypass SAML authentication and MFA in the SSL VPN component. It affects certain SonicOS versions on Gen7 TZ, NSa, NSsp and NSv devices; it was rated CVSS 7.1 and added to CISA KEV, with federal entities directed to remediate by Nov 20. Patches 7.3.4-7013 and 8.2.3-8015 are available; no workaround is provided.

Context

Separately, Talos reports a type confusion vulnerability in the Windows Cloud Files mini filter driver that can potentially crash the kernel and enable a write primitive. Microsoft Secure reports that Storm-3358 targeted financial organizations in Southeast Asia using ARTEX in October 2026.

“Separately, SecurityWeek reports that CVE-2026-19868 may bypass SAML authentication and MFA in SonicWall's SSL VPN component.”
From Senecowitz · Analysis
The move

2 things to do today

Epictim Draper

  1. For affected SonicWall devices, apply patch 7.3.4-7013 or 8.2.3-8015; federal entities are directed to remediate by Nov 20.
  2. Use honeypots and AI-assisted detection across Defender, Entra, and Purview.

On the wire

  • 0critical
  • 3elevated
  • 0moderate
  • 0low
P1Patch

SonicWall Patches Flaw That Weakens VPN Logins

SonicOS CVE-2026-19868 · CVSS 7.1 · Federal remediation deadline: Nov 20 · Patches 7.3.4-7013 and 8.2.3-8015

SonicWall patched CVE-2026-19868, a SonicOS flaw that may bypass SAML authentication and MFA in the SSL VPN component.1 The vulnerability affects certain SonicOS versions on Gen7 TZ, NSa, NSsp and NSv devices and was added to CISA KEV, with federal entities directed to remediate by Nov 20.1

Updated Since Nov 6: CISA Lists SonicWall Vulnerability as Exploited · CVE-2026-19868 · New: securityweek.com, bleepingcomputer.com, helpnetsecurity.com

Timeline

  1. Oct 9SonicWall SMA1000 CVE-2026-102255 Is Being Exploited
  2. Oct 12SonicWall SMA1000 CVE-2026-102255 Actively Exploited Days After Disclosure
  3. Nov 6CISA Lists SonicWall Vulnerability as Exploited
  4. This edition

Added to CISA KEV on 6 Nov 2026 (CVE-2026-19868) · CVE-2026-19868: CVSS 7.5, EPSS <0.01 (FIRST); CVE-2026-102255: EPSS <0.01 (FIRST)

  1. 1SECURITYWEEK · SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins

Copy link to “SonicWall Patches Flaw That Weakens VPN Logins”

P1Exploit

Talos Reports Windows Cloud Files Type Confusion

Windows Cloud Files CVE-2026-80093 · CVSS 8.8 · Potential kernel crash and write primitive

Talos reports a type confusion vulnerability in the Windows Cloud Files mini filter driver (cldflt.sys), affecting versions 10.0.26100.8457 and 10.0.26100.8655.1 A crafted sequence of Cloud Filter API calls can potentially crash the kernel and enable a write primitive; the exploit involves CfAbortOperation and hydration race conditions.1

Updated Since Nov 6: Windows Cloud Files Driver Has Use-after-free · New: helpnetsecurity.com, bleepingcomputer.com

Timeline

  1. Weekend, Oct 31Talos Publishes Windows Cloud Files Driver Flaw
  2. Nov 6Windows Cloud Files Driver Has Use-after-free
  3. This edition

Single sourceCisco Talos Vulnerability Reports

CVE-2026-80093: EPSS <0.01 (FIRST)

  1. 1CISCO TALOS VULNERABILITY REPORTS · Microsoft Windows Cloud Files Type Confusion Flaw (CVE-2026-80093)

Copy link to “Talos Reports Windows Cloud Files Type Confusion”

P1Intelligence

STORM-3358 Targets Southeast Asian Financial Firms

October 2026 · ARTEX · RATs: WISP, vshell and AdaptixC2

Microsoft Secure reports that Storm-3358 targeted financial organizations in Southeast Asia in October 2026 using ARTEX tooling to scan internet-facing applications, exploit flaws and upload RATs.1 The reported activity included exfiltration via compromised cloud identities.1

Single sourceMicrosoft Secure

  1. 1MICROSOFT SECURE · ARTEX Abuse Expands as Financial Sector Targeted

Copy link to “STORM-3358 Targets Southeast Asian Financial Firms”

The wire, last 30 days

This edition has 3 stories rated critical or elevated (P0 or P1); the 23 daily editions from 9 Oct to 6 Nov averaged 3.5. 6 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
7 Nov (this edition)0300
6 Nov1310
5 Nov0320
4 Nov2200
3 Nov0310
2 Nov0211
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200
9 Oct1310

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Also reported

End of the Saturday, November 7, 2026 edition.

Colophon

SitRep · Vol. 1, No. 49

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.