CVE-2026-19868

CVE: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability: SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
CWE: CWE-308
Published: SonicWall | SonicOS SSLVPN
Link: https://www.cve.org/CVERecord?id=CVE-2026-19868

Threat Analysis (SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability: SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).)

  1. Impact: Bypassing SAML authentication and any SAML‑enforced MFA can allow an attacker to gain full access to the SonicWall SSLVPN, compromising Confidentiality (viewing/stealing data), Integrity (modifying protected resources), and Availability (potentially disrupting VPN services).

  2. Affected Components & Attack Surface: The vulnerability resides in the SonicWall SonicOS SSLVPN software (any vulnerable version). The attack surface is remote via the SAML‑based Single‑Factor Authentication (SFA) endpoint; local access does not change the risk.

  3. Exploitation Prerequisites: A user with a valid single‑factor credential (e.g., username/password) that is not protected by MFA must be able to use the alternate authentication method to log in. No additional privileges beyond normal user access are required.

  4. Detection Ideas & Indicators: Look for SAML token bypass logs, missing MFA enrollment events, or repeated failed SAML login attempts. MITRE ATT&CK: T1078 (Valid Accounts) and T1100 (Impair Defenses: Disable Security Controls). Indicators: sudden drop in MFA challenge events, successful login without MFA token.

  5. Mitigations & Workarounds: Deploy the latest SonicWall SonicOS SSLVPN patch, enforce mandatory MFA for all SAML‑protected sessions, and disable the single‑factor fallback in the SonicWall UI.

  6. Verification Steps: Using a test account, attempt SSO login while omitting MFA; confirm the VPN session is established without an MFA token. Validate that the latest patch version removes the SFA bypass logic.

  7. Attack-Path Sequence:

sequenceDiagram
    Attacker->>SonicWall SSLVPN: Send single‑factor credentials
    SonicWall SSLVPN->>SonicWall SSLVPN: Bypass SAML authentication (CVE-2026-19868)
    SonicWall SSLVPN->>Attacker: Grant VPN access
    Attacker->>Attacker: Perform actions (data exfiltration, etc.)

CVE-2024-27834

CVE: Apple Multiple Products Improper Authentication Vulnerability: Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.
CWE: CWE-287
Published: Apple | Multiple Products
Link: https://www.cve.org/CVERecord?id=CVE-2024-27834

Threat Analysis (Apple Multiple Products Improper Authentication Vulnerability: Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.)

  1. Impact: The vulnerability permits an attacker with read/write access to the device’s file system to bypass pointer authentication, enabling arbitrary read/write operations on protected resources. This compromises Confidentiality (exposure of sensitive data), Integrity (potential data tampering), and Availability (possible service disruption if the attacker blocks legitimate processes).

  2. Affected Components & Attack Surface: Vulnerable to all Apple products running iOS, iPadOS, macOS, Safari, tvOS, and watchOS 10.5. The attack surface is the pointer authentication service exposed through Safari’s internal file‑system access and other Apple‑provided APIs. Access is remote via a crafted HTTP/HTTPS request.

  3. Exploitation Prerequisites: Requires an attacker who can already read/write to the target’s file system (e.g., via a compromised user account or local exploit). No additional network‑level privileges are needed; the vulnerability is triggered by a malicious request that exploits the improper authentication check.

  4. Detection Ideas & Indicators: Look for anomalous Safari logs (e.g., SafariLog entries showing failed pointer‑auth checks), spikes in /var/log/Safari.log, or ATT&CK T1071.001 (Exfiltration Over Web Services) using unusual payloads. Also monitor for unexpected file‑system changes (CWE‑287).

  5. Mitigations & Workarounds: Apple released a patch in version 10.6+ for all affected platforms. Until the update, disable Safari’s file‑system access or enforce strict sandboxing policies.

  6. Verification Steps: On a vulnerable device, send a crafted request to https://<target>/path?auth=1 and verify that a hidden file is created or its contents altered, confirming bypass. On a patched device, the same request should be rejected with an authentication error.

  7. Attack‑Path Sequence

    sequenceDiagram
 Attacker->>Safari: Crafted request exploiting pointer auth bypass
 Safari->>FileSystem: Bypass auth check, read/write file
 FileSystem->>User: Modify file (integrity breach)
 User->>Attacker: Return modified data
 Attacker->>Target: Exfiltrate data (confidentiality loss)

CVE-2026-119977

CVE: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability: WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
CWE: CWE-367
Published: WordPress | WordPress Core
Link: https://www.cve.org/CVERecord?id=CVE-2026-119977

Threat Analysis (WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability: WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.)

  1. Impact: A TOCTOU race in the upgrade path can allow an unauthenticated attacker to replace core files during WordPress installation/upgrade, leading to code execution (Integrity breach), data exposure (Confidentiality), and potential service disruption (Availability).

  2. Affected Components & Attack Surface: WordPress core upgrade process, specifically the web‑exposed staging directories that serve upgrade packages; remote access only, no local privilege needed.

  3. Exploitation Prerequisites: Attacker must be able to trigger a full‑package upgrade (e.g., via WP‑CLI or browser) and cause a race condition where the attacker’s file replacement occurs before the upgrade completes; no authentication required.

  4. Detection Ideas & Indicators: Logs for wp_upgrade command or browser upgrade events, sudden creation of new core files with recent timestamps, missing upgrade logs, ATT&CK T1195 (Exploit Public‑Facing Application).

  5. Mitigations & Workarounds: Deploy the official patch (upgrade to affected WordPress version), disable or restrict access to staging paths, use signed upgrade packages, and avoid upgrading while the server is exposed.

  6. Verification Steps: Perform an upgrade on a test server, monitor file creation timestamps and logs; attempt to replace a core file during the race and confirm unauthorized execution.

  7. Attack-Path Sequence:

sequenceDiagram
    Attacker->>Web Server: Trigger upgrade (no auth)
    Web Server->>Staging Path: Serve upgrade package
    Attacker->>Staging Path: Replace core file (race)
    Staging Path->>Web Server: Upload complete
    Web Server->>Core: Apply new file (race window)
    Attacker->>Core: Execute replacement code

CVE-2026-111357

CVE: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability: Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.
CWE: CWE-306|
Published: Ivanti | Connect Secure
Link: https://www.cve.org/CVERecord?id=CVE-2026-111357

Threat Analysis (Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability: Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.)

  1. Impact: Allows a local authenticated attacker to bypass authentication on a critical function, potentially gaining elevated privileges, exfiltrating sensitive data (confidentiality breach), tampering with system configurations (integrity breach), and disrupting the service (availability impact).

  2. Affected Components & Attack Surface: The vulnerable function resides in Ivanti Connect Secure (specific endpoint, e.g., /admin/critical‑action). Exposure is limited to the local network; remote exploitation is not feasible.

  3. Exploitation Prerequisites: An authenticated local user must have network access to the endpoint and the capability to invoke the critical function; no additional tools or elevated system rights are required.

  4. Detection Ideas & Indicators: Look for anomalous API calls to the critical endpoint in web/access logs, ATT&CK T1059.004 (Process Injection), or unexpected privilege‑escalation events in security alerts.

  5. Mitigations & Workarounds: Deploy the official Ivanti patch (CVE‑2026‑111357 fix), disable the critical function if not needed, enforce MFA, and segment the function’s network zone.

  6. Verification Steps: From a local authenticated session, send a request to the vulnerable endpoint; a successful bypass will return an elevated‑privilege response. Confirm patch version (e.g., Connect Secure 2026.XX) is applied.

  7. Attack‑Path Sequence:

    sequenceDiagram
 participant User as Local Authenticated User
 participant App as Ivanti Connect Secure
 User->>App: Call critical function
 App->>App: Skip auth check
 App->>User: Return elevated response
 User->>User: Privilege escalation

CVE-2026-118527

CVE: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability: Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
CWE: CWE-340
Published: Ivanti | Connect Secure
Link: https://www.cve.org/CVERecord?id=CVE-2026-118527

Threat Analysis (Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability: Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.)

  1. Impact: Confidentiality is compromised as attacker‑controlled content can be read or exfiltrated; integrity is broken if uploaded files alter system state; availability may be degraded if upload triggers server errors or crashes.

  2. Affected Components & Attack Surface: Ivanti Connect Secure software (web UI/API), remote authenticated access to the upload endpoint, known file location (e.g., /uploads). Exposure vector: Remote authenticated.

  3. Exploitation Prerequisites: Must be authenticated remotely; attacker knows the upload URL; can send a crafted request with any payload; no extra privileges beyond normal user.

  4. Detection Ideas & Indicators: Log entries for upload events to /uploads, IDS alerts on POST/large‑file uploads to that path, ATT&CK T1059.001 (Exfiltration Over Alternative Protocol), presence of predictable identifiers in file names.

  5. Mitigations & Workarounds: Apply official patch CVE‑2026‑118527; restrict or disable remote uploads; enforce strict input validation; use signed/non‑predictable identifiers; block writes to /uploads.

  6. Verification Steps: From an external host, send a POST to /uploads with a predictable ID and attached file; confirm the file appears on the server. Alternatively, run a script that generates a known ID and attempts upload.

  7. Attack‑Path Sequence:

    sequenceDiagram
 Attacker->>Server: Authenticated POST /uploads (payload)
 Server->>Server: Process upload, write to /uploads
 Server->>Server: Store file with attacker‑controlled content
 Attacker-->>Attacker: File uploaded