[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

official (CISA KEV catalog 2026.11.06, added Nov 6, due Nov 20; SonicWall CNA CVE record / SNWLID-2026-0014); CISA ADP marks Exploitation: active; ransomware use Unknown

CISA KEV: SonicWall SonicOS SSLVPN CVE-2026-19868 — valid alternate-method credentials can bypass SAML and SAML-enforced MFA

  • Who cares: any org running SonicWall Gen7/Gen8 SSLVPN with SAML (and especially SAML-tied MFA) in the named build ranges.
  • Do now: inventory SSLVPN firmware; open SNWLID-2026-0014 and install the vendor-stated fix; review recent SSLVPN logins for unexpected local/LDAP/RADIUS successes that should have been SAML-only; rotate credentials for accounts that can hit the VPN.
  • Note: this still needs valid credentials for some auth method — it is not a no-auth RCE — but it defeats SAML/MFA policy that many teams treat as the hard gate.
  • SSHole (CVE-2026-123158) is still not in KEV as of this catalog refresh.

Sources: CISA Known Exploited Vulnerabilities Catalog (CVE-2026-19868, added Nov 6) · CISA KEV JSON feed (catalogVersion 2026.11.06) · SonicWall PSIRT: SNWLID-2026-0014 · CVE Program: CVE-2026-19868 (SonicWall CNA)