Verified status as of November 7, 2026
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-19868 in SonicWall SonicOS SSLVPN is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-11-06; federal remediation due 2026-11-20). NVD rates it 7.5 (HIGH) on CVSS v3.1.
- CVE-2026-123158 in OpenSSH: the source articles reported no exploitation. NVD rates it 8.1 (HIGH) on CVSS v3.1.
- CVE-2026-83844 in Microsoft Paint: the source articles reported no exploitation. NVD rates it 8.1 (HIGH) on CVSS v3.1.
- CVE-2026-102255 in SonicWall SonicOS: the source articles reported no exploitation. NVD rates it 10 (CRITICAL) on CVSS v3.1.
TL;DR
OpenSSH CVE-2026-123158 is [exploitation unverified] for root access within hours of disclosure. WordPress sites remain vulnerable to attack during the patching process itself due to unpacking flaw. SonicWall CVE-2026-19868 MFA bypass is now in CISA's Known Exploited Vulnerabilities catalog. Patch immediately and monitor access logs.
Executive Summary
- OpenSSH CVE-2026-123158 (SSHole) is under [exploitation unverified] by threat actors attempting to gain root access to Linux systems; the vulnerability enables sign-in to accounts with no password set.
- WordPress sites installing patches for an actively exploited flaw remain vulnerable during the update process because the installation unpacks files using the old, unpatched code.
- SonicWall SonicOS SSL-VPN MFA bypass (CVE-2026-19868) has been added to CISA's Known Exploited Vulnerabilities catalog with active exploitation confirmed; federal remediation deadline is November 20.
- Microsoft Paint RCE fix (CVE-2026-83844) is available only via Microsoft Store; it will not be delivered through standard Windows updates.
Top Threats Today
1. OpenSSH CVE-2026-123158 (SSHole) [exploitation unverified] for Root Access
Severity: HIGH Affected: Technology
Threat actors are actively attempting to exploit OpenSSH CVE-2026-123158, a password-bypass vulnerability codenamed SSHole (or *sshole) that affects Linux systems [1]. The flaw allows sign-ins to accounts that have no password set, and exploitation has been observed within hours of public disclosure [1]. The vulnerability has a CVSS score of 8.1 [1].
Sources:[1] The Hacker News
Recommended Action
- Prioritize OpenSSH patching across all Linux infrastructure; check version and apply latest security update immediately
- Review authentication logs for failed SSH login attempts using empty/null passwords, particularly targeting privileged accounts
- Enforce SSH key-based authentication and disable password-based authentication where feasible
- Monitor for unauthorized root access and privilege escalation events
2. WordPress Patch Installation Vulnerability Window
Severity: HIGH Affected: Technology
Some WordPress sites can still be attacked while installing a fix for an actively exploited vulnerability, according to security researcher Umut Bayram of Picus Security [1]. The update process itself unpacks its files using the site's old, unpatched code, creating a window of vulnerability during the installation phase [1]. This means organizations are exposed to attack at the moment they attempt to remediate.
Sources:[1] The Hacker News
Recommended Action
- Schedule WordPress updates during maintenance windows with heightened monitoring; do not deploy to production without preparation
- Implement Web Application Firewall (WAF) rules to block exploitation attempts during patching
- Consider taking affected WordPress sites offline or into read-only mode during the update process if operationally feasible
- Monitor server and WordPress logs closely during and immediately after patching for signs of exploitation
3. SonicWall SSL-VPN MFA Bypass Added to CISA KEV Catalog
Severity: HIGH Affected: Technology
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including CVE-2026-19868, an SSL-VPN authentication bypass flaw that is actively being exploited in attacks [1]. The vulnerability allows a user with valid credentials for an alternate authentication method to bypass SAML authentication controls and multi-factor authentication (MFA) enforcement [2]. CISA added this CVE to its Known Exploited Vulnerabilities catalog on November 6, 2026, with a federal remediation deadline of November 20 [2].
Sources:[1] BleepingComputer[2] CISA KEV
Recommended Action
- Apply SonicWall SonicOS security updates immediately to all affected appliances
- Review VPN authentication logs for anomalous SAML bypass attempts or unexpected authentication method switching
- Re-enforce MFA policies and verify MFA is functioning correctly on all SSL-VPN access points post-update
- Monitor for unauthorized VPN connections and lateral movement within networks from external access points
4. Microsoft Paint RCE Patch Available via Microsoft Store Only
Severity: MEDIUM Affected: Technology
A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now available in the Microsoft Store [1]. The fixed Paint build is 11.2609.401.0 [1]. However, this fix will only be delivered through the Microsoft Store, not through standard Windows Updates [1], which may delay or prevent patching in environments that do not use the Store or restrict Store access.
Sources:[1] The Hacker News
Recommended Action
- If Paint is used in your environment, update via Microsoft Store or equivalent managed deployment if available
- Monitor for unauthorized Paint usage or suspicious file-opening behavior on user workstations
- Consider disabling Paint via Group Policy or AppLocker if not operationally required
5. AI Vulnerability Discovery Scale: GPT-6 Cyber Identifies Hundreds of Flaws
Severity: MEDIUM Affected: Technology
OpenAI has unveiled GPT-6 Cyber, a new AI model designed for security research that has discovered 81 previously unknown high-severity Firefox vulnerabilities and developed working exploits for 948 distinct Linux kernel flaws [1][2]. The model is described as more capable at finding and fixing vulnerabilities than its predecessor ⚠[1]. While this demonstrates the potential for AI-assisted security research, it also indicates the scale and velocity at which new exploitable flaws can be identified.
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Prepare for accelerated vulnerability disclosure cycles; subscribe to vulnerability feeds for critical products (Firefox, Linux kernel)
- Implement automated patch management and continuous vulnerability scanning
- Increase frequency of security assessments and penetration testing to identify flaws before AI-driven discovery can weaponize them
Today’s Action Checklist
- ☐ URGENT: Patch OpenSSH across all Linux systems; check logs for CVE-2026-123158 [exploitation unverified]
- ☐ URGENT: Apply SonicWall SonicOS security updates by November 20 deadline; review VPN authentication logs
- ☐ HIGH: If running affected WordPress versions, schedule patching during monitored maintenance window with WAF protection active
- ☐ MEDIUM: Update Windows Paint via Microsoft Store if deployed; consider disabling if not required
- ☐ MEDIUM: Review security research vulnerability feeds for Firefox and Linux kernel emerging disclosures