Monday's lead undoes a thing we all count on: the second check at sign-in, the one that makes a stolen password not enough. SonicWall says attackers are using a flaw in its VPN login to get past exactly that, and the federal deadline to fix it is November 20. Further down: Microsoft's quiet Friday fixes for its oldest supported Windows, an Exchange problem on day twenty-seven, and a new OpenSSH hole the internet spent the weekend probing. Here is the longer version of today's five, with the build numbers and links that do not fit in three minutes.
SonicWall SSL VPN: the second check can be skipped
CVE-2026-19868 is a flaw in the SSL VPN service of SonicWall's SonicOS firewalls, and it applies when sign-in runs through SAML, the single sign-on plumbing many companies use. The effect: a user holding valid credentials for another login method can bypass SAML controls, including SAML-enforced multi-factor authentication. BleepingComputer reports that SonicWall has patched the flaw, warns it is exploited in attacks, and that CISA added it to the Known Exploited Vulnerabilities catalog on November 6 with a November 20 remediation deadline for federal agencies. Affected are generation seven firewalls on SonicOS 7.3.3-7015 and earlier and generation eight on 8.2.2-8015 and earlier; the fixed builds are 7.3.4-7013 and 8.2.3-8015. SonicWall says there is no workaround, which makes the firmware update the whole answer. If your firewall runs SSL VPN with SAML enabled, this is today's job, not this week's.
Two out-of-band fixes for Windows Server 2012 and Windows 8.1
Microsoft released out-of-band updates on Friday, November 6: KB5135580 for Windows Server 2012 and KB5135582 for Windows 8.1. They are brand-new non-security updates, newer than our own feed, so we have no pages for them yet; Microsoft's release notes are at KB5135580 and KB5135582. They resolve two known issues listed on the October 13 Monthly Rollups, KB5126835 and KB5126836. First, Multipath I/O-managed iSCSI disks that, in Microsoft's words, "may unexpectedly go offline or display error C0000010 in the details tab of device manager"; the same note says the issue "does not result in data loss or change". Second, the remainder of the USB Audio Class 1.0 problem from the September 8 updates, where devices fail with "This device cannot start (Code 10)" or produce no sound. One oddity to save you a double-take: Microsoft's known-issue text dates the out-of-band release "November 6, 2016". The year is a typo on Microsoft's page; the update is from 2026.
Exchange: Outlook on the web sign-in, day twenty-seven
Since the October 13 Windows Server updates, Microsoft says: "Users might be unable to sign in to OWA or send emails on Exchange Server". Windows release health still lists it as Mitigated, a workaround but no fix, across Windows Server 2016 through 2025, unchanged since October 16. Tomorrow is Patch Tuesday, the next natural window for a real fix. If it comes, it lands best on servers whose workaround state you already know, so list which of yours carry it today.
The install watch: quiet until tomorrow
No new "this update fails to install" issues from Microsoft; the newest known-issue changes are the November 6 out-of-band resolutions above. Patch Tuesday is tomorrow, November 10. Today is the day to confirm October's updates actually finished installing, so anything that fails this week is clearly November's problem and not last month's leftovers.
OpenSSH: the weekend's most probed new hole
The SANS Internet Storm Center's honeypots logged scans for CVE-2026-123158, a password-authentication bypass in OpenSSH, rising from 23 hits on November 1 to 713 on November 6 before easing off; the first logged exploit attempt came November 5. The Storm Center diary has the day-by-day table. The bug affects OpenSSH built without PAM on musl-based Linux, which in practice means Alpine and the containers built on it, and only with password authentication enabled. OpenSSH 10.6p2 fixes it. Key-based login was already the right answer for anything reachable from the internet, and this is one more reason.
If you do three things this week
- Confirm every SonicWall firewall is on SonicOS 7.3.4-7013 or 8.2.3-8015, starting with any that run SSL VPN with SAML enabled.
- Pull KB5135580 and KB5135582 forward on Windows Server 2012 and Windows 8.1 machines, and confirm October's updates finished installing everywhere before tomorrow's Patch Tuesday.
- Find where OpenSSH still accepts passwords, Alpine-based containers first, and move them to key-based login or OpenSSH 10.6p2.
Clay in the Morning is Senserva's weekday patch and security show; this is its written companion. The sources behind our trackers, and their terms, are on our Data sources & thanks page.