Read the feed, not the recap: three new KEVs and three wrong deadlines

CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog between November 3 and November 6. KEV only lists flaws that are confirmed exploited in the wild, so all three are already being used against real systems.

That was the week's news. The more useful story is in the deadlines. HackerStorm's weekly KEV roundup lists a CISA due date for each entry, and all three are wrong when you compare them with CISA's own feed. The worst one makes an overdue patch look like it still has two weeks left.

Source: CISA KEV JSON feed, catalog version 2026.11.09, checked November 9.

The roundup's dates look like a flat "added + 21 days." CISA no longer works that way. Under BOD 26-04, issued in June, deadlines vary by risk. This week's ran from 3 days (WordPress) to 14 days (SonicWall). Strictly speaking, these deadlines bind US federal agencies, but most security teams use them as a priority signal. That only works if the dates are right.

WordPress Core: the update window is the attack window (CVE-2026-119977)

CISA describes a time-of-check/time-of-use race condition in core upgrades: "predictable, web-accessible staging paths used during full-package core upgrades" let an unauthenticated attacker run code on the server while an update is in progress (CWE-367).

• Fix: WordPress 7.1.4, released October 28 as a security release. Its notes credit Umut Bayram with "a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window."
• Affected: 4.7.0 through 7.1.3, per public records. The fix was also backported to every maintained older branch down to 4.7, so "patched" means 7.1.4 or the latest release on your branch.
• In the wild: Wordfence has been blocking thousands of attempts a day against the staged-installer paths. No confirmed successful compromises had been reported as of November 4 (Tech Insider).
• Deadline: November 6. This is also the only entry this week that CISA marked for forensic triage. In other words, CISA expects organizations to check whether they were compromised, not just to patch.

There's an irony here. The routine you'd normally trust, letting the site update itself, is exactly the moment of exposure. If a site was still on 7.1.3 after October 28, assume someone may have tried this. Look for unexpected PHP files and new admin users, and check web logs for requests to upgrade staging paths during update windows.

Apple: a 2024 bug, newly confirmed exploited (CVE-2024-27834)

This is a WebKit flaw that lets an attacker who already has arbitrary read/write access bypass Pointer Authentication (PAC), the hardware-backed protection that makes memory-corruption exploits harder to finish. It isn't an entry point on its own. It's the link in an exploit chain that turns a browser bug into a working exploit.

• Fix: Apple patched this on May 13, 2024. What's new is CISA's confirmation that it is being exploited, two and a half years later.
• Who it matters for: fleets with devices that never left 2024-era OS versions. Kiosks, shared iPads, old Macs and unmanaged phones are typical examples.

SonicWall SSLVPN: MFA that a second login method can skip (CVE-2026-19868)

According to CISA, a user with valid credentials for an alternate authentication method can get past SAML on SonicOS SSLVPN, and with it any MFA enforced through SAML (CWE-308, use of single-factor authentication).

• Who's exposed: only SSLVPNs with SAML-based login enabled, per SonicWall. Affected builds are Gen7 (TZ, NSa, NSsp, NSv) on SonicOS 7.3.3-7015 or older, and Gen8 (TZ, NSa, NSv) on 8.2.2-8015 or older (SecurityWeek).
• Fix: SonicOS 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8), per advisory SNWLID-2026-0014. SonicWall says there are no workarounds, so patching is the only real fix.
• In the wild: SonicWall has said only that it investigated "a report indicating potential exploitation." CISA's KEV listing confirms it as exploited. Neither has shared attack details.
• Hunt: compare your SAML identity provider's logs with SonicOS SSLVPN session records. A session with no matching SAML/MFA event is your red flag. Removing alternate auth methods you don't need, such as local accounts or LDAP fallback, is good hygiene, but SonicWall doesn't count it as a fix.

This is the most dangerous of the three for most companies. A stolen password for a fallback account turns "we have MFA on the VPN" into a false sense of safety.

All three bugs sit where a system is switching state and briefly trusts more than it should:

• WordPress trusts its own staging files during an upgrade.
• SonicWall trusts a second login path that skips the first one's checks.
• Apple's PAC is supposed to be the last line of defense once memory safety has already failed.

None of them needs an exotic attacker. Two need nothing more than an unpatched host or a leaked password. CISA lists ransomware use as "Unknown" for all three.

A recap is a copy, and copies drift. In this case:

• A team that took its patch calendar from the roundup would have treated an overdue WordPress fix, with a forensic-triage flag, as a task for later in the month.
• All three dates were off by 7 to 18 days, always in the same direction: later. The same roundup also lists the SonicWall bug as CVSS 7.5, while SecurityWeek reports 7.1.

This isn't a dig at HackerStorm. The page itself notes that some values were placeholders "pending analyst validation." But it shows why anything that drives patching should read from the source. The KEV catalog is free, public JSON, updated whenever CISA adds entries, and each entry includes dueDate, knownRansomwareCampaignUse, and now forensicTriage.

Aeon's security-digest skill is built around that idea. It runs on a schedule in your own GitHub repo and:

• Pulls the KEV feed directly and picks up anything added in the last 7 days. Exploited flaws come first, whatever their CVSS score.
• Adds EPSS (an estimate of how likely a flaw is to be exploited soon) for the "likely next" tier.
• Filters GitHub Security Advisories to the stack you track. KEV entries always pass the filter.
• Ends every item with one concrete action, and skips anything it already reported in the last two days.

Because it reads dueDate from CISA rather than from a write-up, a 3-day deadline shows up as a 3-day deadline.

What it doesn't do is patch anything for you or tell you which hosts are exposed. It tells you what to fix and by when. Finding the SonicWall box in the closet is still your asset inventory's job.

• WordPress: confirm every site is on 7.1.4+ or the latest patched release of its branch. For any site that ran 7.1.3 after Oct 28, check for webshells, new admin accounts and odd requests during update windows.
• SonicWall (if SAML login is on): patch to 7.3.4-7013 / 8.2.3-8015 and compare your identity provider's logs with SSLVPN sessions. Deadline: Nov 20.
• Apple: find any device still on a pre-May-2024 OS or Safari build and update or retire it. Deadline: Nov 18.
• Take your deadlines from the KEV feed, not from newsletters, including this one.

Sources: CISA KEV catalog (JSON) · CISA BOD 26-04 · WordPress 7.1.4 release · SonicWall SNWLID-2026-0014 · Wordfence advisory · SecurityWeek on CVE-2026-19868 · Tech Insider on CVE-2026-119977 · HackerStorm weekly KEV update · Picus Security on CVE-2026-119977