Patch this week: November 9, 2026
4 known exploited vulnerabilities, the flaws exploited in the wild and the end-of-life deadlines we covered this week, one line each.
What we covered on the Stackurity blog in the seven days to November 9, 2026: known exploited vulnerabilities, other flaws exploited in the wild and end-of-life deadlines. One line each, with a link to the full write-up and the fix.
Added to CISA KEV: patch these first
- SonicWall SSLVPN flaw CVE-2026-19868 can bypass SAML and MFA. CVE-2026-19868 added to the KEV catalog on November 6, 2026.
- AhsayCBS CVE-2026-105133: exploited login bypass, how to fix it. CVE-2026-105133 added to the KEV catalog on October 14, 2026.
- Apple flaw CVE-2024-27834 is now on CISA's exploited list. CVE-2024-27834 added to the KEV catalog on November 4, 2026.
- WordPress CVE-2026-119977: exploited upgrade race condition, how to mitigate. CVE-2026-119977 added to the KEV catalog on November 3, 2026.
Exploited in the wild
End of life: plan the upgrade
- Windows Server 2022 end of life: dates and what to upgrade to.
- Is .NET 9 still supported? The November 10, 2026 deadline.
- Windows Server 2019 end of life: dates and what to upgrade to.
- .NET 8 end of life: November 10, 2026 and what to do.
Every post on the blog: stackurity.ai/blog. To see which of these affect your own servers and code, try Stackurity.
