Today's briefing covers a new active-exploitation alert and two government publications from the past few days. Sources are dated November 5-6; these are not all announcements made today.
SonicWall: An alternative login method can bypass SAML protection
On November 6, CISA added CVE-2026-19868, affecting SonicWall SonicOS SSLVPN, to its Known Exploited Vulnerabilities catalog. Inclusion is based on evidence of active exploitation.
According to BleepingComputer's review of SonicWall's advisory, an attacker with valid credentials for an alternative authentication method can bypass SAML authentication controls, potentially including SAML-enforced MFA. The flaw concerns SSL-VPN services configured to use SAML. It is not a general ability to sign in without credentials.
SonicWall has released fixes. For affected installations, patching should be accompanied by a review of login events and alternative authentication paths. Having an MFA flow configured does not establish that every access path requires MFA. CISA also notes that its binding directive applies to US federal civilian executive branch agencies; other organizations are encouraged to prioritize known exploited vulnerabilities.
Sources: CISA alert, November 6 · BleepingComputer's technical report, November 6
Refrigeration: Remote access can have physical consequences
On November 5, CISA, the FBI and other US government partners warned about malicious activity targeting industrial refrigeration and cold-chain monitoring systems worldwide.
The warning describes how attackers can exploit vulnerabilities and weak configurations in temperature and refrigeration controllers to alter settings, including forcing continuous heating or defrost cycles. Potential consequences include inventory loss, unsafe temperatures and loss of visibility into current temperatures. These are described risks, not evidence that every consequence has occurred in a specific incident.
The agencies recommend removing direct internet exposure, securing necessary remote access, separating operational technology from business networks and updating firmware. They also highlight safe setpoint limits and alerts for deviations. Where equipment lacks usable logs, they recommend collecting network traffic between assets.
Source: Joint government warning on industrial refrigeration, November 5
Post-quantum cryptography: Ask vendors for a concrete migration plan
On November 5, CISA published joint guidance with Australia's ASD's ACSC and the US NSA on questions to ask vendors about post-quantum cryptography, or PQC, readiness.
The focus is vendor dependencies: cloud services, managed services and products with embedded cryptography. Long-lived equipment may require vendor support or replacement before its cryptography can be changed.
The guidance helps organizations assess whether vendors understand the risks, provide transparency about cryptographic implementations and support a secure, timely transition. A practical starting point for procurement and renewals is to request documentation of cryptographic dependencies, update capabilities and migration plans rather than accept a vague "quantum-ready" claim. This is planning guidance, not an announcement that quantum computers have already broken widely used public-key cryptography.
Source: CISA: Post-Quantum Questions to Ask Your Vendors, November 5