# MSP Threat Briefing: November 7, 2026

_November 7, 2026 · LNX Inc._

SonicWall's SSL VPN SAML bypass is exploited, attackers hit the OpenSSH SSHole flaw within hours, and QNAP confirms Plex2Shell NAS breaches.

CISA added one flaw to its exploited list on November 6: a SonicOS SSL VPN bug that can skip SAML login and the MFA tied to it. The OpenSSH bypass from yesterday's briefing now has a CVE and was attacked within hours. Three earlier stories also moved: new advice for updating WordPress safely, confirmed Plex2Shell breaches on QNAP NAS units, and Veeam fixes for the critical Linux TCP flaw.

1. Upgrade SonicWall Gen7 firewalls to SonicOS 7.3.4-7013 and Gen8 to 8.2.3-8015, starting with any that use SAML for SSL VPN. Federal deadline: November 20.
2. Patch OpenSSH on Alpine and other musl-based hosts today, then check logs for password logins on passwordless accounts.
3. Block web access to `wp-content/upgrade/` on every WordPress site still below 7.1.4, then update it.
4. On QNAP NAS units, update Plex Media Server to 1.43.3.10861 or later. Rebuild any unit where an older Plex was reachable from the internet.
5. Run Veeam Updater on Veeam appliances, and install the private fix on Backup & Replication 13.1 for Windows.

## 1. SonicWall SSL VPN flaw can skip SAML and its MFA, and is exploited

CISA [added CVE-2026-19868](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19868) to its exploited catalog on November 6. Federal agencies must fix it by November 20. SonicWall published advisory [SNWLID-2026-0014](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014) the same day.

Per the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-19868), a user with valid credentials for another login method can bypass SAML controls on the SSL VPN. That can also bypass MFA enforced through SAML. Affected are SonicOS Gen7 7.3.3-7015 and older and Gen8 8.2.2-8015 and older. Only SSL VPNs set up for SAML login are exposed.

SonicWall says its PSIRT investigated a report of potential exploitation. Neither SonicWall nor CISA has shared attack details, as [reported by SecurityWeek](https://www.securityweek.com/sonicwall-patches-exploited-sonicos-bug-that-weakens-vpn-logins/). The same advisory fixes six more flaws, none marked exploited. Two, rated 8.8, let an unauthenticated attacker take actions on the management interface under certain conditions.

**Who is exposed.** Clients on Gen7 TZ, NSa, NSsp or NSv firewalls, or Gen8 TZ, NSa or NSv, that send SSL VPN logins through SAML to Entra, Okta or similar. The risk is a stolen local or LDAP password reaching the VPN without the MFA prompt you think is there.

**What to do.**

- Upgrade to SonicOS 7.3.4-7013 on Gen7 or 8.2.3-8015 on Gen8, per [BleepingComputer](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/). SonicWall lists no workaround.
- Review SSL VPN logins since the SAML change went in. Look for sessions that used local or LDAP authentication where SAML should apply.
- Disable or remove local and LDAP VPN accounts that SAML users no longer need. Reset passwords on any that remain.
- Keep the management interface off the internet and off user networks, given the two 8.8 flaws.

## 2. Update: the OpenSSH "SSHole" bypass was attacked within hours

Our [November 6 briefing](/news/msp-threat-briefing-2026-11-06/) covered the OpenSSH password bypass on musl-based Linux without PAM. It now has an ID, [CVE-2026-123158](https://www.cve.org/CVERecord?id=CVE-2026-123158), rated 8.1. The record says that for some account setups, "any password between 256 and 1024 characters succeeds."

Threat intelligence firm Previdian saw the first attempt less than nine hours after the CVE was published, as [reported by The Hacker News](https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html). It confirmed root access on an Alpine Linux honeypot. It logged eight attempts from one IP address, followed by `id`, `uname` and `hostname` reconnaissance. CISA's enrichment of the record lists a public proof of concept. The flaw is not on CISA's exploited list.

**Who is exposed.** Unchanged from yesterday: Alpine servers, containers and cloud images with SSH reachable, and appliances built on musl with OpenSSH added. Glibc distributions, PAM-based setups and Dropbear are not affected.

**What to do.**

- Upgrade to OpenSSH 10.6p2 or your distribution's fixed package, and restart `sshd`. Yesterday's briefing lists the Alpine package versions.
- If you cannot patch, set `PasswordAuthentication no` after confirming key login works.
- Search `/var/log/messages` for "Accepted password for" on `root`, `alpine` or key-only accounts. Review `doas` use, new users, new files and `authorized_keys`.
- Treat any host as compromised if you cannot rule out such a login.

| Indicator | Type |
|---|---|
| `89.116.89[.]18` | Source IP seen by Previdian, as reported by The Hacker News |
| Passwords of 257 to 1,024 bytes | Bypass attempt |

## 3. Update: installing the WordPress fix opens the window one last time

The [November 4 briefing](/news/msp-threat-briefing-2026-11-04/) covered CISA listing [CVE-2026-119977](https://www.cve.org/CVERecord?id=CVE-2026-119977), the WordPress core upgrade flaw. Umut Bayram of Picus Security [published details](https://www.picussecurity.com/resource/blog/cve-2026-119977-when-updating-wordpress-becomes-the-vulnerability) showing why sites still below 7.1.4 face one more risk. The update to 7.1.4 runs through the site's old, unpatched updater code.

So the act of updating creates the same staging window the fix closes. On 5.9 and later, the staging folder name is predictable. Picus's lab measured the window in seconds. Wordfence saw sources polling small groups of sites for about 14.5 hours, which fits waiting for an update, as [reported by The Hacker News](https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html).

**Who is exposed.** Sites from 4.7 through 7.1.3 that have not yet updated: auto-updates off, versions pinned, or updates done by hand. Automatic background updates take the same path. Sites already on 7.1.4 or a fixed branch release are done.

**What to do.**

- Before updating, block web access to `wp-content/upgrade/`. Picus gives these rules:
    - Nginx: `location ^~ /wp-content/upgrade/ { deny all; }`
    - Apache virtual host: a `<Directory>` block for that folder with `Require all denied`
    - `.htaccess` only: `RedirectMatch 403 ^/wp-content/upgrade/` in the WordPress root, above the rewrite rules
- Do not put an `.htaccess` file inside `wp-content/upgrade/`. The old updater deletes that folder's contents first.
- Confirm a request to `/wp-content/upgrade/` returns 403, then update.
- Do not rely on `wp core update` as a safer path. Picus says WP-CLI uses the same updater.
- Sites on 4.6 or older get no fix. Move them to a supported release.

## 4. Update: QNAP confirms Plex2Shell breaches on NAS units

The [October 25 briefing](/news/msp-threat-briefing-2026-10-25/) covered the four exploited Plex Media Server flaws. On November 6, QNAP [published a notice](https://www.qnap.com/en/security-news/2026/qnap-security-notice-plex-media-server-vulnerabilities-plex2shell-update-to-1-43-3-10861-or-later-immediately) saying users have reported compromised Plex servers on its NAS units. QNAP is helping those users.

The flaws are in Plex 1.43.2 and earlier, not in QTS or QuTS hero. QNAP says the fixed 1.43.3.10861 build is in its App Center. Updating does not remove anything an attacker already installed.

**Who is exposed.** Any QNAP NAS that ran Plex 1.43.2 or earlier while reachable from the internet. That includes Plex Remote Access, a forwarded port 32400, or a port opened by UPnP. On a NAS, Plex sits next to the client's file shares.

**What to do.**

- In App Center, update Plex Media Server. Confirm Plex Web shows 1.43.3.10861 or later under Settings > General.
- Where an older Plex was exposed, follow QNAP's [remediation guide](https://www.qnap.com/en/how-to/faq/article/plex2shell-check-and-remediation-faq-for-qnap-nas-users): check for compromise, do a clean reinstall, and reset Plex and NAS credentials.
- Turn off Plex Remote Access and stop forwarding port 32400 if nobody needs it. Use a VPN if they do.
- To have QNAP confirm a compromise, preserve the Plex Logs folder before removing Plex and open a support case.

## 5. Update: Veeam ships fixes for the critical Linux TCP flaw

The [November 1 briefing](/news/msp-threat-briefing-2026-11-01/) covered CVE-2026-98432, a Linux kernel TCP flaw rated 9.8. On November 6, Veeam published [KB4966](https://www.veeam.com/kb4966) listing which of its Linux-based components are affected and how each gets the fix. Veeam does not say whether the flaw is exploited.

**Who is exposed.** MSPs and clients running the Veeam Software Appliance or Infrastructure Appliance 13.1, Linux helper appliances from Backup & Replication, hypervisor plug-in workers, cloud plug-in appliances, or Agent for Linux recovery media. Backup servers are a common ransomware target.

**What to do.**

- Software Appliance and Infrastructure Appliance 13.1: in Veeam Host Management, go to Updates, check for updates and install now. The fixed kernel is `5.14.0-570.60.1+27.2.el9_6_ciq`. Otherwise the update installs on the nearest Sunday at 14:00, server time.
- Backup & Replication 13.1 on Windows: install the private fix for 13.1.2.57. Version 12.3's fix is still pending.
- Redeploy virtual labs and Azure helper appliances that stay deployed. Temporary helpers pick up the fix on their next run.
- Recreate Agent for Linux recovery media made before the update.
- Patch customer-managed Linux repositories and proxies through the distribution's own advisory. Veeam does not cover them.

Before you reboot appliances, read [KB4960](https://www.veeam.com/kb4960), posted November 4. On some AMD EPYC hosts, Software Appliance 13.1 and later can fail to boot after a reboot, including one after a kernel update. If the appliance panics, power it off and on; a guest restart does not recover it.

## Quick hits

**Windows Paint fix arrives only through the Store.** Microsoft's fix for [CVE-2026-83844](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83844), a Paint remote code execution flaw rated 8.1, needs Paint 11.2609.401.0 or later. The fix comes through the Microsoft Store, not Windows Update, as [reported by The Hacker News](https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html). It is not known to be exploited. Microsoft earlier listed 11.2605.91.0 as fixed, so check scanner results. Run `Get-AppxPackage -AllUsers -Name Microsoft.Paint` and `Get-AppxProvisionedPackage -Online` to find every copy, and trigger a Store update scan from your management tool.

**Claude Code approvals are leaking secrets to GitHub.** Apiiro found 1,122 public copies of `.claude/settings.local.json` holding at least one secret, as [reported by The Hacker News](https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html). Choosing "don't ask again" saves the full approved command in that file, including any password typed into it. Search client and internal repositories, including history, for `.claude/settings.local.json` and `.claude/settings.json`. Rotate any secret found before cleaning up, and add the local file to `.gitignore`.

**Booby-trapped GitHub projects aimed at security staff.** Doctor Web [reports](https://news.drweb.com/show/?i=15311&lng=en&c=5) more than 2,000 Windows PCs infected through repositories posing as scanning, testing and log-analysis tools. Code hides behind long runs of whitespace or in Visual Studio pre-build events. The loader tries to remove ESET, McAfee and Malwarebytes and drops AsyncRAT, a clipboard hijacker and a stealer. Build or run downloaded tools only in a disposable VM. Doctor Web publishes [indicators](https://github.com/DoctorWebLtd/malware-iocs/blob/master/Trojan.Loader.3261/README.adoc).

## Sources

- [CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-19868](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19868)
- [SonicWall: SNWLID-2026-0014](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014)
- [CVE record: CVE-2026-19868](https://www.cve.org/CVERecord?id=CVE-2026-19868)
- [SecurityWeek: SonicWall patches exploited SonicOS bug that weakens VPN logins](https://www.securityweek.com/sonicwall-patches-exploited-sonicos-bug-that-weakens-vpn-logins/)
- [BleepingComputer: SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/)
- [CVE record: CVE-2026-123158](https://www.cve.org/CVERecord?id=CVE-2026-123158)
- [The Hacker News: hackers target OpenSSH SSHole flaw within hours of disclosure](https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html)
- [CVE record: CVE-2026-119977](https://www.cve.org/CVERecord?id=CVE-2026-119977)
- [Picus Security: CVE-2026-119977, when updating WordPress becomes the vulnerability](https://www.picussecurity.com/resource/blog/cve-2026-119977-when-updating-wordpress-becomes-the-vulnerability)
- [The Hacker News: installing the fix for an exploited WordPress flaw can expose some sites one last time](https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html)
- [QNAP: security notice for Plex Media Server vulnerabilities (Plex2Shell)](https://www.qnap.com/en/security-news/2026/qnap-security-notice-plex-media-server-vulnerabilities-plex2shell-update-to-1-43-3-10861-or-later-immediately)
- [QNAP: Plex2Shell check and remediation FAQ](https://www.qnap.com/en/how-to/faq/article/plex2shell-check-and-remediation-faq-for-qnap-nas-users)
- [Veeam: KB4966, CVE-2026-98432](https://www.veeam.com/kb4966)
- [Veeam: KB4960, Software Appliance boot failure on AMD EPYC hosts](https://www.veeam.com/kb4960)
- [Microsoft: CVE-2026-83844](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83844)
- [The Hacker News: Microsoft Paint RCE fix now available, but Windows Update won't deliver it](https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html)
- [The Hacker News: Claude Code's "don't ask again" file exposes passwords and keys](https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html)
- [Doctor Web: malicious GitHub repositories spread Trojan.Loader.3261](https://news.drweb.com/show/?i=15311&lng=en&c=5)