SonicWall releases fixes for exploited SAML bypass flaw

SonicWall released fixes for CVE-2026-19868, an authentication enforcement flaw in the SSL VPN component of SonicOS.SecurityWeekSecurity Affairs The weakness could let a person with valid credentials for an alternative login method bypass SAML authentication controls, potentially defeating SAML-enforced MFA; the SSL VPN exposure applies only when SAML-based login is enabled.SecurityWeekSecurity Affairs SecurityWeek said a report indicated potential exploitation, while Security Affairs described the flaw as added to CISA's KEV catalogue on the day of the advisory.SecurityWeekSecurity Affairs The affected devices are Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older, and Gen8 TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or older.SecurityWeekSecurity Affairs Fixes are in SonicOS 7.3.4-7013 and 8.2.3-8015, with no workarounds.SecurityWeekSecurity Affairs SecurityWeek gives the flaw a CVSS score of 7.1 (high), while Security Affairs reports a score of 7.5 for the KEV listing.SecurityWeekSecurity Affairs

AnalysisThe sources describe potential exploitation but do not confirm attacks, and their reported CVSS scores differ.SecurityWeekSecurity Affairs

QNAP said some customer NAS devices appear to have been compromised through Plex2Shell, a chain of four Plex Media Server flaws that enables unauthenticated code execution.CyberSIXT The warning applies to devices whose Plex server was reachable from the internet while running version 1.43.2 or earlier; QNAP said updating alone will not remove anything an attacker installed.CyberSIXT Plex said on October 19 that the chain was actively and widely exploited, with compromised servers used to run cryptocurrency miners and proxy software.CyberSIXT The chain comprises CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.CyberSIXT Plex version 1.43.3.10861 and later are not affected; Plex released 1.43.3 on September 1.CyberSIXT QNAP said the flaws are in Plex software, not its QTS or QuTS hero operating systems, and advised updating Plex Media Server to 1.43.3 or later.CyberSIXT

The Technical University of Munich said attackers broke into its myTUM portal and stole passwords for the university's central login, then used a system administrator's password to attack its TUMonline campus management system.CyberSIXT TUM took TUMonline offline and said accounts protected by MFA were protected from the attack.CyberSIXT The stolen credentials cover login.tum.de, TUMonline and other university systems.CyberSIXT TUM said attackers may have obtained affected users' passwords, names, home addresses and dates of birth, with additional work details for staff and student records where applicable.CyberSIXT Its analysis of largely logged activity suggested no other TUMonline data, including grades or college applications, was compromised.CyberSIXT The university has not said how attackers entered myTUM, how many people registered with the portal, or how the passwords were stored; it said the investigation is continuing.CyberSIXT