Perimeter Security Under Siege: SSLVPN Auth Bypass and File Upload Exploits

Perimeter Security Collapse: SonicWall and Ivanti Exploited in the Wild

High-risk vulnerabilities targeting perimeter security devices that defend the front lines of corporate networks are being reported consecutively. Attackers are heavily targeting VPN and firewall appliances to bypass Multi-Factor Authentication (MFA) or establish a foothold for lateral movement within internal networks.

The most urgent threat is CVE-2026-19868, discovered in the SonicWall SonicOS SSLVPN service. Affecting SonicWall firewalls running SonicOS 7.x and 6.5.x, this vulnerability allows an attacker with valid alternative authentication means to bypass SAML authentication controls and circumvent enforced MFA. With a high EPSS score of 0.8608, this flaw is actively being exploited in the wild. Organizations utilizing these devices must immediately upgrade to the latest firmware and conduct a comprehensive audit of SSLVPN connection logs.

Simultaneously, a new vulnerability in Ivanti Connect Secure, CVE-2026-118527, has been identified and added to CISA's Known Exploited Vulnerabilities (KEV) catalog. This flaw allows authenticated attackers to upload arbitrary files to predictable paths, potentially serving as a stepping stone to compromise system privileges. Organizations running affected versions (prior to 25.1.1.3 and 22.8R2.6) must apply the vendor's security patches immediately.

SOHO Network Threat: Fatal Flaw in WAVLINK Routers

Beyond enterprise-grade appliances, critical flaws are also emerging in network equipment commonly used in branch or small offices. A remote command injection vulnerability, CVE-2026-120227, has been disclosed in the static_route_setting.sh script of WAVLINK WN701AE routers (firmware version M01AE_V260105).

This vulnerability has received an extremely high CVSS score of 9.9. It enables authenticated remote attackers to execute arbitrary OS commands via the web management interface, leading to complete device takeover. Since attackers can exploit this to intercept internal traffic or enlist the device into a botnet, administrators should block external access to the web interface and restrict management ports using Access Control Lists (ACLs).