Perimeter Security Under Siege: SonicWall and Ivanti Flaws Actively Exploited

The Collapse of Perimeter Defense: Auth Bypass and File Uploads

Threat actors are increasingly focusing on perimeter security devices, such as firewalls and VPN gateways, to gain initial access to corporate networks. The latest additions to the CISA Known Exploited Vulnerabilities (KEV) catalog highlight how attackers leverage authentication bypasses and predictable file upload mechanisms to compromise high-value targets.

1. SonicWall SSLVPN Authentication Bypass (CVE-2026-19868)

A critical vulnerability, CVE-2026-19868, has been identified in the SSLVPN service of SonicWall firewalls running SonicOS 7.x and 6.5.x. Attackers with valid alternative authentication factors can bypass SAML authentication controls and completely circumvent enforced Multi-Factor Authentication (MFA). With an extremely high EPSS score of 0.8608, this vulnerability is being actively exploited in the wild to gain direct access to internal networks.

2. Ivanti Connect Secure Predictable Filename Risk (CVE-2026-118527)

Ivanti Connect Secure devices are facing renewed threats with CVE-2026-118527. This vulnerability allows authenticated attackers to upload arbitrary files to predictable paths on the system. Although it requires prior authentication and carries a modest CVSS score of 4.3, its inclusion in the KEV catalog underscores its utility for attackers seeking to establish persistence and escalate privileges within compromised environments.

3. Huawei DSoftBus Denial of Service (CVE-2026-101174)

In the IoT and smart device ecosystem, Huawei's DSoftBus (Distributed Soft Bus) module, used in HarmonyOS and wearables, is vulnerable to a Denial of Service (DoS) attack (CVE-2026-101174). An attacker on an adjacent network can send crafted requests to exhaust system resources, disabling critical distributed communication services.

Mitigation Recommendations

• Immediate SonicWall Patching: Administrators must immediately upgrade SonicOS firewalls to the latest firmware containing official patches and thoroughly audit SSLVPN connection logs for anomalous SAML assertions.
• Apply Ivanti Security Updates: Upgrade Ivanti Connect Secure to version 25.1.1.3, 22.8R2.6, or higher to mitigate the predictable file upload vulnerability.
• Network Segmentation: Restrict access to adjacent networks hosting Huawei smart devices and disable unnecessary communication protocols to prevent localized DoS attacks.