Is it being used in attacks?

What being on the list means

CISA adds a flaw only when it has reliable evidence that attackers are using it, and only once there's a fix or clear advice.^[1] So a match means two things: someone, somewhere, is using this flaw against real people now, and there's something you can do about it. Usually that's installing an update.

Not being on the list doesn't mean safe. Most flaws are never added, and attacks start before anyone has evidence. Keep everything updated either way.

CISA’s required action is written for US government agencies, which have to act by a deadline. For a family or a small business it comes to the same thing: update, or ask whoever looks after your IT to confirm it’s done.

By company

The companies with the most flaws on the list, and how many each has. Each page lists every one, newest first.

• Microsoft390
• Cisco102
• Apple96
• Adobe83
• Google76
• Oracle46
• Apache41
• Ivanti38
• Linux32
• Fortinet32
• Citrix27
• D-Link26
• VMware26
• SonicWall19
• Synacor19
• Android17
• Palo Alto Networks16
• Samsung15
• Atlassian14
• SAP14
• Zyxel13
• Mozilla13
• Trend Micro12
• Qualcomm12

All 95 companies with three or more flaws on the list, or every flaw by month.

Latest alerts

When a flaw matters to people like you, HARD sends an alert: what's happening and what to do. Only when it matters.

1. High31 Oct 2026
   Binance robbed of US$6.3 billion in 20 minutes, the biggest crypto theft on record

   Updated 7 NovBinance published its incident report on 3 November. More

   On 29 October, attackers moved about US$6.3 billion out of Binance across ten blockchains in about 20 minutes. TRM Labs and Chainalysis blame North Korea's TraderTraitor group, which the FBI linked to the US$1.5 billion Bybit theft. Binance paused deposits and withdrawals, says it froze about US$3 billion, and says it will cover every loss.

   What to do nowBrief executives and their assistants on the fake-recruiter trick. Real recruiters don't need you to run code on a work computer. Never open a take-home test, 'assignment' or meeting tool from a stranger on a work laptop; use a separate spare device if you must look. Verify the recruiter and the company through channels you find yourself, and tell your IT or security contact when an approach mentions your employer.

   Read the full story
2. High7 Nov 2026
   Fake OpenAI, SpaceX and Anthropic event invites steal Microsoft 365 and Google logins, even past two-factor

   Push Security says it blocked visits to fake registration pages for OpenAI, SpaceX and Anthropic events in late October. The lures promise perks such as three months of ChatGPT Pro, arrive through trusted link shorteners and sit behind a Cloudflare check that keeps security scanners out, then tell the visitor to sign in with a work account. On the Microsoft path a kit called Kali365 makes a device code and asks the victim to enter it on Microsoft's real login page, which hands the attacker access without a password. On the Google path a kit called VoidProxy relays the real sign-in and captures the password, the two-factor response and the session. Both get past ordinary two-factor codes.

   What to doDon't sign in to claim a prize or register for an event from an email or message. Open the company's own site by typing it. Never type a code that a website gives you into a Microsoft or Google login page. Assistants who manage an executive's calendar and invitations should be told. If someone did, sign out of all sessions, change the password, revoke the account's sessions in the security settings and call your IT contact. Security keys and passkeys resist the Google-style login-proxy attack, but they do not stop device-code phishing, because the victim signs in on Microsoft's real site and approves the attacker's session. IT teams should restrict device-code sign-in where it isn't needed, using Microsoft's Conditional Access authentication-flow controls.

   Sources
3. High7 Nov 2026
   SonicWall SSL-VPN flaw CVE-2026-19868 gets past two-factor login and is being exploited

   SonicWall's advisory SNWLID-2026-0014 fixes CVE-2026-19868 in the SSL-VPN of SonicOS. It only affects SSL-VPN set up to use SAML sign-in. An attacker holding valid credentials for another login method can get past SAML controls, which can include two-factor checks. It affects SonicOS Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier. SonicWall says it investigated a report of possible exploitation and that there are no workarounds. CISA added the flaw to its list of exploited flaws on 6 November, with a deadline of 20 November for US federal agencies. The same advisory fixes six other flaws, which aren't listed as exploited.

   What to doUpdate the SonicWall firewall to SonicOS 7.3.4-7013 (Gen7) or 8.2.3-8015 (Gen8). If it can't be done today, consider switching off SSL-VPN until it is. Ask your IT provider to check VPN logins since October for sign-ins you don't recognise, and to rotate passwords for accounts that use the VPN. Home and small-office setups that don't use SAML sign-in on the VPN aren't in the affected configuration.

   SourcesIs CVE-2026-19868 being used in attacks?

The Situation Room · RSS feed · HARD’s advisories · The long reads

References

1. ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.11.04, updated 4 Nov 2026. The plain-English articles are HARD’s own.

Get alerts by emailOnly when something serious happens, with what to do about it. Nothing else, and we never share your address.

Get alerts