Overview
SonicWall
SonicWall has published a security advisory regarding multiple vulnerabilities affecting their SonicOS platform, including four high-severity vulnerabilities, with one known to be actively exploited. These vulnerabilities target both the SonicOS SSLVPN service and SonicOS management interface. Successful exploitation could lead to an application-level denial of service or enable a remote unauthenticated attacker to perform unauthorised operations.
- CVE-2026-107155 – Cross-Domain Policy Vulnerability – CVSSv3.1 Score: 8.8
- CVE-2026-107154 – Session Validation Bypass Vulnerability – CVSSv3.1 Score: 8.8
- CVE-2026-82308 – Heap-Based Buffer Overflow – CVSSv3.1 Score: 7.5
- CVE-2026-19868* – Use of Single-factor Authentication Vulnerability – CVSSv3.1 Score: 7.5 *[Actively Exploited]
Affected Versions:
- Gen7 Hardware Firewalls: 7.3.3-7015 and older versions
- Gen8 Hardware Firewalls: 8.2.2-8015 and older versions
Zyxel
Zyxel has released a security advisory alongside patches for GS1900 series switches affected by an out-of-bounds write vulnerability. Successful exploitation of the vulnerability could enable an unauthenticated attacker on the local network to send crafted HTTP requests and potentially gain control of the device by running unauthorised commands.
- CVE-2026-107441 – Out-of-Bounds Write Vulnerability – CVSSv3.1 Score: 8.8
Affected Versions:
- GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E,
- GS1900-24EP, GS1900-24HPv2, GS1900-48, and GS1900-48HPv2.
All listed models running version 2.90 Patch 2 or earlier firmware are affected.
Microsoft Paint
The Microsoft Security Response Centre has released security guidance for a high-severity vulnerability impacting Microsoft Paint. The out-of-bounds read in Microsoft Paint enables an unauthorised attacker to execute code locally.
- CVE-2026-83844 – Remote Code Execution Vulnerability – CVSSv3.1 Score: 8.1
Affected Versions:
Any version of Microsoft Paint below 11.2609.401.0 is vulnerable. Ensure that Paint is updated through Microsoft Store or has automatically updated.
Microsoft Patch Tuesday: Microsoft Outlook Zero-day
Following the latest Patch Tuesday (10th of November), Microsoft released patches for 1094 flaws across its products, including 64 critical severity vulnerabilities, and one actively exploited zero-day vulnerability for Microsoft Outlook.
Microsoft Security Response Centre have issued a security guidance for the medium severity vulnerability in Microsoft Outlook. If a user opens a specially crafted message file created by an attacker, Outlook may automatically initiate a connection to an attacker-controlled network without displaying a security warning.
- CVE-2026-124194 – Missing User Interaction for Potentially Unsafe Action Vulnerability – CVSSv3.1 Score: 6.5
Recommended Action
Organisations are encouraged to review the appropriate security advisory pages and apply the updates:
SonicWall: SonicWall SonicOS Security Advisory
Zyxel: Zyxel Security Advisory
Microsoft Paint: Microsoft Paint Security Update Guidance