Three things happening in the Windows and infrastructure world this week that Columbus businesses running managed IT environments should be aware of. One is urgent. Two are important. All three are worth a quick read.
🔴 SonicWall VPN Flaw — Actively Exploited Right Now
SonicWall has patched a vulnerability (CVE-2026-19868) in their SSL-VPN product that allows attackers to bypass multi-factor authentication. The flaw has been confirmed exploited in real attacks, and CISA (the federal cybersecurity agency) has added it to their Known Exploited Vulnerabilities catalog — which means it's not theoretical.
Here's what makes this one worth flagging: VPNs are the front door to your business network. A flaw that lets attackers bypass MFA on a VPN means that two-factor authentication — one of the most important protections you can have — stops working as advertised. Attackers with any valid credential can potentially get in without the second factor stopping them.
The vulnerability affects SonicOS SSL-VPN services using SAML authentication. SonicWall has released patches and is urging customers to upgrade immediately. CISA has ordered federal civilian agencies to fix this by November 20, 2026.
- If you use SonicWall for VPN access, contact your IT provider today and verify the patch status
- The affected CVE is CVE-2026-19868 (CVSS 7.1) — your IT team can confirm whether your firmware version is affected
- SonicWall's security advisory is at psirt.global.sonicwall.com
Source: BleepingComputer · CISA KEV Catalog
🟡 Patch Tuesday Arrives This Tuesday, November 10
Microsoft's monthly security update — Patch Tuesday — drops this Tuesday, November 10. If your business manages Windows update deployment or uses deferred update policies, now is a good time to make sure patches are queued to apply within a reasonable window after release.
For context: October's Patch Tuesday was a record-breaker — 1,411 vulnerabilities patched, including 3 zero-days (one of which was actively exploited). November patches typically follow a similar pattern. The consistent theme this year has been the sheer volume of fixes, which makes timely patching more important, not less.
What to check:
- Windows Update settings — make sure your machines aren't set to defer updates indefinitely
- Server environments — if you're running Windows Server, patch windows (especially for production systems) need to be planned before Tuesday
- Microsoft's Security Update Guide at msrc.microsoft.com will have the full breakdown on Tuesday
⚪ Windows 11 23H2 Enterprise Just Lost Security Updates
Effective this month, Windows 11 version 23H2 (Enterprise, Education, and IoT Enterprise editions) no longer receives security patches from Microsoft. This follows Windows 11 24H2 Home and Pro reaching end of support last month.
Running an unsupported Windows version doesn't mean your computer stops working — it means Microsoft stops releasing security fixes for it. That gap grows every month.
If you're not sure which Windows version your machines are on: press Windows + R, type winver, and hit Enter. If you see 23H2 on an Enterprise or Education machine, it's time to plan an upgrade to 24H2 or later.
Confused about which versions are still supported and for how long? Microsoft's lifecycle page at learn.microsoft.com has the full breakdown.