EpiFive
Daily IT & AI brief

IT & AI brief, 7 November 2026: SonicWall SSLVPN flaw in KEV, Exchange Admin API permissions change

CISA lists a SonicWall SSLVPN SAML bypass as exploited, Exchange Online Admin API apps must move to new permissions by 30 November, and Purview's Copilot email DLP control slips to 2027.

By EpiFive Editorial TeamHow the brief is made

CISA added a SonicWall SonicOS SSLVPN vulnerability to its Known Exploited Vulnerabilities catalog on 6 November, with a federal due date of 20 November. Microsoft also published a deadline-driven change for apps that call the Exchange Online Admin API.

SonicWall SonicOS SSLVPN SAML bypass added to KEV

What changed: CISA's Known Exploited Vulnerabilities catalog lists CVE-2026-19868, "SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability", added on 6 November 2026 with a due date of 20 November. The entry says a user holding valid credentials for an alternate authentication method can bypass SAML authentication controls, which can also bypass MFA enforced through SAML. CISA notes SonicWall advisory SNWLID-2026-0014 and marks ransomware use as unknown.

Who is affected: Organisations whose SonicWall firewalls publish SSLVPN and rely on SAML sign-in with MFA.

What to do: Read the SonicWall advisory referenced in the KEV entry and apply its mitigations or fixed firmware. Review SSLVPN sign-in logs for logins that skipped the SAML flow, and check which local or alternate accounts can still authenticate.

Exchange Online Admin API: permissions are being replaced

What changed: MC1540345 says Exchange.ManageV2 is replaced by Exchange.AdminAPI.Manage (delegated) and Exchange.ManageAsAppV2 by Exchange.AdminAPI.ManageAsApp (application). Endpoints stay the same. Worldwide, the new permissions exist from 1 November, migration should finish by 30 November, and the old ones are deprecated on 1 December. GCC, GCC High and DoD deprecate on 1 January 2027. A related post, MC1540342, covers a MailboxFolderPermission response update.

Who is affected: Anyone who owns or runs apps, scripts or third-party tools using the old permissions.

What to do: Inventory app registrations with the old permissions, add the new ones, grant admin consent, confirm Exchange RBAC roles, test, then remove the old permissions. Ask vendors whether they need to update.

Entra SMS and voice retirement: dates for admins and external users

What changed: MC1540327 (marked action required, for education tenants) repeats that Microsoft-provided SMS and voice MFA retires in phases. Rollout begins 1 February 2027 for most users, and 1 July 2027 for Global Administrators and external users. Microsoft cannot give each tenant an exact date.

Who is affected: Users whose only MFA methods are SMS or voice, especially in browsers, apps or devices that cannot use passkeys.

What to do: Identify these users, have them register Authenticator or another supported method, and check it works in their sign-in environments. Use a customer-managed telephony provider if SMS must stay. See /blog/entra-sms-voice-mfa-retirement-migration and /blog/passkeys-entra-id-deployment-guide.

Purview DLP control for external email in Copilot slips to June 2027

What's new: Microsoft updated MC1301714 on 6 November. The Purview DLP control that stops Microsoft 365 Copilot and Copilot Chat from using emails from external or untrusted senders as grounding data now reaches general availability in early June 2027, later than the earlier January plan. It is off by default and does not affect delivery, retention or eDiscovery.

Who is affected: Tenants using Microsoft 365 Copilot or Copilot Chat that want to limit prompt-injection risk from outside mail.

What to do: No action needed unless you want the control. If you do, plan a DLP policy with Copilot as the location. See /blog/purview-dlp-microsoft-365-copilot.

EC2 now publishes an IMDSv1 CloudWatch metric

What changed: AWS announced an ImdsV1Enabled CloudWatch metric for EC2 that shows which instances still allow the older instance metadata service version.

Who is affected: Teams running EC2 who are moving to IMDSv2.

What to do: Chart or alarm on the metric across accounts to find instances still allowing IMDSv1, then require IMDSv2 on them after testing the applications on each.

@GitHub in Slack and Teams is generally available

What changed: GitHub says the @GitHub integration for Slack and Microsoft Teams is generally available. Users can investigate bugs, create issues, make changes and open pull requests from a chat thread. Teams gets a canvas to review plans and changes, and created items note that they came from a chat.

Who is affected: Organisations whose developers use GitHub with Slack or Teams.

What to do: The announcement describes no admin controls, so check your GitHub organisation's app permissions and Copilot policies before encouraging use.

Also worth knowing