All advisories
SMS codes and push approvals are routinely bypassed. Passkeys and security keys are not.
1 min read
Severity: HighPrioritize within your next patch cycle.
Severity
High
Published
9 November 2026
Updated
12 November 2026
Affected
- VPN
- cloud consoles
- admin portals
CVE IDs
No specific CVE IDs.
The problem
Attackers now use real-time phishing proxies and "MFA fatigue" to get past one-time codes and push prompts.
Recommended steps
- Require passkeys or FIDO2 security keys for administrators first.
- Turn on number matching for any remaining push-based MFA.
- Block legacy authentication protocols that skip MFA entirely.
- Alert on new MFA device registrations.
Need help with this?
We'll check whether your systems are exposed, set priorities, and help your team remediate.