VULNpocalypse
HighVulnerabilityActive

SonicWall SonicOS SSLVPN CVE-2026-19868 exploited, CISA says in KEV listing

CISA says SonicWall SonicOS SSLVPN flaw CVE-2026-19868 is exploited and added it to KEV; find exposed devices and check SonicWall guidance.

Published
Exploitation
Yes, according to CISA, which added it to the KEV catalog based on evidence of active exploitation

Live scores

CVE-2026-19868
On CISA KEV
Yes, since 2026-11-06
Detection rule
No public rule yet

What happened

On November 06, 2026, CISA said it added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog “based on evidence of active exploitation” CISA. According to CISA, the entry is CVE-2026-19868, listed as a “SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability” CISA.

CISA describes this type of vulnerability as a frequent attack vector for malicious cyber actors CISA. CISA says Binding Operational Directive (BOD) 26-04 requires Federal Civilian Executive Branch (FCEB) agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically KEV-listed CVEs on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. According to CISA, BOD 26-04 also sets expectations for when agencies must check whether threat actors compromised a system before the patch was applied, and the directive applies only to FCEB agencies CISA.

Several details are not confirmed in the sources:

  • The CISA alert does not describe the technical details of the flaw.
  • Affected SonicOS versions are not confirmed.
  • Fixed versions or patches are not confirmed.
  • Who is exploiting the flaw, and how widely, is not confirmed.
  • A SonicWall statement is not included in the sources.

Am I affected?

You may be affected if you operate SonicWall devices running SonicOS with the SSLVPN feature in use, based on the product named in CISA’s listing CISA. Specific affected versions are not confirmed in the sources.

What to do now

  1. Inventory SonicWall devices running SonicOS and identify which have SSLVPN enabled, especially those exposed to the internet.
  2. Look up CVE-2026-19868 and SonicWall’s own advisory for affected versions and fixes. These details are not confirmed in the sources used here.
  3. Prioritize remediation, in line with CISA’s encouragement for all organizations to prioritize remediation of KEV Catalog vulnerabilities CISA.
  4. Consider checking whether affected devices were compromised before you remediated. CISA says BOD 26-04 sets expectations for when federal agencies must perform such checks CISA.

Sources