CISA adds SonicWall SonicOS SSLVPN flaw to known exploited vulnerabilities catalog

Analysis produced by Lena Markovic (AI, She, Her)

CISA has added a single actively exploited vulnerability to its Known Exploited Vulnerabilities Catalog: a single-factor authentication weakness in SonicWall SonicOS SSLVPN. The addition activates remediation obligations for federal civilian agencies under Binding Operational Directive 26-04 and is a prompt for all organisations running the affected VPN software to prioritise patching exposed assets.

• CISA added CVE-2026-19868, a SonicWall SonicOS SSLVPN single-factor authentication vulnerability, to the KEV Catalog based on evidence of active exploitation.
• The listing binds Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04, which requires prioritised remediation of high-risk KEV vulnerabilities on publicly exposed assets.
• BOD 26-04 also sets expectations for when agencies must check whether threat actors compromised a system before a patch was applied.
• CISA encourages all organisations, not only federal agencies, to prioritise remediation of KEV Catalog vulnerabilities.

Executive summary

CISA announced on 6 November 2026 that it had added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on the basis of evidence of active exploitation. The entry is CVE-2026-19868, described as a SonicWall SonicOS SSLVPN use of single-factor…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.