- cybersecurity
- vulnerabilities
CISA adds exploited SonicWall SonicOS SSL VPN flaw CVE-2026-19868 to the KEV catalog
On November 6, 2026, the Cybersecurity and Infrastructure Security Agency added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog, a government-maintained list of security flaws that are confirmed to alrea...
·1 min read·Apply
On November 6, 2026, the Cybersecurity and Infrastructure Security Agency added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog, a government-maintained list of security flaws that are confirmed to already be under active attack in the real world. The flaw affects SonicWall's SonicOS SSL VPN and is described as a use of single-factor authentication vulnerability, meaning attackers can potentially get in without needing to pass a second authentication check. CISA added the entry based on evidence that it is already being actively exploited. The agency notes that this type of vulnerability is a frequent attack vector against networks and poses significant risk to federal systems. Under Binding Operational Directive rules, federal civilian agencies are required to fix catalog entries by their assigned due dates, and CISA is urging all organizations, not just federal ones, to prioritize fixing this vulnerability.
Why it matters
Single-factor authentication gaps in widely deployed VPN software are an easy target for attackers, and this flaw is already being exploited in the wild.