CISA Adds Exploited SonicWall SonicOS Flaw to KEV Catalogue

CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalogue on 6 November 2026. The flaw affects SonicWall SonicOS SSLVPN and may let a user with valid credentials for an alternate authentication method bypass SAML authentication controls, including SAML-enforced multi-factor authentication.

The vulnerability is a use of single-factor authentication flaw that can undermine authentication protections. The supplied data does not include a CVSS score or severity rating. SonicWall has made a patch available and published an advisory with vendor instructions.

KEV listing confirms that the vulnerability is being actively exploited. Use in ransomware campaigns is unknown. CISA set 20 November 2026 as the remediation deadline for affected federal agencies.

CISA requires organisations to apply mitigations in accordance with SonicWall’s instructions, while complying with CISA’s BOD 26-04 guidance on prioritising security updates based on risk and its Forensics Triage Requirements. For cloud services, follow applicable BOD 26-04 guidance; discontinue use of the product if mitigations are unavailable. Stakeholders must assess each asset’s internet exposure and meet BOD 26-04 patching guidelines.

These requirements directly affect Federal Civilian Executive Branch (FCEB) agencies; all organisations should review their exposure and take appropriate action.

See the [NVD entry](https://nvd.nist[.]gov/vuln/detail/CVE-2026-19868) and [CISA KEV catalogue](https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog) for full details.