CISA adds SonicWall SSLVPN authentication bypass to known exploited list

On 6 November 2026, CISA placed CVE-2026-19868, a use of single-factor authentication vulnerability in SonicWall SonicOS SSLVPN, on its Known Exploited Vulnerabilities Catalog. The entry includes the vendor, product, required action, due date, and ransomware use status.

The catalog entry says that someone who already has valid credentials for a different authentication method can use them to get past SAML authentication controls. It also says that successful exploitation can get around multi-factor authentication that SAML would normally enforce.

The listing does not show a CVSS severity score or a fixed SonicOS version. In the ransomware use field, CISA marks the entry as unknown. The entry does not call for forensic triage under Binding Operational Directive 26-04. Because the catalog does not name a fixed version, administrators do not have a patch version to apply from this source. Instead, they must apply mitigations in line with the vendor's instructions or discontinue use of the product if mitigations are unavailable. The lack of a CVSS score also means the severity is not expressed as a number in this catalog listing.

Federal agencies have until 20 November 2026 to take action. The required action is to apply mitigations in line with the vendor's instructions and CISA's BOD 26-04 guidance, or stop using the product when mitigations are not available. CISA also directs stakeholders to review each device's internet exposure and to follow the patching guidelines in BOD 26-04.

The BOD 26-04 guidance referenced by the catalog prioritizes security updates by risk. It also sets out forensic triage requirements for certain vulnerabilities that are being exploited. The due date of 20 November 2026 is two weeks after the 6 November catalog addition, giving federal agencies that period to complete the specified actions. The catalog entry's due date provides a clear deadline for agencies bound by the directive.