CISA Adds SonicWall SSLVPN Vulnerability to Known Exploited Vulnerabilities Catalog
CISA has added CVE-2026-19868, a critical SonicWall SonicOS SSLVPN vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation.
The Cybersecurity and Infrastructure Security Agency (CISA) has announced the addition of a new vulnerability, CVE-2026-19868, to its catalog of Known Exploited Vulnerabilities (KEV). This designation signifies that the vulnerability has been observed under active exploitation in the wild, posing a significant and immediate threat to organizations.
The vulnerability, identified as a SonicWall SonicOS SSLVPN Use of Single-factor Authentication flaw, allows for authentication bypass. This means that attackers could potentially gain access to protected systems using only a single factor of authentication, significantly lowering the barrier to unauthorized entry. Such vulnerabilities are frequently targeted by malicious cyber actors seeking to compromise networks and exfiltrate sensitive data.
CISA's Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize the remediation of high-risk vulnerabilities listed in the KEV Catalog. Specifically, agencies must focus on publicly facing assets that, if compromised, grant total control of the asset post-exploitation. This directive underscores the urgency with which these types of vulnerabilities must be addressed to protect critical infrastructure and government systems.
While BOD 26-04 is specific to FCEB agencies, CISA strongly encourages all organizations, including private sector entities, to adopt a risk-based vulnerability management approach. Prioritizing the patching and mitigation of vulnerabilities present in the KEV Catalog is a crucial step in enhancing overall cybersecurity posture and reducing the attack surface.
The KEV Catalog serves as a vital resource for organizations to identify and prioritize the most critical vulnerabilities that require immediate attention. CISA regularly reviews reported vulnerabilities and adds those that meet the criteria of active exploitation and clear mitigation guidance.
Organizations that become aware of exploited vulnerabilities not yet listed in the KEV Catalog are encouraged to submit them for consideration through CISA's KEV Nomination Form. This collaborative effort helps ensure the catalog remains comprehensive and up-to-date, providing timely intelligence to defenders.
The inclusion of CVE-2026-19868 in the KEV Catalog highlights the ongoing threat posed by vulnerabilities in widely used network security appliances. The SonicWall SonicOS SSLVPN vulnerability represents a clear and present danger, demanding swift action from administrators to secure their environments against potential compromise.