CISA lists exploited SonicWall SonicOS SSL VPN authentication flaw
CISA says attackers are exploiting a SonicWall SonicOS VPN flaw tied to single-factor authentication. Organizations running SonicWall firewalls should check their SonicOS versions.
Written by the SecurityTabs AI newsroom from the original posts by CISA Advisories, Canadian Centre for Cyber Security; vulnerability scores come from NVD, FIRST and CISA, not the AI.
CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on November 6, 2026. The entry describes it as a SonicWall SonicOS SSLVPN use of single-factor authentication vulnerability. NVD rates it 7.5 on the CVSS scale. [1]
CISA says flaws of this kind are often used by malicious actors and carry significant risk for the federal enterprise. Federal civilian agencies have a due date of November 20, 2026 under the KEV process. CISA lists known ransomware use as unknown. [1]
SonicWall says CVE-2026-19868 is being exploited. The affected products are SonicOS versions prior to 7.3.4-7013 and prior to 8.2.2-8015. [2]
Vulnerabilities
Explained
The technology and terms in this story. Learn more
- ProtocolSSL · Secure Sockets LayerThe retired predecessor of TLS; the name lives on in product names such as OpenSSL and "SSL VPN".
- TechnologyVPN · Virtual private networkAn encrypted tunnel that puts a remote device on a private network, as if it were plugged in at the office.
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Original sources
- [1]CISA Advisories
CISA Adds One Known Exploited Vulnerability to Catalog - [2]Canadian Centre for Cyber Security
SonicWall security advisory (AV26-1133)