Our automated tracking framework flagged that CISA added CVE-2026-19868 (SonicWall SonicOS SSLVPN) to the Known Exploited Vulnerabilities (KEV) catalog on November 7, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-19868 by November 20, 2026 — a 14-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-19868 |
| Vendor / product | SonicWall SonicOS SSLVPN |
| Vulnerability | SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability |
| CVSS base score | 7.5 |
| Added to KEV | November 6, 2026 |
| Days public before listing (NVD → KEV lag) | 0 |
| Federal patch deadline | November 20, 2026 |
| Known ransomware use | No |
How This Compares to SonicWall’s Track Record
This one was listed on or before its public disclosure (a lag of 0 days) — a zero-day exploited at or before the vulnerability was even published. SonicWall currently ranks #25 on our KEV Lag leaderboard.
| SonicWall in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 20 |
| Median lag (public → KEV listing) | 124 days |
| 0-day rate (exploited at or before disclosure) | 20% |
| Entries tied to known ransomware campaigns | 10 |
For perspective, the median across all 1768 tracked KEV entries is 232 days — SonicWall’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent SonicWall KEV Additions
The most recent SonicWall vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-83549 | SMA1000 Appliances | September 2, 2026 | 1 | No |
| CVE-2026-83548 | SMA1000 Appliances | September 2, 2026 | 1 | No |
| CVE-2026-15410 | SMA1000 Appliances | July 14, 2026 | 0 | No |
| CVE-2026-15409 | SMA1000 Appliances | July 14, 2026 | 0 | No |
| CVE-2025-40602 | SMA1000 appliance | December 17, 2025 | -1 | No |
Defense guide: How to Detect Zero-day Vulnerability: Attack Chain & Defense — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA has added CVE-2026-19868, a Use of Single-factor Authentication Vulnerability in SonicWall SonicOS SSLVPN, to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability has a CVSS base score of 7.5. It was added to KEV on November 6, 2026, with a federal patch deadline of November 20, 2026. Patching all affected SonicWall SonicOS SSLVPN instances is a high priority.
CVE-2026-19868 was added to the KEV catalog the same day it was made public, indicating exploitation began immediately. Organizations using SonicWall SonicOS SSLVPN are exposed and must patch before the November 20 deadline to mitigate risk.
If immediate patching isn’t feasible, restrict access to vulnerable systems, enforce multi-factor authentication (MFA) on all VPN access points, and enhance network segmentation. Increase monitoring for suspicious activity originating from or targeting SonicWall SSLVPN to detect potential exploitation attempts.
Related Coverage
- SonicWall’s CVE-2026-83548 Was Exploited in 1 Days — Well Under Its 197-Day Median (September 2026)
- SonicWall’s CVE-2026-83549 Was Exploited in 1 Days — Well Under Its 197-Day Median (September 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
