CVE‑2026‑19868 SonicWall SonicOS SSLVPN Single‑Factor Authentication Vulnerability Added to CISA KEV Catalog
What It Is — CISA has placed CVE‑2026‑19868 in its Known Exploited Vulnerabilities (KEV) Catalog. The flaw resides in SonicWall SonicOS SSLVPN where authentication relies on a single factor, allowing an attacker who obtains valid credentials to gain full control of the VPN gateway. Active exploitation has been confirmed, prompting the federal Binding Operational Directive 26‑04 to require rapid remediation on publicly exposed assets. No public patch details were released in the advisory, but SonicWall has issued guidance to enable multi‑factor authentication (MFA) and apply the forthcoming firmware update.
Affected Products — SonicWall SonicOS SSLVPN (all versions vulnerable to CVE‑2026‑19868).
Why It Matters for Trust & Control Assurance — The issue tests the control objective of robust authentication and access‑control mechanisms; verifying MFA enforcement is a concrete evidence point for many frameworks. Capability focus: ACCESS_CONTROLS.
Recommended Actions —
- Verify the current SonicOS version and apply the SonicWall‑provided patch or firmware that enforces MFA for SSLVPN.
- Immediately enable multi‑factor authentication on all VPN accounts and document the configuration change.
- Update your vulnerability‑management process to prioritize any CVE listed in the CISA KEV Catalog, capturing remediation tickets as audit evidence.
Source: CISA Advisory – 2026‑11‑06