Skip to main content
cve.nowby Sazabi
← Early warnings
SZB-659381b7e7Early warningVulnerabilityConfirmed

CISA adds SonicWall SonicOS SSLVPN flaw CVE-2026-19868 to KEV catalog

CISA added CVE-2026-19868, a SonicWall SonicOS SSLVPN use of single-factor authentication vulnerability, to its Known Exploited Vulnerabilities catalog. CISA says the addition is based on evidence of active exploitation.

Written by a model from the sources below. Verify against them.

Sources9Confirmed
Kind
Vulnerability
Vendor
SonicWall
Product
GMS 9.5.2
Status
Confirmed
First seen
Confirmed

What to do

  • Apply SonicWall's vendor fix for SonicOS SSLVPN to affected appliances

  • Review SSLVPN login logs for unexpected authentication activity

  • Enable multi-factor authentication on VPN access

  • Prioritize remediation as required by CISA BOD 26-04 if you are a federal agency

Timeline

  1. Made public by Mastodon
  2. First seen by cve.now
  3. Confirmed by CISA advisories1 day
  4. Record last updated

Evidence 9

  1. Social
    Mastodon
    “SonicWall confirms two vulnerabilities in end-of-life GMS 9.5.2 will not be patched.”
  2. Official
    CISA advisories
    “CISA Adds One Known Exploited Vulnerability to Catalog”
  3. Social
    Mastodon
    “A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions could potentially enable an attacker with existing local access to disclose a platform credential.”
    +7 more: Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon
  4. Social
    Mastodon
    “⚠️ FAILLE CRITIQUE CVE-2026-19868 activement exploitée : utilisation d'une authentification à un seul facteur dans SonicWall SonicOS SSLVPN”
  5. Social
    Mastodon
    “SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability.”
Show all 9 sourcesShow fewer sources
  1. Social
    Bluesky
    “Zero-day · Newly listed by CISA: SonicWall SonicOS SSLVPN”
  2. Social
    Mastodon
    “CISA lists this as actively exploited, so treat it as urgent.”
  3. Social
    Mastodon
    “Attackers exploit the SonicWall SonicOS SSLVPN flaw CVE-2026-19868 in the wild.”
  4. Press
    BleepingComputer
    “SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks.”
    +1 more: BleepingComputer on Bluesky

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about SZB-659381b7e7

Has SonicWall confirmed it?

Mastodon, CISA advisories and Mastodon report a possible compromise. None of the sources says it happened.Source: Mastodon, CISA advisories, Mastodon, Mastodon, Mastodon, Bluesky, Mastodon, Mastodon, BleepingComputer

What should SonicWall users do?

Apply SonicWall's vendor fix for SonicOS SSLVPN to affected appliances. Review SSLVPN login logs for unexpected authentication activity. Enable multi-factor authentication on VPN access. Prioritize remediation as required by CISA BOD 26-04 if you are a federal agency.

Does it have a CVE?

Yes. It is tracked as CVE-2026-19868.Source: CVE-2026-19868

Sources

Tracked as