# SZB-659381b7e7: CISA adds SonicWall SonicOS SSLVPN flaw CVE-2026-19868 to KEV catalog

CISA added CVE-2026-19868, a SonicWall SonicOS SSLVPN use of single-factor authentication vulnerability, to its Known Exploited Vulnerabilities catalog. CISA says the addition is based on evidence of active exploitation.

- Type: Early warning
- Kind: Vulnerability
- Vendor: SonicWall
- Product: GMS 9.5.2
- Status: Confirmed
- Sources: 9 distinct
- First seen: 2026-11-06 04:08 UTC
- Confirmed: 2026-11-06 21:00 UTC

Written by a model from the sources below. Verify against them.

## What to do

- Apply SonicWall's vendor fix for SonicOS SSLVPN to affected appliances
- Review SSLVPN login logs for unexpected authentication activity
- Enable multi-factor authentication on VPN access
- Prioritize remediation as required by CISA BOD 26-04 if you are a federal agency

## Timeline

- 2026-11-06 04:08 UTC: Made public by Mastodon
- 2026-11-06 04:08 UTC: First seen by cve.now
- 2026-11-06 21:00 UTC: Confirmed by CISA advisories
- 2026-11-07 00:02 UTC: Record last updated

## Evidence (9 sources)

- 2026-11-06 · Social · [Mastodon](https://infosec.exchange/@deafnews/117567526068058971): “SonicWall confirms two vulnerabilities in end-of-life GMS 9.5.2 will not be patched.”
- 2026-11-06 · Official · [CISA advisories](https://www.cisa.gov/news-events/alerts/2026/11/06/cisa-adds-one-known-exploited-vulnerability-catalog): “CISA Adds One Known Exploited Vulnerability to Catalog”
- 2026-11-06 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117571281700932203): “A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions could potentially enable an attacker with existing local access to disclose a platform credential.” (+7 more: [Mastodon](https://mastodon.social/@EUVD_Bot/117571281760088744), [Mastodon](https://mastodon.social/@EUVD_Bot/117571281790606742), [Mastodon](https://mastodon.social/@EUVD_Bot/117571285816484820), [Mastodon](https://mastodon.social/@EUVD_Bot/117571285897214461), [Mastodon](https://mastodon.social/@EUVD_Bot/117571289562150987), [Mastodon](https://mastodon.social/@EUVD_Bot/117571757554966604), [Mastodon](https://infosec.exchange/@suriq/117572220442901944))
- 2026-11-06 · Social · [Mastodon](https://infosec.exchange/@infonewscyber/117571524363399025): “⚠️ FAILLE CRITIQUE CVE-2026-19868 activement exploitée : utilisation d'une authentification à un seul facteur dans SonicWall SonicOS SSLVPN”
- 2026-11-06 · Social · [Mastodon](https://infosec.exchange/@ssvc/117571686095657062): “SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability.”
- 2026-11-06 · Social · [Bluesky](https://bsky.app/profile/patchsonar.com/post/3mzoegjwn5j22): “Zero-day · Newly listed by CISA: SonicWall SonicOS SSLVPN”
- 2026-11-06 · Social · [Mastodon](https://infosec.exchange/@patchsonar/117571703121618888): “CISA lists this as actively exploited, so treat it as urgent.”
- 2026-11-06 · Social · [Mastodon](https://infosec.exchange/@DailyCyberSecurity/117571940077186288): “Attackers exploit the SonicWall SonicOS SSLVPN flaw CVE-2026-19868 in the wild.”
- 2026-11-07 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/): “SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks.” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mzolqntpah2x))

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-659381b7e7&body=https%3A%2F%2Fcve.now%2FSZB-659381b7e7%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-659381b7e7

### Has SonicWall confirmed it?

Mastodon, CISA advisories and Mastodon report a possible compromise. None of the sources says it happened.

Source: https://infosec.exchange/@deafnews/117567526068058971, https://www.cisa.gov/news-events/alerts/2026/11/06/cisa-adds-one-known-exploited-vulnerability-catalog, https://mastodon.social/@EUVD_Bot/117571281700932203, https://infosec.exchange/@infonewscyber/117571524363399025, https://infosec.exchange/@ssvc/117571686095657062, https://bsky.app/profile/patchsonar.com/post/3mzoegjwn5j22, https://infosec.exchange/@patchsonar/117571703121618888, https://infosec.exchange/@DailyCyberSecurity/117571940077186288, https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/

### What should SonicWall users do?

Apply SonicWall's vendor fix for SonicOS SSLVPN to affected appliances. Review SSLVPN login logs for unexpected authentication activity. Enable multi-factor authentication on VPN access. Prioritize remediation as required by CISA BOD 26-04 if you are a federal agency.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-19868.

Source: https://cve.now/CVE-2026-19868

## Tracked as

- [CVE-2026-19868](https://cve.now/CVE-2026-19868.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-659381b7e7
Site guide for agents: https://cve.now/llms.txt