CISA Adds SonicWall SSLVPN Authentication Flaw to KEV

CISA has added a SonicWall SonicOS SSLVPN authentication vulnerability to its Known Exploited Vulnerabilities catalogue, setting 20 November 2026 as the remediation due date for covered federal agencies. The SonicWall SSLVPN entry, added on 6 November, identifies CVE-2026-19868 and describes a route by which valid credentials for an alternate authentication method may bypass SAML authentication controls.

Successful exploitation may also bypass SAML-enforced multi-factor authentication, according to the CISA catalogue entry. That credential prerequisite is central: the official description is not a claim that an unauthenticated attacker can enter the VPN without a password or other valid credentials.

SonicWall SSLVPN entry identifies a single-factor weakness

CISA calls the issue a use-of-single-factor-authentication vulnerability and classifies it under CWE-308. Its entry links to SonicWall advisory SNWLID-2026-0014 as the vendor source. The product named is SonicOS SSLVPN, not SonicWall’s separate Global Management System.

The authentication distinction is important for organisations relying on SAML to enforce their access policy. The described problem is that a user holding valid credentials for another method may get around those SAML controls, with possible consequences for SAML-enforced MFA. It is therefore about which authentication route is honoured, rather than a general claim that MFA itself has been broken across all SonicWall products.

KEV inclusion establishes CISA’s assessment that exploitation is known. The entry does not identify a victim count, campaign operator or loss total. Its field for known ransomware campaign use reads “Unknown”, and its forensic-triage field reads “No”. Neither field establishes that ransomware deployment has been confirmed, nor that investigation of an individual organisation would be unnecessary.

The 20 November date has a defined federal scope

CISA’s required action is to apply mitigations in accordance with vendor instructions while meeting Binding Operational Directive 26-04 and the linked implementation guidance. The catalogue also directs stakeholders to evaluate each asset’s internet exposure and follow the applicable patching guidance. Where mitigations are unavailable, its required action includes discontinuing use of the product.

The catalogue’s 20 November date is a deadline in the covered federal-agency regime, not a law imposing the same deadline on every private company or every user worldwide. Other organisations can use KEV inclusion as prioritisation evidence without misdescribing the source of their own obligations.

The vendor advisory is the place to check affected releases and applicable mitigations for the deployed environment. CISA’s short description alone is not a fixed-version matrix: affected releases and the appropriate vendor response need to be matched to the installation.

Alternate authentication paths can undermine a policy boundary

For defenders, the meaningful distinction is between a control being enabled and that control governing every permitted login route. SAML-enforced MFA may be part of an organisation’s intended access boundary; the vulnerability description concerns an alternate route that can bypass that boundary using valid credentials. Treating this as passwordless entry would lose the prerequisite. Treating it as harmless because credentials are required would lose the significance of the SAML and MFA controls that may be bypassed.

The federal due date and exploitation status answer different questions. One establishes when covered agencies are expected to act; the other explains why the flaw merits urgent attention. Neither supplies a diagnosis of any particular installation. The same separation applies to ransomware: CISA’s Unknown field leaves that campaign classification unsettled even though the vulnerability is in KEV. Accurate triage therefore needs the vendor’s applicability and mitigation information alongside the catalogue’s exploitation signal, rather than an invented attack narrative or a generic promise that one configuration change solves every deployment.

TSN’s earlier SonicWall GMS end-of-life flaw coverage concerns different vulnerabilities in a different product, so it is related context rather than an earlier version of this story. Alpine OpenSSH’s authentication-bypass fix offers another example of why authentication prerequisites matter. The Zyxel GS1900 vulnerability warning provides a contrasting network-device case in which the wording around exploitation confidence also matters.

For this entry, the actionable reference remains SonicWall’s SNWLID-2026-0014 advisory, with CISA’s covered-agency due date fixed at 20 November and ransomware attribution still unspecified.

Sources

• CISA Known Exploited Vulnerabilities catalogue
• CISA machine-readable catalogue
• SonicWall PSIRT SNWLID-2026-0014
• CISA BOD 26-04

Related stories

SonicWall Won’t Patch Two GMS Flaws as the Product Is End-of-Life is the next read for product-lifecycle context, but those GMS flaws are distinct from this SonicOS SSLVPN vulnerability.