[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmwHAgdwmzT8x-yZHtWAW-xsVjk6mWChlZK_ghE9zEKs":3},{"article":4,"iocs":55,"watch_terms":60,"solutions":61,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"adadd494-66a0-412c-8857-9cca29dd9561","U.S. CISA adds SonicWall SonicOS SSLVPN flaw to its Known Exploited Vulnerabilities catalog","u-s-cisa-adds-sonicwall-sonicos-sslvpn-flaw-to-its-known-exploited-vulnerabiliti-e3c468","U.S. CISA adds SonicWall SonicOS SSLVPN vulnerability CVE-2026-19868 to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a SonicWall SonicOS SSLVPN flaw, tracked as CVE-2026-19868 (CVSS score of 7.5), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-19868 is an authentication bypass vulnerability affecting the SSL VPN service in SonicWall SonicOS. […]","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a SonicWall SonicOS SSLVPN vulnerability, CVE-2026-19868, to its Known Exploited Vulnerabilities (KEV) catalog. This flaw allows an attacker with valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially circumventing multi-factor authentication (MFA). SonicWall is investigating reports of exploitation and urges customers to update their systems immediately.","CISA adds SonicWall SonicOS SSLVPN flaw CVE-2026-19868 to KEV catalog.","https:\u002F\u002Fsecurityaffairs.com\u002F202581\u002Fsecurity\u002Fu-s-cisa-adds-sonicwall-sonicos-sslvpn-flaw-to-its-known-exploited-vulnerabilities-catalog.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2020\u002F07\u002FCISA.jpeg","2026-11-07T09:09:58+00:00","2026-11-07T10:00:23.247754+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"SonicOS","product",{"name":21,"type":22},"SonicWall","vendor",{"name":24,"type":25},"SSLVPN","technology",{"name":27,"type":25},"SAML",{"name":29,"type":25},"MFA",{"name":31,"type":19},"SonicWall SonicOS SSLVPN","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":58,"context":59},"cve","CVE-2026-19868","SonicWall SonicOS SSLVPN authentication bypass vulnerability",[21,18,31],{"controls":62,"vendors":147},[63,92,118],{"slug":64,"name":65,"problem":66,"products":67},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":93,"name":94,"problem":95,"products":96},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[97,102,110],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":98,"product_name":99,"url":100,"description":101},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":119,"name":120,"problem":121,"products":122},"patch-management","Automated patch management","Known holes get closed in days, not months.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",[148],{"slug":149,"name":21,"logo_path":150,"roles":151},"sonicwall","\u002Fvendor-logos\u002Fsonicwall.png",[152],"affected",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":165},"sonicwall-sslvpn-auth-bypass-added-to-cisa-kev-catalog","SonicWall SSLVPN Auth Bypass Added to CISA KEV Catalog","A critical authentication bypass vulnerability in SonicWall SonicOS SSLVPN (CVE-2026-19868) is being actively exploited, allowing attackers with valid credentials for an alternate authentication method to bypass SAML authentication controls and circumvent MFA protections entirely. This matters because VPN gateways are high-value perimeter targets — compromising one can grant broad internal network access. CISA's addition to the KEV catalog signals confirmed in-the-wild exploitation, meaning unpatched organizations face immediate, credible risk. The incident highlights how even layered controls like MFA can be rendered ineffective when underlying authentication logic contains flaws in critical network appliances.",[158,159,160,161,162,163,164],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":166,"NIST SP 800-53 SI-2: Flaw Remediation":167,"CIS Control 17: Incident Response Management":168,"OWASP A06:2021 Vulnerable and Outdated Components":169,"CIS Control 7: Continuous Vulnerability Management":170,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":171,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":172},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices, including timely response to actively exploited vulnerabilities like this SSLVPN flaw.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined schedule, which would mandate timely patching of this SonicOS authentication bypass.","With active exploitation confirmed by CISA, organizations need a practiced incident response plan to rapidly contain, investigate, and recover from potential VPN compromise stemming from this vulnerability.","The exploitation of a known, patchable flaw in a network appliance is a textbook example of risk from running vulnerable and outdated software components in a production environment.","Regular vulnerability scanning and a defined remediation timeline for internet-facing appliances would have flagged CVE-2026-19868 and driven patching before active exploitation occurred.","A.8.8 mandates timely identification and remediation of technical vulnerabilities in information systems, directly applicable to this unpatched SonicOS flaw actively targeted by attackers.","This control requires that authentication mechanisms be robustly implemented and protected; the SAML bypass directly undermines the integrity of identity verification on the VPN gateway."]