The Cybersecurity and Infrastructure Security Agency added a vulnerability in SonicWall’s SonicOS SSLVPN to its Known Exploited Vulnerabilities catalog on Friday, Nov. 6, based on evidence of active exploitation, the agency said.
Related: Censys Finds 800-Plus Exposed Copies of Artex, the AI Hacking Tool.
The flaw
CISA listed the flaw as CVE-2026-19868, a “Use of Single-factor Authentication” vulnerability in SonicWall SonicOS SSLVPN. The agency said this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
What agencies must do
Binding Operational Directive 26-04 requires federal civilian agencies to prioritize fast fixes for high-risk vulnerabilities in the catalog, CISA said. The directive applies only to those agencies, but CISA urged all organizations to prioritize remediation of catalog vulnerabilities.
What is not yet known
CISA’s alert did not name who is exploiting the flaw or how many systems are affected. It did not include a remediation deadline. More coverage is in Technology.
Sources
Read next in Technology
Most read this week
- Abdul El-Sayed and the Muslim Brotherhood Claims: What’s Confirmed and What Isn’t
- Stock Futures Erase a 2.4% Overnight Drop as Markets Digest Democrats’ Sweep of Congress
- Spain Transport Minister Óscar Puente Quits 26 Days Before Election Over Crash That Killed 69
- GM Korea’s Sales Jump 26.6% on Chevrolet Exports as Hyundai Slips 6.3% and Korean Factory Growth Cools
- Boston Plans to Close 3 Schools in 2028 as Enrollment Drops as Much as 58%
Latest
- Pentagon Awards $1.6 Billion in Contracts, Led by $1 Billion for Emergency Response
- NASA Spotlights De Gerlache-Kocher Massif, a Former Artemis Landing Candidate
- 7,000 Troops Begin Simulated Combat in Hawaii as French Forces Join Army Drill
- Acting Navy Secretary Hung Cao Tours Blount Island, the Marines’ Prepositioning Hub
- Pentagon Logistics Agency Commits $2 Billion to Critical Materials for the Stockpile