Skip to content
eastbaycyber
CISA KEV additions

CISA Adds 1 Known Exploited Vulnerability to Catalog (November 6, 2026)

Source: CISA KEV Catalog · Updated 2026-11-07

Summary

On November 6, 2026, CISA added 1 vulnerability to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-19868. A KEV listing means CISA has evidence of active exploitation. CISA sets a remediation due date for US federal civilian agencies under its binding operational directives; any organization running the affected products should treat these as patch-now priorities.

CVE-2026-19868: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

SonicWall · SonicOS SSLVPN

SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

Federal due date
2026-11-20
Ransomware use
Unknown
Added
2026-11-06

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Read our explainer · NVD record · SonicWall KEV history

Also added to KEV in November 2026

  • November 4, 2026: CVE-2024-27834, Apple Multiple Products (Apple Multiple Products Improper Authentication Vulnerability)
  • November 3, 2026: CVE-2026-119977, WordPress WordPress Core (WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulne)

Check whether you run these products: our vulnerability scanner comparison covers tools that detect KEV-listed flaws. See also the KEV dashboard and KEV history by vendor.