CISA adds SonicWall SSLVPN flaw to exploited vulnerabilities Catalog

CISA added a single vulnerability, CVE-2026-19868, a flaw in SonicWall SonicOS SSLVPN tied to single-factor authentication, to its Known Exploited Vulnerabilities Catalog on Nov. 6, 2026. An SSLVPN is a secure sockets layer virtual private network that lets remote users reach a private network. The agency announced the addition because attackers are actively exploiting the flaw. CISA describes this vulnerability type as a common entry point for malicious cyber actors and a serious risk to federal systems.

The catalog tracks flaws attackers are using in the wild.

Binding Operational Directive 26-04 requires agencies to move quickly on high-risk catalog flaws affecting internet-facing assets that let attackers fully control a system once exploited. The directive also tells agencies when to determine whether intruders breached a system before patching. It applies only to Federal Civilian Executive Branch agencies. CISA urges all organizations to use risk-based vulnerability management and to prioritize fixing vulnerabilities in the catalog.

CISA plans to keep adding vulnerabilities to the catalog when they meet the specified criteria. A CVE is a common vulnerability identifier used to track security flaws. Nominations need a CVE ID, proof of active exploitation, and clear mitigation guidance. CISA calls the catalog an authoritative list of vulnerabilities exploited in the real world and says it provides remediation guidance for protecting affected systems.

The catalog helps defenders understand which flaws attackers are already exploiting in the wild.

CISA put an online nomination form into service on May 22, 2026, to let researchers, vendors, and industry partners report exploited vulnerabilities faster. The agency says the form helps it spot, confirm, and share details about flaws attackers are using against government, industry, and critical infrastructure. People can submit through the online form or by e-mail to vulnerability@cisa.dhs.gov. These are the two submission channels CISA offers.

Early detection and coordinated vulnerability disclosure are among the most powerful tools we have to reduce risk at scale

Chris Butera, meritalk.com

The agency added CVE-2026-15409 and CVE-2026-15410 to its Known Exploited Vulnerabilities Catalog on July 14, 2026. CVE-2026-15409 is a server-side request forgery flaw carrying a CVSS score of 10.0. CVSS is the Common Vulnerability Scoring System used to rate severity. CVE-2026-15410 is a post-authentication code injection issue in the Appliance Management Console rated 7.2 on CVSS.

SonicWall released patches for the two SMA1000 flaws in mid-July 2026 and warned that attackers were exploiting them as zero-days, meaning unknown flaws.

SonicWall PSIRT said, “SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory,” the company warned at the time. CISA said ransomware gangs are exploiting the two patched SMA1000 flaws and marked them as ransomware-exploited in catalog updates. Shadowserver is tracking more than 380 SMA1000 appliances exposed online.

SMA1000 enables government agencies, managed service providers and large corporations to reach internal applications and corporate networks via VPN. CISA told federal agencies to patch CVE-2026-15409 and CVE-2026-15410 by July 17, 2026. BOD 22-01 tells civilian federal agencies to fix listed vulnerabilities by the due date, so their networks stay protected from attacks using catalog flaws.

CISA urges all organizations to prioritize fixing CVE-2026-19868 now that it is listed. The agency describes this vulnerability type as a common entry point for malicious cyber actors and a serious risk to federal systems. The listing means agencies under Binding Operational Directive 26-04 must move quickly to fix high-risk catalog flaws on internet-facing assets.