It’s on the Exploited List Now. Patch by November 20.

Two days ago, it was a serious flaw with a patch available. Today it is on the US government’s list of vulnerabilities that attackers are actually exploiting — with a deadline attached.

CISA has added CVE-2026-19868, the SonicWall SonicOS SSL-VPN flaw, to its Known Exploited Vulnerabilities (KEV) catalog. The addition follows reports that the flaw may have been exploited in real-world attacks. For US federal agencies, the message is now a date: apply the patches by November 20, 2026. For everyone else running SonicWall, the message is simpler — the exploitation evidence that put this flaw on the list applies to your firewall too.

This is a follow-up to a story we covered on November 7. The flaw itself has not changed. What changed is the certainty: this is no longer a theoretical bypass. CISA’s catalog only lists vulnerabilities with evidence of real-world exploitation, and its decision record for this entry lists the exploitation status as active.

What the flaw does

CVE-2026-19868 is an authentication enforcement vulnerability in the SonicOS SSL-VPN service — the VPN that lets people connect into a company network from outside. It carries a CVSS score of 7.1 to 7.5, rated high.

The weakness is in how the service handles alternate authentication methods. A user with valid credentials for an alternate method can bypass the SAML authentication controls — and with them, any multi-factor authentication (MFA) that SAML enforces. In plain terms: the firewall asks for a second factor at the front door, and this flaw lets an attacker walk around the side and skip it entirely.

SonicWall has acknowledged that it “investigated a report indicating potential exploitation of this vulnerability” and is urging customers to update to the latest version as soon as possible. The company has not disclosed specifics about the attack or who is behind it.

That is the part worth sitting with. When we first covered this flaw, the headline was that MFA was on and attackers walked around it. The KEV listing confirms the walk-around is not hypothetical — someone has already used it, or something very like it, in the wild.

Three more flaws patched in the same round

SonicWall’s advisory fixed more than the KEV entry. Three other high-severity flaws were patched alongside it:

• CVE-2026-107155 (CVSS 8.8) — a permissive cross-domain policy vulnerability in the SonicOS management interface that could let a remote, unauthenticated attacker perform unauthorized operations under specific conditions.
• CVE-2026-107154 (CVSS 8.8) — a session validation vulnerability in the same management interface, with the same potential: unauthorized operations by a remote attacker without logging in.
• CVE-2026-82308 (CVSS 7.5) — a pre-authentication heap-based buffer overflow in the SSL-VPN service that could let a remote, unauthenticated attacker cause an application-level denial of service.

Two of those three sit on the management interface — the part of the firewall administrators use to configure it — and both are rated higher than the KEV flaw itself. They do not need a valid login at all. If your management interface is reachable from the internet, those two deserve the same urgency as the headline flaw.

What to do before November 20

Federal agencies have a hard date. Everyone else has the same risk without the formal deadline, so treat November 20 as your date too:

1. Update SonicOS now. The fixed builds are SonicOS 7.3.4-7013 for Gen 7 and 8.2.3-8015 for Gen 8. Confirm your build in the management interface and do not assume an auto-update handled it.
2. Check whether your SSL-VPN uses alternate authentication methods alongside SAML. The bypass only works where an alternate method is accepted — if you can remove or restrict those methods, do it, and verify SAML is the only path in.
3. Restrict the management interface. It should not be reachable from the internet at all. Limit it to trusted admin networks or a jump host, and check the access logs for logins you do not recognize.
4. Review recent SSL-VPN logins for sessions that bypassed MFA or came from unusual locations, and treat any you cannot explain as a potential compromise, not a glitch.

The wider pattern

This KEV addition lands days after SonicWall detailed two unpatched vulnerabilities in its end-of-life Global Management System (CVE-2026-109593 and CVE-2026-109594), urging customers to migrate to Network Security Manager. The firewall vendor’s week has been a steady drumbeat: a bypass that defeats MFA, management-interface flaws that need no login, and end-of-life systems with no patch coming at all.

It also lands in a month when patch windows have been shrinking across the board. Attackers were exploiting the OpenSSH SSHole flaw within hours of disclosure — and here, too, the gap between “patch available” and “exploitation confirmed” was measured in days, not months. The old assumption — that you have weeks to test and schedule a firewall update — keeps failing in the same way.

November 20 is eleven days away. That is the federal deadline, and it is also a reasonable planning horizon for everyone else: confirm your build, apply the fix, close the alternate login paths, and lock down the management interface. The flaw is on the exploited list now. The only question left is whether your firewall is still running the vulnerable version when the next scan comes around.