Act today Critical Known exploited Patch available
SonicWall VPN flaw exploited and added to CISA's known-exploited list
CISA Cybersecurity AdvisoriesSonicWallCVE-2026-19868
What happened. CISA added a SonicWall SonicOS SSL-VPN flaw (CVE-2026-19868) to its Known Exploited Vulnerabilities Catalog because of active exploitation. The flaw is the use of single-factor authentication. A related report describes a multi-factor authentication bypass exploited in attacks.
Who is affected. Organisations using SonicWall SonicOS SSL-VPN. Industrial sites that use it for remote access are exposed, because vendors and engineers often reach plant systems through such gateways.
What to do. Check whether you run SonicWall SonicOS SSL-VPN, apply the vendor fix, and check whether the gateway was compromised before patching.
When to act. Act today: on CISA's list of known exploited flaws
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L5
- L3.5
Why: An SSL-VPN gateway is a remote-access and perimeter device, often internet-facing (L5) and bridging into the industrial DMZ (L3.5).
- Are you exposed?
Check whether any SonicWall SonicOS appliance has SSL-VPN enabled and whether it is reachable from the internet.
- If you cannot fix it yet
- Limit who can connect through the SSL-VPN to named users and approved source addresses.
- Require multi-factor authentication on the remote-access path.
- Keep the gateway off the plant network until it is patched.
- Watch for
- VPN logons from unfamiliar addresses, or successful logons without the expected second factor.
- New accounts or configuration changes on the SonicWall appliance.
- ATT&CK for ICS
- T0866Exploitation of Remote ServicesT0886Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CISA Cybersecurity Advisories (opens cisa.gov)
More on SonicWall CVE-2026-19868