Your VPN's MFA bypass is on CISA KEV: what to do in the first 24 hours
Quick answer, Nov 9, 2026As of 9 November 2026, CVE-2026-19868 may let a SonicWall SonicOS SSLVPN user with credentials for an alternate authentication method bypass SAML-enforced MFA. SonicWall says it investigated a report of potential exploitation, and CISA added the CVE to its KEV catalog on 6 November with a federal due date of 20 November 2026.
Check one thing before anything else
SonicWall advisory SNWLID-2026-0014 is explicit about the precondition: "This vulnerability ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins." If SAML is not enabled for SSLVPN on a firewall, that firewall is not exposed to this one — though the same advisory carries six other CVEs, including a pre-authentication heap overflow in the SSL-VPN service (CVE-2026-82308).
So the first question is not "are we patched" but "which of our firewalls run SAML on SSLVPN". That list is the scope.
The 24-hour sequence
CISA publishes the forensic triage steps that go with a KEV addition, with target timelines, under "Forensic Triage Steps" in its BOD 26-04 Implementation Guidance. Nobody is obliged to run them here. Federal civilian agencies owe a forensic triage only where Table 1 of the directive reads "& forensic triage", and the KEV entry for this CVE answers "Forensic triage required per BOD 26-04: No". The guidance says the same about its own clock: "the specific timeline below is not required." Copy the sequence for its order, not its deadlines.
| Hours | CISA step | What it means here |
|---|---|---|
| 0–2 | "Step 1: Scoping" | List every SonicOS firewall with SAML enabled for SSLVPN. Stand up an out-of-band channel that "does not rely on potentially compromised infrastructure" |
| 2–24 | "Step 2: Preserve and Collect Evidence" | Pull SSLVPN authentication logs and session records before you upgrade. Patching "may jeopardize the availability of artifacts" |
| 2–24 | "Step 3: Critical Patching and Stabilization" | Upgrade to Gen7 7.3.4-7013 or higher, Gen8 8.2.3-8015 or higher (SonicWall, Fixed Software) |
| 6–24 | "Step 4: Contain and Control" | Isolate suspected systems, but not before evidence collection — "premature containment can destroy vital evidence" |
| 24–48 | "Step 5: Triage Analysis" | Look for unauthorized access, lateral movement, persistence, data staging or exfiltration |
| 48–72 | "Step 6: Escalation Decision" | Write the triage report, then decide whether this becomes a full incident response |
If you cannot upgrade today
SonicWall publishes a workaround under "Workaround" in the same advisory, revised on 9 November 2026: if SAML authentication is in use and upgrading is not possible, "disable or delete any active LDAP, RADIUS, and TACACS+ authentication server configured on the firewall," with the menu paths given for each. Note what that costs you — those are the alternate authentication methods, so disabling them removes fallback login paths as well as the bypass. The advisory's Revision History dates version 1.0 to 05-Nov-2026 and version 1.1, which updated the workaround, to 09-Nov-2026, so re-read it rather than working from a copy.
Why 20 November, and why it is not your deadline
The KEV catalog entry carries a date added of 6 November 2026 and a due date of 20 November 2026. That fourteen days is not a judgement about your risk — it falls out of Table 1 in BOD 26-04, which sets a timeline from four facts. Here they are: publicly exposed yes, in the KEV yes, automatable no, technical impact partial. That is row 4 of the table, and row 4 reads 14 days. The automatable and technical-impact values are CISA's own, recorded as SSVC decision points on the NVD record for CVE-2026-19868 with the role "CISA Coordinator" and exploitation marked "active".
Change one fact and the timeline changes. Row 3 — the same vulnerability with total rather than partial control — would read "3 days & forensic triage". The directive says so directly: "the timelines for each asset are dynamic as facts change."
BOD 26-04 took effect on 10 June 2026 and, in its Background section, "supersedes and hereby revokes" both BOD 19-02 and BOD 22-01, the 2021 directive that created the KEV catalog. If your vulnerability-management policy still cites BOD 22-01 timelines, it is citing a revoked directive. CISA's own KEV guidance page says BOD 26-04 "carries forward the KEV catalog criteria from BOD 22-01" — the criteria survived, the timelines did not.
Where this sits next to the other pages
This is the vendor-vulnerability case. If you are already encrypted, the sequence and the payment question are in First 72 hours after ransomware. If you are the underwriter reading the listing rather than the operator living it, the four checks are in What a cyber underwriter checks when CISA adds a KEV listing. If you are deciding what to patch next week rather than today, KEV vs EPSS covers ranking what is not yet listed.
From an AI assistant, the Distributed Risk MCP server runs search_kev against the catalog and list_cyber_advisories for CISA advisories naming a product. If Step 5 turns up evidence and you need people, the selection criteria are in Choosing a cyber crisis response firm, or brief an advisor and we arrange a partner firm that works in your region.
Questions
Is it confirmed exploited, or only reported? SonicWall's advisory says "SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability." CISA went further: adding a CVE to the KEV catalog requires "reliable evidence that the vulnerability has been actively exploited in the wild," and the NVD record carries CISA's SSVC exploitation value of "active". The published record does not say who, how many, or against whom.
We patched. Are we done? Patching closes the path forward, not backwards. The whole point of CISA's step order is that evidence collection comes before patching, because an upgrade can destroy the artefacts that would show whether someone already used the bypass. If you upgraded before pulling logs, say so in the triage report.
Is this legal advice? No. This page is a procedural guide drawn from the public record. Counsel decides what your disclosure and notification obligations are.