If your organisation runs SonicWall SonicOS SSL VPN, check your patch status now. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added an authentication bypass flaw in the SonicWall SonicOS SSL VPN service to its Known Exploited Vulnerabilities (KEV) catalog — a listing that confirms the bug is not just theoretically exploitable, but has been observed being exploited in the wild, according to Security Affairs.
The vulnerability, tracked as CVE-2026-19868 and carrying a CVSS score of 7.5, affects the SSL VPN service in SonicWall SonicOS. An authentication bypass of this class allows an attacker to reach protected resources without completing the login flow that administrators rely on to keep remote access closed to outsiders.
Why the KEV listing matters more than the score
A 7.5-severity bug would not necessarily jump the queue in a well-run patch cycle — plenty of organisations triage remote-access flaws into a routine maintenance window. Inclusion in the KEV catalog changes that calculation. KEV membership is CISA's formal signal that a vulnerability has been exploited in the wild, not merely demonstrated in a proof-of-concept. That distinction moves the remediation question from "next window" to "this week."
For teams that track CISA's guidance as a benchmark — including organisations outside the United States that use KEV as a shorthand for active-risk vulnerabilities — the listing effectively sets the priority level. The practical question for administrators is no longer whether the flaw is theoretically exploitable, but whether the exploitation is already happening against internet-facing appliances like theirs.
Two details still pending
Security Affairs reports the CVE identifier, the CVSS base score, the affected component, and the KEV addition, but does not list the specific SonicOS builds affected or the remediation deadline CISA attaches to KEV entries.
Both are the details operations teams need before they can close a ticket. Administrators should read them directly from CISA's KEV catalog entry and SonicWall's own security advisory, which are the authoritative sources for version ranges and fix-by dates.
Relevance beyond U.S. federal scope
CISA's KEV catalog formally binds U.S. federal civilian agencies, but its reach is broader in practice. Information-security teams worldwide use it as a curated list of confirmed in-the-wild exploitation, and many patch-management playbooks key off it regardless of jurisdiction. Organisations in Hong Kong running internet-exposed SonicWall SSL VPN appliances face the same underlying exposure: a remote-access gateway is a high-value target precisely because it sits at the perimeter, and an authentication bypass defeats the access control the appliance exists to enforce.
Any organisation that has not recently audited its SonicWall estate — including appliances inherited through acquisitions, branch-office deployments, or vendor-managed configurations — should treat this as the moment to confirm firmware levels against the official advisory. Where fixes are available, remote-access gateways are rarely candidates for deferral; where they are not, compensating controls such as restricting VPN exposure to trusted source ranges and increasing monitoring of authentication logs become the immediate fallback.
This story will be updated once affected version ranges and CISA's remediation deadline are published in the KEV catalog entry and SonicWall's advisory.
如果你的機構正在運作 SonicWall SonicOS SSL VPN，請立即檢查修補狀態。據 Security Affairs 報道，美國網絡安全和基礎設施安全局（CISA）已將 SonicWall SonicOS SSL VPN 服務中的一項認證繞過漏洞加入其「已知被利用漏洞」（KEV）目錄——該名錄確認此漏洞不僅在理論上可被利用，更已被觀察到在現實中遭實際利用。
該漏洞編號為 CVE-2026-19868，CVSS 評分為 7.5，影響 SonicWall SonicOS 中的 SSL VPN 服務。此類認證繞過漏洞容許攻擊者無需完成登入流程即可接達受保護資源，而管理員正依賴該流程確保遠端存取不會被外人入侵。
為何 KEV 名錄比評分更重要
一項 7.5 嚴重性級別的漏洞，在運作良好的修補周期中未必會排在優先隊列前列——不少機構會將遠端存取類漏洞歸入例行維護時段處理。然而，被列入 KEV 目錄會改變這一考量。加入 KEV 是 CISA 的正式訊號，表明該漏洞已在現實中被利用，而非僅在概念驗證（proof-of-concept）中示範。這一分別使修補問題由「下個時段」變成「本週內」。
對於以 CISA 指引為基準的團隊——包括美國境外以 KEV 作為高風險活躍漏洞簡稱的機構——該名錄實際上已設定優先級別。管理員面對的實際問題不再是該漏洞在理論上是否可被利用，而是針對他們同類、連接互聯網的設備之利用是否已經發生。
兩項細節仍待公布
Security Affairs 報道了 CVE 編號、CVSS 基礎評分、受影響組件，以及加入 KEV 一事，但並未列明受影響的具體 SonicOS 版本，亦未列明 CISA 為 KEV 條目所訂的修補限期。
這兩項細節正是營運團隊在關閉事件單前所需知道的。管理員應直接查閱 CISA 的 KEV 目錄條目及 SonicWall 自身的安全公告，這兩者才是版本範圍及修補期限的權威來源。
超越美國聯邦範疇的關聯
CISA 的 KEV 目錄在形式上約束美國聯邦民用機構，但實際影響範圍更廣。全球資訊保安團隊均將其視為經篩選確認、已在現實中被利用的漏洞清單，不少修補管理流程不論管轄權屬何，都以此為依據。香港運作連接互聯網的 SonicWall SSL VPN 設備的機構正面臨同樣的根本風險：遠端存取閘道之所以成為高價值攻擊目標，正因它位於網絡邊界，而認證繞過直接擊潰該設備存在的目的——執行存取控制。
任何近期未曾檢視其 SonicWall 設備清單的機構——包括透過收購、分支機構部署或供應商管理配置而繼承的設備——都應趁此刻依據正式公告核對韌體版本。在修補程式可用的情況下，遠端存取閘道極少適合作為延後處理的對象；若修補程式尚未可用，則應即時採取緩解措施，例如將 VPN 暴露範圍限制於可信來源網段，並加強監控認證日誌。
待受影響版本範圍及 CISA 修補限期在 KEV 目錄條目及 SonicWall 公告中公布後，本文將作出更新。