CISA Adds SonicWall SonicOS SSLVPN Flaw to Known Exploited Vulnerabilities Catalog, Flagging Active Threat
CISA has listed a critical remote‑code‑execution bug in SonicWall’s SonicOS SSLVPN in its KEV catalog, indicating active exploitation. Organizations using SonicWall appliances must patch immediately and prove remediation to meet audit expectations.
ADTP Breach Watch· November 8, 2026· Security Affairs
In early 2026 a critical remote‑code‑execution vulnerability (CVE‑2026‑XXXX, CVSS 9.8) was disclosed in SonicWall’s SonicOS SSLVPN component. The flaw allows unauthenticated attackers to execute arbitrary code and gain full network access. SonicWall issued a security advisory and released patches. On 8 Nov 2026 CISA added the issue to its Known Exploited Vulnerabilities catalog, confirming that threat actors are actively leveraging the bug in the wild. The KEV listing is a signal for U.S. federal agencies and the broader community to prioritize remediation.
Why it matters for trust and compliance
The episode highlights the need for continuous vulnerability‑management controls that generate defensible evidence of timely patching, a core control across most governance frameworks.
Continuous monitoring of vendor patches provides audit‑ready evidence of remediation.
Mapping this vulnerability to your control framework demonstrates effective risk mitigation.
Who is affected
Technology & SaaS providersFinancial services firmsHealthcare organizationsManufacturing and industrial operators
Recommended actions
Identify all SonicWall SonicOS devices and confirm they run the patched firmware version.
Deploy automated vulnerability scanning that captures remediation evidence for audit purposes.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.