CISA adds CVE-2026-19868 to KEV, catalog date 2026-11-06

CHRONOS Cybersecurity & Infrastructure category illustration. Illustrative only, not specific to this event. — Illustrative image, not a photograph of this event.

Urgency: L3
: 60
: 80
: 30
: 20
: 85

At a glance

On 2026-11-06 CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities Catalog. KEV trackers report severity 7.5 and a federal remediation due date of 2026-11-20. Affected organisations should prioritise inventory, patching, or mitigations in line with the KEV listing and federal timetable.

CISA KEV entry added 2026-11-06 for CVE-2026-19868; trackers show severity 7.5 and federal due date 2026-11-20.

CHRONOS Wire · November 7 · Alert 3

What happened

On 2026-11-06 CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog. KEV trackers list the issue as high severity, 7.5, and show a federal remediation due date of 2026-11-20. Organizations using affected SonicWall SonicOS SSLVPN devices should prioritise inventory, patching, or mitigations in line with the KEV listing and federal timetable.

Why it matters

KEV additions are used to prioritise remediation and the trackers show a federal remediation due date of 2026-11-20, creating a short remediation window for affected organisations.

CHRONOS Bottom Line

CISA added CVE-2026-19868 to its KEV on 2026-11-06; trackers report severity 7.5 and a federal due date of 2026-11-20, so affected organisations should prioritise patching or mitigations per KEV guidance.

Full detail

What changed

CVE-2026-19868 was added to CISA's Known Exploited Vulnerabilities Catalog on 2026-11-06; KEV trackers list severity 7.5 and a federal remediation due date of 2026-11-20.

What is genuinely new

The KEV catalog entry for CVE-2026-19868 was added on 2026-11-06, and catalog trackers show a federal remediation due date of 2026-11-20 and severity 7.5.

Detailed analysis

CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities Catalog on 2026-11-06. KEV trackers list the issue as high severity, 7.5, and show a federal remediation due date of 2026-11-20. The KEV listing indicates the vulnerability has been identified for accelerated remediation; organisations should inventory affected devices and apply vendor patches or mitigations as available.

U.S. Impact

No material U.S. impact identified · Confidence: High.