Technology
CISA adds Apple WebKit CVE-2024-27834 and SonicWall SonicOS SSLVPN CVE-2026-19868 to its Known Exploited Vulnerabilities catalog
CISA has added two more flaws to its KEV catalog because of evidence of active exploitation: an old Apple WebKit bug and a SonicWall SonicOS SSLVPN authentication bypass.
Two more vulnerabilities joined this week the priority list of the US Cybersecurity and Infrastructure Security Agency (CISA), because, as it announced, there is evidence that attackers are already exploiting them. The first is CVE-2024-27834 in Apple products, added on Wednesday, November 4. The second is CVE-2026-19868 in the SSLVPN service of SonicWall SonicOS, added on Friday, November 6. The list is the Known Exploited Vulnerabilities (KEV) catalog, which held 1,769 entries in the November 6 edition.
The SonicWall flaw
The SonicWall gap concerns SonicOS, the operating system of the company’s network security appliances, and specifically the SSLVPN service, that is, remote access to the corporate network over an encrypted connection. CISA describes it as the use of single-factor authentication (CWE-308). In practice, a user who holds valid credentials for an alternative authentication method can bypass the SAML authentication checks. If the bypass succeeds, the multi-factor authentication (MFA) enforced through SAML can be bypassed too.
Data from the US National Vulnerability Database (NVD), based on SonicWall’s own listing, show which versions are affected: versions 7.3.3-7015 and earlier for Gen7 appliances, and 8.2.2-8015 and earlier for Gen8. The CVSS 3.1 severity score is 7.5 out of 10 (high). The vendor advisory is numbered SNWLID-2026-0014 and is in SonicWall’s vulnerability database (PSIRT). The KEV catalog records use of the flaw in ransomware campaigns as unknown, as it does for the Apple flaw.
The Apple flaw
CVE-2024-27834 is considerably older and concerns WebKit code, the browser engine used by Safari and Apple’s apps. CISA explains that an attacker who already has arbitrary read and write access to memory can bypass the Pointer Authentication protection. Affected are Safari, iOS, iPadOS, macOS, tvOS and watchOS 10.5. Apple had already fixed the bug on May 13, 2024: Safari, tvOS and iOS and iPadOS 17 in version 17.5, macOS Sonoma in 14.5, watchOS in 10.5, and older iPhones and iPads in iOS and iPadOS 16.7.8. The bug had been reported by Manfred Paul, working with Trend Micro’s Zero Day Initiative, and the NVD rates it 5.5 out of 10 (medium severity). The catalog points to six Apple security pages.
What CISA asks
For both entries CISA asks for mitigations to be applied following the vendors’ instructions and for Binding Operational Directive (BOD) 26-04 on risk-based prioritisation of security updates to be followed. If no mitigations are available, it asks that use of the product stop. The deadline is Wednesday, November 18 for Apple and Friday, November 20 for SonicWall. The deadline binds only the civilian federal executive branch agencies of the United States (FCEB), which under BOD 26-04 must quickly fix the catalog’s high-risk vulnerabilities on internet-exposed systems and check whether they were compromised before the update is applied. CISA urges all organisations to use the catalog as a priority guide.
The two additions follow similar entries of recent days, such as the Ivanti Connect Secure flaws and the GitLab and Cisco ASA/FTD flaws. On how to choose which vulnerabilities deserve fixing first, see also Microsoft’s analysis of 383,000 vulnerabilities.
