Neoteo CISA Adds Two Vulnerabilities to KEV Catalog Amid Active Exploitation
Article Content
- •CISA added CVE-2026-19868 and CVE-2024-27834 to the KEV Catalog due to active exploitation.
- •CVE-2026-19868 affects SonicWall SonicOS SSLVPN and poses significant risks to federal agencies.
- •CVE-2024-27834 is an improper-authentication flaw in Apple systems with a remediation deadline of November 18.
CISA has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. CVE-2026-19868, a high-severity flaw in SonicWall SonicOS SSLVPN, was added on November 6, 2026, due to evidence of active exploitation. This vulnerability allows attackers to exploit single-factor authentication weaknesses, posing significant risks to federal agencies. Additionally, CVE-2024-27834, an improper-authentication flaw affecting Apple systems, was added on November 4, 2026, and has a remediation deadline of November 18 for Federal Civilian Executive Branch (FCEB) agencies under BOD 26-04. CISA encourages all organizations to prioritize remediation of vulnerabilities listed in the KEV Catalog. The vulnerabilities are linked to ongoing exploitation campaigns, highlighting the urgency for organizations to address these issues promptly.
Ask AI about this cluster
Answers cite the sources they use
More articles in this cluster (3)
Following this threat?
Track CVE-2024-27834 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What systems are affected by CVE-2026-19868?
What is the remediation deadline for CVE-2024-27834?
How can organizations prioritize these vulnerabilities?
Continue Reading
APT29 Targets Mobile Users with Watering Hole Campaign APT29, a Russian state-sponsored hacking group, is behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites and fake domains. The campaign, identified by Sekoia in mid-October 2026, employs multiple infection vectors, including JavaScript injection on legitimate sites… 
CISA Adds Apple Vulnerability to Exploited List Amid Active Exploitation Reports On November 4, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-27834, a medium-severity vulnerability (CVSS 5.5) affecting multiple Apple products, to its Known Exploited Vulnerabilities catalog. This flaw, which allows attackers with arbitrary read and write capabilities to…