# HELD: SonicWall SonicOS SSL VPN CVE-2026-19868 (catalog 6 Nov, 41 minutes 45 seconds after CVE publication) in-shape candidate, timing indeterminate after the vendor advisory read on 8 November; not counted

- **Artifact ID:** RA-2026-046-02
- **Status:** VALID
- **Public record:** https://record.cybersecurityhq.com/rating-actions/ra-2026-046-02
- **Machine-record SHA-256:** `4aba5ffb835efe19f4bf07b38d7aa0e5db592abac3ad6fe49613c1e704a9fa0e`

## Complete structured record

```json
{
  "id": "RA-2026-046-02",
  "date": "2026-11-09",
  "issue": "Issue No. 46",
  "condition": "SC-2026-006",
  "action": "HELD: SonicWall SonicOS SSL VPN CVE-2026-19868 (catalog 6 Nov, 41 minutes 45 seconds after CVE publication) in-shape candidate, timing indeterminate after the vendor advisory read on 8 November; not counted",
  "from": "CONFIRMED / Accumulating; candidate held 7 Nov pending the advisory read",
  "to": "CONFIRMED / Accumulating; candidate held, timing indeterminate; trigger stated",
  "outlook": "Accumulating",
  "watch": "none",
  "criterion_version": "SC-2026-006 criterion v2.0 C1",
  "methodology_version": "v1.3",
  "evidence_rows": [
    "SN-2026-11-07-01"
  ],
  "grades": "Vendor advisory SNWLID-2026-0014, Grade A, read 8 November 2026 by a route outside the collection environment: the vendor says it investigated a report of potential exploitation and gives no date and no scale. CVE record and catalog: Grade A on their own timestamps",
  "independence_determination": "Not reached; no exploitation date exists to compare with the disclosure clock",
  "rule_applied": "Criterion v2.0 C1 verbatim: an exploitation date earlier than the first public product identification is required and none is on any primary; CHQ-CRIT-QUESTION-2026-004 governs whether an authority determination alone suffices (a recommendation is queued for the audit)",
  "alternative_not_taken": "Count on the authority-determination reading, since an active-exploitation listing 41 minutes after publication implies earlier exploitation (not taken: the criterion counts dated exploitation, not inference from catalog cadence, and the question is before the audit)",
  "blind_reproduction": "not applicable (no count)",
  "reproduction_result": "n/a",
  "cgs_provisions": "CGS-2.2",
  "record_links": "CHQ-RAT-2026-046; CHQ-CRIT-QUESTION-2026-004; the signal ledger SN-2026-11-07-01",
  "status": "VALID",
  "admission_status": "Not counted. Held as timing indeterminate: no primary gives an exploitation date. Counts if a primary dates exploitation before the first public product identification."
}
```