HELD: SonicWall SonicOS SSL VPN CVE-2026-19868 (catalog 6 Nov, 41 minutes 45 seconds after CVE publication) in-shape candidate, timing indeterminate after the vendor advisory read on 8 November; not counted
- id
- RA-2026-046-02
- date
- 2026-11-09
- issue
- Issue No. 46
- condition
- SC-2026-006
- action
- HELD: SonicWall SonicOS SSL VPN CVE-2026-19868 (catalog 6 Nov, 41 minutes 45 seconds after CVE publication) in-shape candidate, timing indeterminate after the vendor advisory read on 8 November; not counted
- from
- CONFIRMED / Accumulating; candidate held 7 Nov pending the advisory read
- to
- CONFIRMED / Accumulating; candidate held, timing indeterminate; trigger stated
- outlook
- Accumulating
- watch
- none
- criterion version
- SC-2026-006 criterion v2.0 C1
- methodology version
- v1.3
- evidence rows
- SN-2026-11-07-01
- grades
- Vendor advisory SNWLID-2026-0014, Grade A, read 8 November 2026 by a route outside the collection environment: the vendor says it investigated a report of potential exploitation and gives no date and no scale. CVE record and catalog: Grade A on their own timestamps
- independence determination
- Not reached; no exploitation date exists to compare with the disclosure clock
- rule applied
- Criterion v2.0 C1 verbatim: an exploitation date earlier than the first public product identification is required and none is on any primary; CHQ-CRIT-QUESTION-2026-004 governs whether an authority determination alone suffices (a recommendation is queued for the audit)
- alternative not taken
- Count on the authority-determination reading, since an active-exploitation listing 41 minutes after publication implies earlier exploitation (not taken: the criterion counts dated exploitation, not inference from catalog cadence, and the question is before the audit)
- blind reproduction
- not applicable (no count)
- reproduction result
- n/a
- cgs provisions
- CGS-2.2
- record links
- CHQ-RAT-2026-046; CHQ-CRIT-QUESTION-2026-004; the signal ledger SN-2026-11-07-01
- status
- VALID
- admission status
- Not counted. Held as timing indeterminate: no primary gives an exploitation date. Counts if a primary dates exploitation before the first public product identification.