CVE-2026-19868

HIGH

7.5

CVSS Score

Published: November 6, 2026 at 07:03 PM UTC

Updated: November 7, 2026 at 05:19 AM UTC

1 product affected across 1 vendorSonicOS

Using SonicOS by SonicWall?

Get instant alerts when new vulnerabilities affect SonicOS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploitation

CISA KEV

Exploit prediction

EPSS 0.6%

SSVC

Active

Remediation

No fix recorded

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score0.6%

EPSS (Exploit Prediction Scoring System) estimates a 0.6% chance this CVE is exploited in the wild within the next 30 days — higher than 50% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

Required Action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Ransomware Use

Unknown

Added to KEV

Nov 6, 2026

Remediation Due

Nov 20, 2026

12 days remaining

Notes

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014

BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk

Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk

https://nvd.nist.gov/vuln/detail/CVE-2026-19868

Description

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

SonicOS · SonicWall

90%

7.3.3-7015 and older versions 8.2.2-8015 and older versions

Remediation

VTDB RemediationNo fix recorded

AI-generated · claude-opus-5-5 · published by VulnTracker

Apply SonicWall's mitigations from advisory SNWLID-2026-0014 to every SonicOS firewall running SSLVPN on 7.3.3-7015 or older or 8.2.2-8015 or older, because this SAML and MFA bypass is actively exploited and our records name no fixed firmware.

1
Apply the CISA KEV required action
CISA required action: "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines." Due date: 2026-11-20T00:00:00+00:00. The entry was added to KEV on 2026-11-06, and CISA lists ransomware use as Unknown. The SSVC assessment is active exploitation, not automatable, partial technical impact.
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19868
2
Identify SonicOS firewalls with SSLVPN and SAML in the affected versions
Record the SonicOS version of every SonicWall firewall. Versions 7.3.3-7015 and older and 8.2.2-8015 and older are affected. Exposure comes from the SSLVPN service where SAML authentication (and SAML-enforced MFA) is configured alongside another authentication method. Prioritise internet-facing SSLVPN gateways.
Fact: affected versions for sonicwall-sonicos; CVE description (SSLVPN, alternate authentication method bypasses SAML)
3
Apply SonicWall's remediation from SNWLID-2026-0014
Follow SonicWall's advisory SNWLID-2026-0014 for the fixed firmware or mitigation for your SonicOS line (7.x or 8.x). Our records name no fixed build, so take the target version or configuration change from the advisory. If no mitigation is available for your version, follow the KEV instruction to stop using the product.
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014
4
Review SSLVPN logins for SAML/MFA bypass
The flaw lets a user with valid credentials for an alternate authentication method skip SAML and SAML-enforced MFA. On affected firewalls, review recent SSLVPN sessions for logins that did not go through the SAML identity provider, especially for accounts expected to use SAML with MFA. Investigate and reset credentials for any account you cannot account for. CISA's KEV action also requires following its Forensics Triage Requirements.
Fact: KEV short_description (bypass of SAML authentication controls and SAML-enforced MFA)

No fixed version, fixes entry or vendor advisory record is in the facts; the remedy and any mitigation must come from SonicWall's advisory SNWLID-2026-0014. The description suggests that removing or disabling non-SAML authentication methods for SSLVPN users would close the path, but the facts do not state this as a vendor mitigation, so it is not given as a workaround; confirm with the advisory. The affected-version data is a free-text statement (7.3.3-7015 and older, 8.2.2-8015 and older) without range bounds, so the first unaffected build for each line is not established here. The KEV action refers to BOD 26-04 and Forensics Triage Requirements URLs in CISA's notes, which are not included in these facts. The facts give no specific indicators of compromise.

Guidance updated 2026-11-07