CVE-2026-19868: SonicWall SSLVPN SAML Bypass in KEV

CISA added CVE-2026-19868, an authentication bypass in the SonicWall SonicOS SSLVPN service, to the Known Exploited Vulnerabilities (KEV) catalog on November 6, 2026. A user with valid credentials for an alternate authentication method can bypass SAML controls, and successful exploitation may also bypass SAML-enforced multi-factor authentication. The CVSS score is 7.5 High, and the KEV entry sets a November 20, 2026 remediation deadline for federal agencies.

How the flaw works

The CVE record describes an authentication enforcement vulnerability in the SonicOS SSLVPN service. A user who holds valid credentials for an alternate authentication method may bypass SAML authentication controls, and successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA). The weakness is CWE-308, use of single-factor authentication.

The description points to a login path that sits next to SAML and does not carry the same checks, so a valid password for that path can skip the identity provider and its MFA step. The public record does not spell out the exact path, so treat that reading as an interpretation of the description and not as a confirmed walkthrough.

The CISA-ADP vector is network, high attack complexity, no privileges, no user interaction, scope changed, high confidentiality impact and low integrity impact, which gives 7.5 High. The attacker still needs a working credential for the alternate method, which is why the complexity is rated high.

Who is affected

The CVE record lists SonicOS on Gen 7 and Gen 8 firewalls. SonicWall's SonicOS 7.3.4 and 8.2.3 security advisory gives the affected and fixed builds, and its versions match the CVE record.

Platform	Affected	Fixed in	Availability per SonicWall
Gen 7, physical and virtual	SonicOS 7.3.3-7015 and older	7.3.4-7013 and above	7.3.4-7013 on October 20, 2026; 7.3.4-7015 on November 5, 2026
Gen 8, physical and virtual	SonicOS 8.2.2-8015 and older	8.2.3-8015	Scheduled for November 6, 2026

The CVE record places the flaw in the SSLVPN service, and its description points at firewalls where SAML sign-in runs alongside another authentication method. The notice lists no configuration conditions, so treat every Gen 7 and Gen 8 firewall below these builds as affected until SonicWall says otherwise, and check internet-facing SSLVPN gateways first. The notice rates the release as a whole at CVSS 8.8 High and says it fixes multiple high and medium severity vulnerabilities, without naming CVE numbers. The only score tied to this CVE is the 7.5 from CISA-ADP.

Listed the day it was published, with no public detail

The CVE record was published on November 6, 2026 at 19:03 UTC, and the KEV entry carries the same date. CISA's SSVC data marks exploitation as active, not automatable, with partial technical impact. That is the whole public evidence of exploitation.

SonicWall's own notice says nothing about attacks. It has no workaround section, names no actor, and gives no scale or start date, and the KEV entry lists ransomware use as Unknown. The one instruction in the notice is to prepare to apply SonicOS 7.3.4 on Gen 7 and 8.2.3 on Gen 8 as soon as those versions are released.

That shapes the response. With no mitigation published and exploitation confirmed by CISA, the upgrade is the only control the vendor has documented. The attacker needs a valid credential for the alternate method, so credential hygiene on those accounts matters while the upgrade is scheduled.

Reading it on VulnTracker

The CVE page opens with an Actively Exploited banner: CISA KEV, added November 6, 2026, remediation due November 20, 2026, ransomware use Unknown. The required action cites CISA's BOD 26-04 guidance. The SSVC panel reads Active, Not automatable, Partial impact, and the CVSS panel shows 7.5 High from CISA-ADP with scope changed.

In the Affected section, the VulnTracker VTDB tab lists SonicOS with two ranges, 7.3.3-7015 and older and 8.2.2-8015 and older, at 90% confidence. The MITRE CNA tab shows one entry and the NVD CPE tab is empty. Remediation carries a VulnTracker guide, AI-generated and updated November 7, 2026, with a No fix recorded badge. It sends you to SonicWall's advisory for the target build because the record names none, repeats CISA's required action, and tells you to review SSLVPN sessions that skipped the SAML identity provider. It also warns that the affected-version data has no range bounds, so the first unaffected build is not established from the record, and that no indicators of compromise are published. Vendor advisories reports none found, so the fixed builds in this post come from SonicWall's notice and not from the CVE page. Quick Info shows the status as Undergoing Analysis and the weakness as CWE-308.

What to do

Inventory your SonicWall firewalls and note the SonicOS build on each Gen 7 and Gen 8 unit. Start with internet-facing SSLVPN gateways where SAML sign-in runs next to another authentication method.
Upgrade Gen 7 to 7.3.4-7013 or later and Gen 8 to 8.2.3-8015, as listed in SonicWall's notice. Confirm in your SonicWall portal that the build is available for your model, since the Gen 8 release was scheduled for November 6, 2026.
Until the upgrade is done, the notice offers no workaround. As precautions, not vendor instructions, review which alternate authentication methods are enabled for SSLVPN users and disable any you do not need.
Review recent SSLVPN sessions for logins that did not go through your SAML identity provider, especially for accounts expected to use SAML with MFA. Investigate and reset credentials for any account you cannot account for. No indicators of compromise have been published, so this is a pattern check, not a signature search.
Federal agencies must follow the KEV required action under BOD 26-04: apply mitigations per vendor instructions, follow CISA's Forensics Triage Requirements, or stop using the product if no mitigation is available, with a November 20, 2026 deadline.

Takeaway

CVE-2026-19868 reached KEV the day its record was published, and the vendor notice documents one fix and no workaround. A 7.5 score understates a flaw that can skip SAML and MFA on an internet-facing VPN, so move Gen 7 and Gen 8 firewalls to the fixed builds before November 20 and track SonicOS on VulnTracker so the next change to this record, such as new exploitation detail or a mitigation, reaches you when it lands.

CVE-2026-19868: SonicWall SonicOS SSLVPN SAML Bypass Added to CISA KEV