CISA has added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog. According to the vendor description, a user with valid credentials for another login method may be able to bypass SAML authentication on SonicWall SonicOS SSLVPN, and possibly the MFA that SAML enforces.
What Is It
CVE-2026-19868 is an authentication enforcement flaw in the SonicOS SSLVPN service. CISA calls it a "Use of Single-factor Authentication Vulnerability" (CWE-308). A user who has valid credentials for an alternate authentication method may be able to bypass SAML authentication controls. If the attack works, it may also bypass multi-factor authentication (MFA) that SAML enforces.
The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N. The flaw is reachable over the network with no user interaction. Attack complexity is high, the impact on confidentiality is high, and the scope is changed.
Why It Matters
CISA added this CVE to KEV on 2026-11-06, which confirms it is being actively exploited. The SSVC assessment that CISA attached to the NVD record also lists exploitation as "active," automatable as "no," and technical impact as "partial."
SSLVPN is a perimeter remote-access service. A way to get around SAML and MFA undermines the controls that organizations rely on to protect VPN access. KEV lists known ransomware campaign use as "Unknown."
What's Vulnerable
SonicWall SonicOS SSLVPN on these platforms:
- Gen7: SonicOS 7.3.3-7015 and older
- Gen8: SonicOS 8.2.2-8015 and older
NVD lists this CVE with a CVSS 3.1 base score of 7.5 (HIGH). NVD's status for the record is "Undergoing Analysis."
Patch Status
The supplied data does not name fixed versions. For remediation details, see SonicWall's advisory SNWLID-2026-0014.
CISA's required action is to apply mitigations according to the vendor's instructions, following BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. If mitigations are not available, organizations should follow the applicable BOD 26-04 guidance for cloud services or stop using the product. Stakeholders are responsible for evaluating each asset's internet exposure. Federal agencies must remediate by 2026-11-20.