TL;DR: CVE-2026-19868 is an authentication-enforcement flaw in SonicOS SSLVPN. When SAML is enabled for SSLVPN logins, a user with valid credentials for an alternate authentication method may bypass SAML controls, and successful exploitation may also bypass SAML-enforced MFA. SonicWall rates this CVE CVSS 7.1 High and fixed it in Gen7 7.3.4-7013+ and Gen8 8.2.3-8015+. CISA added it to KEV on Nov 6, 2026. Upgrade SAML-enabled SSLVPN appliances now. (SonicWall, CISA)
| Item | Detail | Source |
|---|---|---|
| CVE / severity | CVE-2026-19868, High, vendor CVSS 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N). CWE-308. Reported by Ryan Harris of The Electronic Office |
SonicWall |
| Condition | Impacts the SonicOS SSLVPN interface or service only if SAML is enabled for SSLVPN logins | SonicWall |
| Impact | A user with valid credentials for an alternate authentication method may bypass SAML authentication controls; successful exploitation may also bypass SAML-enforced MFA | SonicWall |
| Affected | Gen7 SonicOS 7.3.3-7015 and older; Gen8 SonicOS 8.2.2-8015 and older (product families include Gen7 TZ/NSa/NSsp/NSv and Gen8 TZ/NSa/NSv as listed on the advisory) | SonicWall |
| Fixed in | Gen7 7.3.4-7013 and higher; Gen8 8.2.3-8015 and higher. Advisory first published / last updated Nov 6, 2026 | SonicWall |
| Workaround | None | SonicWall |
| Exploitation | CISA added CVE-2026-19868 to KEV on Nov 6, 2026, based on evidence of active exploitation. Federal due date: Nov 20, 2026. Forensic triage: No. Ransomware use: Unknown. Separately, SonicWall PSIRT says it "has investigated a report indicating potential exploitation of this vulnerability" and urges upgrade; that is not the same as a vendor confirmation of confirmed in-the-wild attacks | CISA alert, CISA KEV, SonicWall |
| Related advisory | SNWLID-2026-0014 also covers other SonicOS issues (management UI, SSL-VPN DoS, TACACS+, weak hashing) that are not in KEV; this page focuses on CVE-2026-19868 | SonicWall |
What to do
- Upgrade Gen7 SonicOS to 7.3.4-7013 or higher, or Gen8 to 8.2.3-8015 or higher. (SonicWall)
- Prioritize appliances with SAML enabled for SSLVPN logins; the advisory says the CVE only impacts SSLVPN when SAML is enabled. (SonicWall)
- SonicWall publishes no workaround. Until upgraded, MoonSec analysis: review which alternate authentication methods remain enabled alongside SAML, and shrink internet-facing SSLVPN exposure where operationally possible.
- Federal/BOD 26-04 stakeholders: remediate by Nov 20, 2026 per KEV. (CISA KEV)
Why it matters
MoonSec analysis: A SAML/MFA bypass on SSLVPN, now on CISA KEV, belongs near the front of the firewall patch queue even at vendor CVSS 7.1. Qualification here is active exploitation evidence via KEV, not a CVSS 9+ or vendor-Critical label for this CVE. Treat SonicWall's "potential exploitation" wording and CISA's KEV add as related but distinct signals.