CISA Adds CVE-2026-19868 to SonicWall SSLVPN

CISA has added CVE-2026-19868, a single-factor authentication weakness in SonicWall SonicOS SSLVPN, to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. The issue affects SSL-VPN setups that use SAML and, based on available reporting, can let a user with valid credentials for an alternate method bypass SAML authentication controls and the MFA enforced through that flow.

What did SonicWall fix?

SonicWall fixed the issue in SonicOS 7.3.4-7013 and 8.2.3-8015. Available reporting also says there is no workaround, so updating is the mitigation path publicly reported so far. SecurityAffairs echoed the company's recommendation to install the update after investigating a report of possible exploitation.

Which versions were put under notice?

The affected versions identified in available coverage include SonicOS 7.3.3-7015 or earlier on Gen7 TZ, NSa, NSsp, and NSv devices, as well as Gen8 devices running versions earlier than 8.2.3-8015. The Canadian Centre for Cyber Security notice, AV26-1133, said SonicWall reported exploitation of CVE-2026-19868 and linked its addition to CISA's KEV catalog on Nov. 6, 2026.

How did other sources describe the flaw?

BleepingComputer said the vulnerability lets a user with valid credentials for an alternate authentication method bypass SAML authentication controls. Vijilan, in a secondary technical analysis, described it as accepting alternate authentication without necessarily completing the SAML exchange, something that in deployments where SAML enforces MFA could leave that check unrun.

SecurityWeek reported a CVSS score of 7.5 for CVE-2026-19868. The report also said the issue affects SonicOS 7.3.3-7015 or earlier on Gen7 TZ, NSa, NSsp, and NSv, and Gen8 versions earlier than 8.2.3-8015. The material reviewed does not identify any victims, regional scope, or compromise in Latin America, but it does present a clear risk for operators in the region managing exposed SonicWall equipment.