CISA has added a SonicWall SonicOS SSLVPN vulnerability, CVE-2026-19868, to its Known Exploited Vulnerabilities catalog. The issue affects authentication enforcement in SonicOS SSLVPN and can let users with valid alternate credentials bypass SAML controls, with possible bypass of multi-factor authentication through that login path.
CISA listed the vulnerability on November 6, 2026, and set a November 20 remediation deadline. Its entry says ransomware use is unknown and does not call for forensic triage under Binding Operational Directive 26-04. Organizations are still expected to assess exposure and follow the vendor guidance that applies to the flaw.
What the flaw allows
According to the CVE record, a person who has valid credentials for an alternate authentication method may get around the controls applied through SAML. If that login flow is used successfully, MFA enforced through the SAML process may also be bypassed. The source describes SAML as a way for an organization to handle sign-ins through a central identity provider, and the concern is that another authentication route can open access without the checks that were expected.
The record does not describe this as a password-free attack. Valid credentials for an alternate method are still required. The weakness is classified as CWE-308, use of single-factor authentication, where a system accepts one factor such as a password when additional checks should be required.
Affected SonicWall platforms
The CVE record says the affected systems are Gen7 and Gen8 platforms running SonicOS 7.3.3-7015 and earlier, and 8.2.2-8015 and earlier, respectively. Cybersecurity News’ earlier reporting on the SonicWall SSLVPN issue lists fixed releases as 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8, or later supported versions. The reported CVSS score is 7.1.
CISA’s listing came after SonicWall’s warning, which first described a report of possible exploitation. The later catalog entry increases the urgency for defenders dealing with the same flaw.
What is known and what is not
The available information does not name the attackers, the affected organizations, or how many incidents have been confirmed. Ransomware involvement should not be treated as established. That limit stays in place even though the vulnerability is now in CISA’s exploited catalog.
The source also draws a line between this issue and earlier SonicWall authentication bypass attacks. Those earlier attacks involved CVE-2024-53704, a different flaw that allowed session hijacking without authentication. The earlier details do not apply to CVE-2026-19868 because the access requirements are different.
Response and remediation
Administrators are told to check appliance models, firmware versions, SAML settings, and internet exposure before applying the matching update. The SonicWall security advisory is the guide for deployment decisions. The source says there is no published workaround, so the firmware upgrade is the main remediation step.
Security teams are also told to review enabled login methods and VPN activity for unexpected access. An MFA setting by itself should not be taken as proof that every authentication route uses the same checks. After patching, the controls should be confirmed so the intended remote access policy is actually in place.
Licensed under CC BY-ND 4.0 International