Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-19868 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-06 |
| Vendor | SonicWall |
| Product | SonicOS SSLVPN |
| CVSS Score | 7.1 (high) |
| EPSS Score | No data |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-11-20 |
Vulnerability Description
The SSLVPN service in SonicOS does not properly enforce authentication (CWE-308: Use of Single-factor Authentication). A user with valid credentials for an alternate authentication method may bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA) — i.e. log in to the VPN with a password alone even though the organization requires MFA.
The vulnerability only affects the SSLVPN interface or service when SAML is enabled for SSLVPN logins. SonicWall PSIRT states that it investigated a report indicating potential exploitation, and on 6 November 2026 CISA added the flaw to the Known Exploited Vulnerabilities catalog with a remediation deadline of 20 November 2026.
Vendor CVSS score: 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N). CISA (ADP) rates it 7.5 in NVD. The same SonicOS update (bulletin SNWLID-2026-0014) also fixes six other vulnerabilities, including CVE-2026-107155 and CVE-2026-107154 in the management interface (CVSS 8.8) and CVE-2026-82308, a pre-authentication buffer overflow in SSL-VPN (DoS, CVSS 7.5).
Required Actions
- Upgrade SonicOS — the vendor provides no workaround; the update is the only fix:
- Gen7 firewalls (TZ 270/370/470/570/670, NSa 2700–6700, NSsp 10700–15700, NSv 270/470/870): 7.3.4-7013 or later (affected: 7.3.3-7015 and older),
- Gen8 firewalls (TZ 80/280/380/480/580/680, NSa 2800–5800, NSv XS/S/M/L): 8.2.3-8015 or later (affected: 8.2.2-8015 and older).
- Until you upgrade, if SSLVPN uses SAML, consider temporarily disabling internet-facing SSLVPN access or restricting it to known source addresses, and remove unneeded alternate authentication methods (e.g. local accounts, LDAP) for VPN users.
- Check for compromise (the flaw is actively exploited): review SSLVPN logs for logins that did not go through the SAML/MFA provider, logins from unusual addresses or countries, and sessions of accounts that should only log in via SAML. After upgrading, reset passwords of accounts with alternate login methods and terminate active VPN sessions.
- The CISA deadline for US federal agencies is 2026-11-20 — treat it as the latest acceptable date in your organization as well.
Who Is Affected?
The vulnerability affects organizations running Gen7 and Gen8 SonicWall firewalls (TZ, NSa, NSsp series and virtual NSv on ESX, KVM, Hyper-V, AWS and Azure) with SonicOS where SSLVPN with SAML login is enabled (e.g. via Microsoft Entra ID or another IdP). Deployments without SAML on SSLVPN are not vulnerable to CVE-2026-19868 but should apply the same update because of the other flaws in the bulletin.
Sources
- SonicWall PSIRT - SNWLID-2026-0014: SonicWall SonicOS Affected By Multiple Vulnerabilities
- NVD - CVE-2026-19868
- CISA KEV Catalog - CVE-2026-19868
- FIRST EPSS
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
