CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on November 6, 2026, citing evidence of active exploitation. The vulnerability affects authentication enforcement in SonicWall SonicOS SSLVPN. A user who possesses valid credentials for an alternate authentication method may bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication.
This is not an unauthenticated remote-code-execution vulnerability. The alternate-authentication credential prerequisite matters, as does the SAML control involved. Organizations should prioritize identifying affected SonicOS remote-access services and arranging vendor-confirmed remediation rather than assuming that every SonicWall product or deployment has the same exposure.
Note: SonicWall's advisory page for SNWLID-2026-0014 briefly displayed a 'not published' message on 9 November 2026 before rendering again unchanged (version 1.0, published 6 November 2026). The CISA KEV listing (added 6 November 2026) was unaffected. We are monitoring the vendor source and will update this advisory if anything changes.
Technical Information
SonicWall's published CVE record identifies the issue as CWE-308, use of single-factor authentication. Its description places the failure in the SonicOS SSLVPN service: valid credentials for an alternate authentication method can allow a user to bypass SAML authentication enforcement. Where MFA depends on those SAML controls, that enforcement may also be bypassed.
The confirmed impact is therefore loss of an intended authentication barrier. It does not establish execution of arbitrary code, credential-free access, or compromise of every network behind an affected firewall. The exact access available after authentication depends on the deployment's remote-access permissions and network controls; administrators should review those permissions rather than infer a universal impact.
SonicWall assigns this CVE a CVSS 3.1 score of 7.1, High, with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N. The advisory also covers other vulnerabilities and carries an overall CVSS 3.1 rating of 8.8; that bulletin-level score must not be attributed to CVE-2026-19868. CISA ADP separately supplies a 7.5 score using PR:N. That enrichment does not override SonicWall’s explicit valid-credentials prerequisite or its CVE-specific 7.1 score.
Affected Product Versions
SonicWall's advisory identifies the following affected and fixed releases for the listed Gen7 and Gen8 hardware firewalls and NSv virtual appliances:
| Platform family | Affected versions | Fixed versions |
|---|---|---|
| Gen7 hardware and NSv | 7.3.3-7015 and older | 7.3.4-7013 and higher |
| Gen8 hardware and NSv | 8.2.2-8015 and older | 8.2.3-8015 and higher |
SonicWall explicitly states that this vulnerability only impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins. Identify whether SSLVPN uses SAML and whether alternate-authentication credentials could satisfy an unintended access path. Match the appliance against the vendor’s listed models; products or generations absent from this table must not automatically be treated as confirmed unaffected.
Use SonicWall’s product-specific fixed-version table as the remediation authority. Gen8 8.2.2-8015 is affected, not a safe upgrade target; the vendor specifies 8.2.3-8015 and higher.
Exploitation Status
SonicWall says its PSIRT investigated a report indicating potential exploitation and strongly urges customers to upgrade to the latest release. Separately, CISA's November 6 alert states that the CVE was added to KEV based on evidence of active exploitation. The live catalog entry records November 6 as the addition date and November 20, 2026 as the due date. That federal remediation date is not a blanket private-sector deadline or a reason to delay action on exposed remote-access infrastructure.
The catalog lists known ransomware campaign use as Unknown. This does not establish a ransomware connection, and it does not prove that ransomware use is absent. The reviewed primary evidence does not identify a particular threat actor, victim population, or attack volume. Older SonicWall SMA and Akira reporting should not be imported as evidence about this CVE.
Workaround and Mitigation
Prioritize affected internet-facing SSLVPN services and upgrade listed Gen7 hardware and NSv appliances to SonicOS 7.3.4-7013 or higher, and listed Gen8 hardware and NSv appliances to 8.2.3-8015 or higher. Follow SonicWall’s supported upgrade path for the specific appliance and release. The vendor’s workaround field states None; do not substitute a configuration assurance for the prescribed firmware remediation.
As operational risk-reduction measures, review remote-access exposure, restrict access where business requirements permit, and examine the relationship between alternate authentication and SAML-enforced MFA. These are defensive recommendations, not claims that a particular configuration change fixes CVE-2026-19868. Test changes carefully to avoid interrupting legitimate remote access.
After remediation, obtain evidence of the installed version and verify expected SAML/MFA behavior using authorized administrative validation. Review authentication history and remote-access sessions for unexpected account use, and investigate suspicious activity through the organization's incident-response process. Installing an update alone does not establish that an appliance was never accessed before remediation.
Indicators of Compromise
No CVE-specific IP addresses, domains, file hashes, or reliable detection signatures were established in the primary materials reviewed for this draft. There is no responsible basis to invent them or reuse indicators from unrelated SonicWall incidents.
Authentication and session-log review can support an investigation, but unusual events are investigative leads rather than definitive CVE-specific indicators. Preserve relevant evidence according to the organization's incident-response procedures when compromise is suspected.
What to Ask Your Suppliers Today
Ask suppliers that provide remote access, managed firewalls, or connectivity into your environment whether they operate affected SonicOS SSLVPN services, whether SAML-enforced MFA is involved, and which Gen7 or Gen8 firmware build is installed. Request a vendor-confirmed remediation target, a change owner and completion evidence. Explicitly challenge a Gen8 closure response that relies only on 8.2.2-8015, because SonicWall explicitly lists that release as affected.
For suppliers handling sensitive access, also ask whether authentication and session histories were reviewed and whether unexpected access requires incident escalation. Track unresolved exposure and version discrepancies to closure rather than accepting a generic assurance that MFA is enabled.
Need help working through firewall and remote-access suppliers exposed to CVE-2026-19868? Our team can help you prioritize them and track their answers. Talk to an expert
Sources
- SonicWall security advisory SNWLID-2026-0014 — full-page browser render captured 9 November 2026, 07:39 Asia/Jerusalem (UTC+2); first published and last updated 2026-11-06, revision 1.0.
- SonicWall CNA record and CISA ADP enrichment
- CISA November 6 exploitation alert
- CISA KEV catalog JSON — catalogVersion 2026.11.06, checked 9 November 2026 at 07:40 Asia/Jerusalem UTC+2.
