CISA Warns of SonicWall SonicOS SSLVPN Vulnerability Exploited in Attacks
CISA added a SonicWall SonicOS SSLVPN vulnerability to its Known Exploited Vulnerabilities catalog, warning of bypasses of SAML and MFA.
CISA added a SonicWall SonicOS SSLVPN vulnerability, CVE-2026-19868, to its Known Exploited Vulnerabilities catalog, warning that valid-credential users can bypass SAML authentication controls and potentially evade multi-factor authentication. CISA added the vulnerability on November 6, 2026, and set a November 20 remediation deadline. The flaw affects authentication enforcement in SonicOS SSLVPN and is classified as CWE-308. It impacts Gen7 and Gen8 platforms running SonicOS 7.3.3-7015 and earlier, and 8.2.2-8015 and earlier, respectively. The fixed releases are 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8.
Unconfirmed: None
- CVE-2026-19868 added to CISA KEV
- Affects Gen7 and Gen8 SonicOS
- Bypass SAML authentication controls
- May evade MFA
- Remediation deadline November 20, 2026
Impact: bypass SAML authentication controls and MFA using valid credentials
| Product | Affected | Fixed in |
|---|---|---|
| SonicWall SonicOS | 7.3.3-7015 and earlier, 8.2.2-8015 and earlier | 7.3.4-7013, 8.2.3-8015 and later |
- 1.upgrade to fixed versions
- 2.assess exposure and follow vendor guidance
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19868 | SAML bypass in SonicWall SonicOS SSLVPN | 7.5 | <1% | KEVPoC | KEV |
From the original article
2 min read at cybersecuritynews.com
CISA added a SonicWall SonicOS SSLVPN vulnerability, CVE-2026-19868, to its Known Exploited Vulnerabilities catalog, warning that valid-credential users can bypass SAML authentication controls and potentially evade multi-factor authentication. CISA added the vulnerability on November 6, 2026, and set a November 20 remediation deadline. Its entry lists ransomware use as unknown and does not require forensic […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.