CISA lists exploited SonicWall SonicOS SSL-VPN SAML bypass
First merged summary.
CISA lists CVE-2026-19868 as exploited; SonicWall has fixes, and federal agencies must remediate by November 20, 2026.
CISA added SonicWall SonicOS SSL-VPN flaw CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on November 6, 2026, and ordered federal agencies to remediate by November 20. The flaw applies only when SAML is enabled for SSL-VPN logins: a user with valid credentials for an alternate method can bypass SAML controls and MFA enforced through them. Gen7 and Gen8 firewalls on SonicOS 7.3.3-7015 and earlier or 8.2.2-8015 and earlier are affected; fixes are 7.3.4-7013 and 8.2.3-8015, with no workaround. Security Affairs reports CVSS 7.5, while SecurityWeek and Cyber Security News report 7.1. CISA treats the flaw as exploited, while SonicWall says it is investigating reports of possible exploitation and has not published attack details.
- CVE-2026-19868 bypasses SAML MFA only with valid alternate credentials.
- Fixes are SonicOS 7.3.4-7013 and 8.2.3-8015; no workaround is listed.
- Federal agencies were ordered to remediate by November 20, 2026.
- Ryan Harris of Electronic Office discovered and reported the flaw.
- The same releases fix six other vulnerabilities not flagged as exploited.
Timeline
dated events in the reporting · oldest first- Nov 6, 2026CISA added CVE-2026-19868 to the KEV catalog · Canadian Centre for Cyber Security
- Nov 20, 2026Federal agencies ordered to remediate the flaw · BleepingComputer
What each outlet adds
beyond the shared facts- Canadian Centre for Cyber SecurityStates the vendor says the flaw is being exploited.
- Security AffairsGives CVSS 7.5 and says PSIRT is investigating possible exploitation.
- SecurityWeekLists Gen7 and Gen8 families and CVSS 7.1.
- Help Net SecurityNames Electronic Office and notes Gen6 is unsupported, not listed.
- BleepingComputerReports the November 20 federal patch deadline and seven fixes.
- Vendors
- SonicWall
- Products
- SonicOSSonicOS SSLVPN
- Organizations
- CISACanadian Centre for Cyber Security
- Countries
- United States
Coverage
oldest first · one row per article · UTC- · 6d ago
Canadian Centre for Cyber SecurityFirst report
SonicWall SonicOS prior to 7.3.4-7013 and 8.2.2-8015 affected by exploited CVE-2026-19868
CISA added CVE-2026-19868 to KEV Catalog on November 6, 2026; SonicWall SonicOS versions prior to 7.3.4-7013 and 8.2.2-8015 are being exploited.
- · 6d ago
BleepingComputer
SonicWall SSL-VPN MFA bypass flaw exploited in attacks
CISA added CVE-2026-19868 to KEV after exploitation; affects SonicOS SSL-VPN with SAML MFA
- · 5d ago
Security Affairs
CISA adds SonicWall SSLVPN flaw to KEV catalog
CISA adds CVE-2026-19868 authentication bypass to KEV catalog.
- · 5d ago
SecurityWeek
SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
SonicWall patches CVE-2026-19868 that bypasses SAML and MFA in SSL VPN after exploitation; CISA added it to KEV with federal deadline November 20.
- · 5d ago
Cyber Security News
SonicWall warns of SSLVPN flaw bypassing MFA
CVE-2026-19868 in SonicOS SSLVPN allows credentialed attackers to bypass SAML and MFA when enabled; fix available in versions 7.3.4-7013 and 8.2.3-8015.
- · 3d ago
The Hacker News
CISA adds SonicWall SonicOS MFA bypass to KEV catalog
CISA urges FCEB agencies to patch by November 20, 2026; possible exploitation reported
- · 3d ago
GBHackers
SonicWall SSL-VPN vulnerability bypasses SAML and MFA
SonicWall SSL-VPN auth bypass CVE-2026-19868 affects Gen7 and Gen8 SonicOS, fixed in 7.3.4-7013 and 8.2.3-8015.
- · 3d ago
Help Net Security
Exploited SonicWall SSL-VPN flaw bypasses SAML-enforced MFA
Attackers with valid alternate credentials can skip SAML MFA; federal agencies must remediate by November 20, 2026.
- · 3d ago
CISA Warns of SonicWall SonicOS SSLVPN Vulnerability Exploited in Attacks
CISA added a SonicWall SonicOS SSLVPN vulnerability to its Known Exploited Vulnerabilities catalog, warning of bypasses of SAML and MFA.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107154 | Session validation vulnerability in SonicOS management interface | 8.8 | — | ||
CVE-2026-107155+1 related CVE | Permissive cross-domain policy in SonicOS management interface | 8.8 group max | — | ||
| CVE-2026-19868 | SAML bypass in SonicWall SonicOS SSLVPN | 7.5 | <1% | KEVPoC | KEV |