StoryVulnerabilityhighExploited in the wild

CISA Adds SonicWall SSLVPN MFA Bypass Flaw to KEV

9 sources · 10 articlesFirst reported Nov 6, 2026 · 00:00 UTCUpdated Nov 9, 2026 · 11:40 UTC (5h ago)1

What's new

November 9: Help Net Security and Cyber Security News add discovery by Ryan Harris, CWE-308 classification, and lack of published attack indicators.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

SonicWall patches exploited CVE-2026-19868 SSLVPN flaw bypassing SAML MFA; CISA KEV added November 6.

SonicWall SonicOS SSLVPN contains CVE-2026-19868, an authentication enforcement vulnerability that allows users with valid credentials for an alternate method to bypass SAML controls and any associated MFA when SAML is enabled. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 6, 2026, after reports of potential exploitation. SonicWall released patches on November 7 fixing the issue in versions 7.3.4-7013 and 8.2.3-8015 for Gen7 and Gen8 firewalls, also addressing six other vulnerabilities. Federal agencies must remediate by November 20, 2026. No attack details or workarounds are available.

Key facts

CVE-2026-19868 bypasses SAML-enforced MFA in SonicOS SSLVPN
Fixed in SonicOS 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8)
CISA KEV addition: November 6, 2026
Patch deadline: November 20, 2026
Discovered by Ryan Harris
Affects only SAML-configured SSLVPN on Gen7/Gen8

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first

Nov 6, 2026CISA adds CVE-2026-19868 to KEV catalog · CISA
Nov 7, 2026SonicWall releases advisory and patches · SonicWall
Nov 20, 2026Federal agencies must apply mitigations · CISA

What each outlet adds

beyond the shared facts

BleepingComputerDiscovered by Ryan Harris; fixes seven vulnerabilities including the main flaw
SecurityWeekCVSS score 7.1; specific impacts on Gen7 and Gen8 firewalls
Help Net SecurityDiscovered by Ryan Harris; no indicators or attack details published; fixes six other vulnerabilities
Cyber Security NewsCVE-2026-19868 classified as CWE-308; no indicators published
Canadian Centre for Cyber SecurityAdvisory AV26-1133; confirms exploitation status

CVEs: CVE-2026-19868 CVE-2026-107155 CVE-2026-107154 CVE-2026-82308

Vendors: SonicWall
Products: SonicOS SonicOS SSLVPN
Organizations: CISA Canadian Centre for Cyber Security
Countries: United States

Coverage

oldest first · one row per article · UTC

Nov 6, 00:00 UTC · 3d ago CISA Known Exploited VulnerabilitiesFirst report
SonicWall SonicOS SSLVPN SAML bypass vulnerability (CVE-2026-19868)
SonicWall SonicOS SSLVPN allows users with valid credentials to bypass SAML authentication and multi-factor controls.
Nov 6, 21:00 UTC · 2d ago Canadian Centre for Cyber Security
SonicWall SonicOS prior to 7.3.4-7013 and 8.2.2-8015 affected by exploited CVE-2026-19868
CISA added CVE-2026-19868 to KEV Catalog on November 6, 2026; SonicWall SonicOS versions prior to 7.3.4-7013 and 8.2.2-8015 are being exploited.
Nov 7, 00:00 UTC · 2d ago BleepingComputer
SonicWall SSL-VPN MFA bypass flaw exploited in attacks
CISA added CVE-2026-19868 to KEV after exploitation; affects SonicOS SSL-VPN with SAML MFA
Nov 7, 09:09 UTC · 2d ago Security Affairs
CISA adds SonicWall SSLVPN flaw to KEV catalog
CISA adds CVE-2026-19868 authentication bypass to KEV catalog.
Nov 7, 10:16 UTC · 2d ago SecurityWeek
SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
SonicWall patches CVE-2026-19868 that bypasses SAML and MFA in SSL VPN after exploitation; CISA added it to KEV with federal deadline November 20.
Nov 7, 12:59 UTC · 2d ago Cyber Security News
SonicWall warns of SSLVPN flaw bypassing MFA
CVE-2026-19868 in SonicOS SSLVPN allows credentialed attackers to bypass SAML and MFA when enabled; fix available in versions 7.3.4-7013 and 8.2.3-8015.
06:05 UTC · 11h ago The Hacker News
CISA adds SonicWall SonicOS MFA bypass to KEV catalog
CISA urges FCEB agencies to patch by November 20, 2026; possible exploitation reported
06:20 UTC · 10h ago GBHackers
SonicWall SSL-VPN vulnerability bypasses SAML and MFA
SonicWall SSL-VPN auth bypass CVE-2026-19868 affects Gen7 and Gen8 SonicOS, fixed in 7.3.4-7013 and 8.2.3-8015.
10:30 UTC · 6h ago Help Net Security
Exploited SonicWall SSL-VPN flaw bypasses SAML-enforced MFA
Attackers with valid alternate credentials can skip SAML MFA; federal agencies must remediate by November 20, 2026.
11:40 UTC · 5h ago Cyber Security News
CISA Warns of SonicWall SonicOS SSLVPN Vulnerability Exploited in Attacks
CISA added a SonicWall SonicOS SSLVPN vulnerability to its Known Exploited Vulnerabilities catalog, warning of bypasses of SAML and MFA.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-107154	Session validation vulnerability in SonicOS management interface	8.8	—		2d ago
CVE-2026-107155 +1 related CVE CVE-2026-82308	Permissive cross-domain policy in SonicOS management interface	8.8 group max	—		2d ago
CVE-2026-19868	SAML bypass in SonicWall SonicOS SSLVPN	7.5	<1%	KEVPoC	2d ago KEV Nov 6, 2026