CISA adds exploited SonicWall SSLVPN flaw CVE-2026-19868

CISA added CVE-2026-19868 to its known exploited catalog on November 6. The flaw is in SonicWall SonicOS SSLVPN, and the catalog due date is November 20.

SonicWall says the bug can skip SAML checks. The company describes an authentication-enforcement issue in the SSLVPN service. A person who already has valid credentials for a different login method may get around SAML controls. The same path may also get around multi-factor authentication that SAML is set to require. SonicWall scores this flaw 7.1. Its vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N. The advisory's top score of 8.8 belongs to other flaws in the same notice, not to this CVE.

The company says it looked into a report of possible exploitation. SonicWall PSIRT says that review covered a report indicating potential exploitation, and it urges customers to move to the newest release. The notice says the issue applies only when SAML is turned on for SSLVPN logins. CISA lists ransomware use as unknown.

Fixed builds are 7.3.4-7013 and 8.2.3-8015. SonicWall says Gen7 hardware firewalls and Gen7 NSv virtual appliances at 7.3.3-7015 and older are affected. Gen8 hardware firewalls and Gen8 NSv appliances at 8.2.2-8015 and older are affected. The fixed lines are 7.3.4-7013 and later for Gen7, and 8.2.3-8015 and later for Gen8. The advisory names the models in those generations.

A temporary step exists if the firmware cannot be changed yet. SonicWall says that if SAML is in use, administrators can disable or remove active+ servers on the firewall. That workaround section was updated on November 9. The advisory, SNWLID-2026-0014, was first published on November 6. Ryan Harris of The Electronic Office is credited for this CVE.