CISA has added a SonicWall SSLVPN authentication bypass vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming that attackers have exploited a flaw capable of defeating SAML authentication controls, including multi-factor authentication (MFA).
Tracked as CVE-2026-19868, the vulnerability affects SonicWall's SonicOS firewall software.
CISA added it to the KEV catalog on Nov. 6, giving federal civilian agencies until Nov. 20 to remediate affected systems.
The flaw is particularly concerning for organizations relying on SAML-based MFA to protect remote access. An attacker with valid credentials for an alternative authentication method may be able to bypass those additional protections.
How CVE-2026-19868 bypasses SonicWall authentication
According to SonicWall's security advisory, CVE-2026-19868 is an authentication enforcement vulnerability in the SonicOS SSLVPN service.
Successful exploitation may allow someone holding valid credentials for another authentication method to bypass SAML authentication controls and SAML-enforced MFA.
The vulnerability does not mean an unauthenticated attacker can automatically access any affected firewall. The attack requires valid credentials for an alternative authentication method, and the SAML authentication configuration is central to the exposure.
That distinction separates CVE-2026-19868 from vulnerabilities involving session hijacking or unauthenticated remote access.
The flaw also differs from the SonicOS SSLVPN vulnerability disclosed in November 2025, which could allow unauthenticated attackers to crash affected firewalls.
SonicWall addressed CVE-2026-19868 alongside six other vulnerabilities in advisory SNWLID-2026-0014. The broader update includes fixes for management-interface weaknesses and denial-of-service vulnerabilities.
Although CISA has confirmed exploitation, publicly available information does not establish who was targeted, how attackers obtained the necessary credentials, or whether the vulnerability was used in a wider campaign.
Affected SonicOS versions and required updates
SonicWall identifies the following affected firmware versions:
- Gen 7 firewalls: SonicOS 7.3.3-7015 and earlier.
- Gen 8 firewalls: SonicOS 8.2.2-8015 and earlier.
The corresponding fixed releases are SonicOS 7.3.4-7013 or later for supported Gen 7 platforms and SonicOS 8.2.3-8015 for Gen 8 platforms.
Administrators should verify their exact appliance model before upgrading. SonicWall's initial Gen 7 release notes specify that SonicOS 7.3.4 was not yet available for NSv virtual firewalls, making platform-specific availability an important consideration.
The company has published firmware upgrade guidance covering affected generations, supported releases, and the status of older appliances.
Gen 6 and older firewalls have reached end of support and do not receive these firmware updates. Organizations still operating those devices should evaluate supported replacement hardware.
What administrators should do now
Security teams should prioritize the following actions:
- Identify affected appliances. Inventory SonicWall firewalls, record their firmware versions, and determine whether SSLVPN and SAML authentication are enabled.
- Install the appropriate firmware. Apply the latest supported security release for each affected platform rather than addressing only CVE-2026-19868.
- Review authentication activity. Investigate unusual SSLVPN logins, unexpected authentication methods, unfamiliar source addresses, and suspicious configuration changes.
- Assess credential exposure. Review potentially compromised accounts and rotate credentials where investigation identifies a risk.
- Preserve forensic evidence. Retain relevant authentication logs and configuration records before making changes that could affect an investigation.
Credential review is particularly relevant given SonicWall's previous firewall backup exposure, which prompted the company to recommend credential resets in September 2025. No public evidence establishes a connection between that incident and CVE-2026-19868.
CISA sets Nov. 20 remediation deadline
CISA's KEV designation establishes that CVE-2026-19868 has been exploited in real-world attacks, rather than representing only a theoretical vulnerability.
Under Binding Operational Directive 26-04, covered federal civilian agencies must follow the applicable remediation and forensic triage requirements by Nov. 20.
Private organizations are not subject to the same federal deadline, but they face the same underlying vulnerability when operating affected configurations.
Patching closes the documented authentication bypass. It does not establish whether an attacker previously accessed the environment.
Organizations should therefore treat firmware updates and compromise assessment as separate tasks, particularly where exposed VPN services provide access to sensitive internal systems.
Also read: SonicWall's earlier SMA1000 zero-day vulnerabilities involved a different remote-access product and attack mechanism, with two exploited flaws that could be chained for remote code execution.