CVE-2026-19868, a flaw in the SSL VPN (the VPN used to connect from outside into a company network) of SonicWall's firewall OS SonicOS, was added to the KEV catalog of CISA, the US cybersecurity agency, on November 6, 2026. KEV lists vulnerabilities that have actually been exploited. According to the NVD description, a user with valid credentials for an alternate authentication method (such as an ID and password) may be able to bypass SAML authentication controls (SAML is the mechanism that signs you in through a company's identity system). On success, SAML-enforced multi-factor authentication (MFA) may be bypassed too.
Ask your network administrator whether your organization uses it. The flaw concerns SonicWall firewalls (SonicOS) whose SSL VPN uses SAML for authentication. Personal PCs and phones are not affected. In the CVE record that SonicWall itself registered (the official CVE record), the affected builds are SonicOS on Gen7 and Gen8: "7.3.3-7015 and older" and "8.2.2-8015 and older." The Canadian Centre for Cyber Security advisory (AV26-1133) instead says "before 7.3.4-7013 and before 8.2.2-8015," so the two differ on whether 8.2.2-8015 itself is included. If you run 8.2.2-8015, do not assume you are safe.
Where the score comes from: 7.5 (CVSS v3.1) is the assessment by CISA (CISA-ADP) shown in NVD. The vector reads: network, high attack complexity, no privileges, no user interaction, changed scope, high confidentiality impact, low integrity impact. When we retrieved NVD's data (API) on the morning of November 9, the status was "Undergoing Analysis" and the only metric shown was this CISA assessment (we saw no NIST score). This number may change once NIST adds its own score.
What is happening (as far as published)
- ▸CVE-2026-19868: NVD describes an authentication-enforcement flaw in the SonicOS SSL VPN service. A user with valid credentials for an alternate authentication method may bypass SAML authentication controls, and SAML-enforced MFA may be bypassed as well. The weakness type is use of single-factor authentication (CWE-308). It is not described as a flaw that lets someone with no credentials walk straight in
- ▸CISA KEV: added November 6, with a due date of November 20 (a deadline for US federal agencies). Ransomware use is listed as "Unknown." CISA's SSVC assessment is exploitation "active," automatable "no," technical impact "partial"
- ▸SonicWall's CVE record: the affected product is SonicOS on Gen7 and Gen8, with builds "7.3.3-7015 and older" and "8.2.2-8015 and older." Canadian advisory (AV26-1133): dated November 6, it says SonicWall indicates that CVE-2026-19868 is being exploited and lists affected builds as before 7.3.4-7013 and before 8.2.2-8015. We could not read SonicWall's own advisory (SNWLID-2026-0014) (see "What we could not confirm" below)
What to do today
- ✓★Check your SonicOS build. On Gen7 and Gen8, SonicWall's CVE record lists 7.3.3-7015 and older (7.3 line) and 8.2.2-8015 and older (8.2 line) as affected. The Canadian advisory treats 8.2.2-8015 differently, so treat 8.2.2-8015 as affected. Confirm the final affected and fixed builds in SonicWall's advisory (SNWLID-2026-0014).
- ✓★Update to a fixed build. Back up the configuration first and pick a window when downtime is acceptable. We have not confirmed which build is the fixed one. Confirm it in SonicWall's advisory
- ✓Review your SSL VPN authentication settings. If you use SAML, check whether users can still sign in to the SSL VPN with another method (for example local users). (This is our suggestion, not a step SonicWall published)
- ✓Review sign-in logs. Look for sign-ins that did not go through SAML and for sign-ins nobody recognizes. If you find something suspicious, change passwords and contact your administrator or a specialist quickly (same caveat)
- ✓Put internet-facing VPN devices first. Vulnerabilities in KEV are being attacked in the real world
If you cannot update right away
We could not confirm any workaround or mitigation published by SonicWall, so we cannot present an official procedure here. Until you can update, check SonicWall's advisory for a workaround and follow it if there is one. One general measure while you wait: if you can restrict who may reach the SSL VPN to your partners and staff, doing so helps (this is our general advice, not an official mitigation for this flaw).
What we could not confirm
- ▸The text of SonicWall's advisory (SNWLID-2026-0014). The page is built for on-screen display and we could not retrieve its contents. The affected builds come from SonicWall's CVE record and the Canadian advisory (AV26-1133)
- ▸A workaround or mitigation, and a list of fixed builds. Not in the sources we could confirm. We could not confirm in an official advisory whether 8.2.2-8015 is affected (SonicWall's CVE record) or fixed (one reading of the Canadian advisory)
- ▸Scale of attacks and attacker identity. The sources we confirmed had no counts or attacker information
- ▸Damage in Japan. We cannot show it in this article
- ▸A NIST score. NVD showed "Undergoing Analysis" and only CISA's assessment when we retrieved it on the morning of November 9
Three lines to share
- ▸CVE-2026-19868 in SonicWall SonicOS (SSL VPN) was added to CISA's "known exploited" catalog (KEV) on November 6. SAML authentication, and MFA enforced through SAML, may be bypassed
- ▸★Check your Gen7/Gen8 SonicOS build; 7.3.3-7015 and older or 8.2.2-8015 and older counts as affected, so prepare to update. Ask the VPN administrator whether SAML is in use (confirm the fixed build in SonicWall's advisory)
- ▸We have not confirmed an official workaround. Update first, and review sign-in logs too