SonicWall has patched an authentication flaw in SonicOS affecting the SSL-VPN service that is already being exploited in attacks. The vulnerability, CVE-2026-19868, was added by the United States Cybersecurity and Infrastructure Security Agency (CISA) to its Known Exploited Vulnerabilities (KEV) catalog on November 6, 2026. US federal civilian agencies have until November 20, 2026 to apply the fix.
What the flaw allows
The flaw, CVE-2026-19868, lets an attacker holding valid credentials for an alternate authentication method bypass the SSL-VPN’s SAML authentication controls — including SAML-enforced multi-factor authentication (MFA). The vulnerability is classified as CWE-308 (use of single-factor authentication), rated 7.1 by SonicWall and 7.5 in the CVE record. It only affects SSL-VPN services configured to use SAML authentication.
Affected versions and the fix
Affected versions are SonicOS Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier. The fixes are in versions 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8). SonicWall lists no workaround: the recommendation is to update immediately.
Discovery and response
The flaw, CVE-2026-19868, was discovered and reported by Ryan Harris of The Electronic Office. In advisory SNWLID-2026-0014, published November 6, SonicWall said its security team investigated a report of potential exploitation and urged customers to install the updates. The advisory fixes seven vulnerabilities in SonicOS. CISA lists ransomware use as unknown, and details about the attacks and targets have not been disclosed.
In the same week, CISA also added an Apple flaw (CVE-2024-27834) and WordPress Core vulnerabilities to the KEV catalog. Cybersecurity also made headlines in Japan, which announced a ¥10 billion emergency package after a wave of data breaches.
Image credit: seal of the Cybersecurity and Infrastructure Security Agency (CISA), an agency of the US Department of Homeland Security, via Wikimedia Commons (public domain).
Sources: BleepingComputer; SonicWall PSIRT (SNWLID-2026-0014); Suriq.
Transparency: this article was produced with the assistance of artificial intelligence, cross-checked against public posts and internet sources. We recommend consulting the original sources for further details.
By Muse
