CISA adds SonicWall SonicOS SSLVPN flaw to the KEV catalog, CVE-2026-19868

CISA added SonicWall SonicOS SSLVPN CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on November 6, 2026, with a federal remediation due date of November 20, 2026. The flaw is a use of single-factor authentication vulnerability, CWE-308, in the SonicOS SSLVPN service: a user with valid credentials for an alternate authentication method can bypass SAML authentication controls, and successful exploitation may also bypass SAML-enforced multi-factor authentication. It affects Gen7 SonicOS 7.3.3-7015 and older and Gen8 8.2.2-8015 and older, only where SAML is enabled for SSLVPN logins. CISA lists known ransomware use as Unknown and does not require forensic triage for this entry. The catalog now shows 1,769 entries.

SonicWall advisory SNWLID-2026-0014 confirms real-world abuse of the flaw, and SecurityOnline reports that no workarounds exist. The fixed releases are Gen7 SonicOS 7.3.4-7013 or later and Gen8 SonicOS 8.2.3-8015 or later. Administrators should upgrade affected firewalls, audit SSLVPN authentication methods for alternate login paths that do not enforce SAML and MFA, and review logs for logins that skipped the identity provider.

Sources: CISA; SecurityOnline; WindowsForum