CISA lists SonicWall SonicOS SSLVPN SAML bypass CVE-2026-19868 as exploited
A user with valid credentials for another login method can sidestep SAML, and SAML-enforced MFA, on the SonicOS SSLVPN service; CISA now lists it as exploited.
What CISA added
On 2026-11-06 CISA added CVE-2026-19868 to its KEV catalog of known exploited vulnerabilities. The entry is named “SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability” and is classed as CWE-308. Known ransomware campaign use is listed as Unknown.
The timeline is short. The NVD record was published on 2026-11-06, the same day as the KEV listing, and NVD gives its status as Undergoing Analysis. For US federal civilian agencies bound by BOD 22-01, the due date is 2026-11-20.
How the flaw works
The KEV description and the NVD description tell the same story in slightly different words. NVD calls it “an authentication enforcement vulnerability in SonicOS SSLVPN service”. The affected product is the SSLVPN service in SonicWall SonicOS.
The condition is specific. The attacker is “a user with valid credentials for an alternate authentication method”. Such a user may be able to bypass SAML authentication controls on the SSLVPN service. Both descriptions add that successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
That explains the CWE-308 label, use of single-factor authentication. Where SAML is the layer that enforces MFA for SSLVPN logins, a valid credential for the alternate method may be enough on its own, which is the single-factor outcome the CWE describes. The descriptions do not say which alternate methods are involved or which SonicOS versions are affected; the vendor advisory SNWLID-2026-0014, linked from both the KEV notes and the NVD references, is the place to look for that.
Severity
The only CVSS score in the record is a secondary one: CVSS 3.1 base score 7.5 HIGH, with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N. Read field by field, that is a network attack vector, high attack complexity, no privileges required, no user interaction, changed scope, high impact on confidentiality, low impact on integrity and no impact on availability.
The no-privileges-required field (PR:N) sits next to a description that assumes valid credentials for an alternate authentication method; the record does not explain that pairing. The KEV listing records that CISA treats the flaw as exploited.
What to do
The required action is to apply mitigations in accordance with vendor instructions, following CISA’s BOD 26-04 guidance on prioritizing security updates based on risk and its “Forensics Triage Requirements”. Where mitigations are unavailable, the guidance is to discontinue use of the product, and stakeholders are responsible for evaluating each asset’s internet exposure.
For teams running SonicOS SSLVPN with SAML, two checks follow from the descriptions. First, read SNWLID-2026-0014 for the affected versions and fix. Second, review which other authentication methods are still enabled for SSLVPN users alongside SAML, since a valid credential for one of them is the precondition the descriptions name.
Source: CVE-2026-19868 (NVD, CISA KEV)