An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate…
Affects SonicWall SonicOS with the SSLVPN service where SAML authentication is enforced; a user with valid credentials for an alternate method can bypass it. No fixed version is listed in the facts.
Written by anthropic/claude-sonnet-5.5 from the sources below. Verify against them.
- Exploited
- Yes, on CISA KEV
- Fix
- No fix listed
- Who is exposed
- Not reported
Do first: Workaround: The facts list no workaround. Pending a fix, one option is to limit the affected setup, such as reviewing which alternate authentication methods are available for SSLVPN, but the facts do not confirm this as an official mitigation. Check SonicWall's advisory for guidance.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 75/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: active
- Automatable: no
- Technical impact: partial
Summary
SonicOS's SSLVPN service has a flaw that lets someone who holds valid credentials for a different login method bypass SAML authentication, including any multi-factor authentication enforced through SAML. This bug is being exploited in attacks, as it is listed in CISA's Known Exploited Vulnerabilities catalog.
Read the original description
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
cve.now Index
- Exploitation40/40Listed in CISA's Known Exploited Vulnerabilities catalog
- Exposure22/25Actively exploited, reachable over the network without a login
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.5/10CVSS 7.5
- No patch5/5No patch listed yet
What to do
Workaround: The facts list no workaround. Pending a fix, one option is to limit the affected setup, such as reviewing which alternate authentication methods are available for SSLVPN, but the facts do not confirm this as an official mitigation. Check SonicWall's advisory for guidance.
Fix it by , CISA's deadline for US federal agencies.
Timeline
- cve.now early warning
CISA adds SonicWall SonicOS SSLVPN flaw CVE-2026-19868 to KEV catalog
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CVE published
- First seen by cve.now
- Posted on X by cve.now
- CISA SSVC assessment
Exploitation: active · Automatable: no · Technical impact: partial
- Record last updated14 days
- CISA remediation deadline
Due date for US federal agencies to patch
Affected versions
- SonicWall SonicOS
Version range not reported
Evidence 2
- Advisory
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-19868
Is CVE-2026-19868 being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-11-06, which means it has evidence of attacks. US federal agencies must fix it by 2026-11-20. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What does this mean?
The SonicOS SSLVPN service can let a user who holds valid credentials for an alternate authentication method bypass SAML authentication controls. This may also bypass multi-factor authentication (MFA) that SAML enforces.Source: cisa.gov
Am I affected, and how do I check?
The facts name SonicWall SonicOS with the SSLVPN service, in a setup where SAML authentication is enforced and an alternate authentication method with valid credentials exists. No specific version ranges are given. A reader can check the SonicOS version and whether SSLVPN uses SAML and any alternate authentication methods in the SSLVPN configuration.Source: cisa.gov
How do I fix CVE-2026-19868?
The facts give no fixed version or workaround. Check SonicWall's advisory for CVE-2026-19868 for patch and mitigation guidance.Source: cisa.gov
What if there's no patch?
The facts list no workaround. Pending a fix, one option is to limit the affected setup, such as reviewing which alternate authentication methods are available for SSLVPN, but the facts do not confirm this as an official mitigation. Check SonicWall's advisory for guidance.Source: cisa.gov