CVE-2026-19868

What it is. SonicWall describes an authentication enforcement flaw in the SonicOS SSL VPN service. The attacker must be "a user with valid credentials for an alternate authentication method," and successful exploitation "may also bypass SAML-enforced multi-factor authentication (MFA)." SonicWall credits Ryan Harris of The Electronic Office.

Who is affected, per SonicWall.

• Gen7 hardware firewalls (TZ, NSa and NSsp models) and Gen7 NSv 270, 470 and 870 on SonicOS 7.3.3-7015 and older.
• Gen8 hardware firewalls (TZ and NSa models) and Gen8 NSv XS, S, M and L on SonicOS 8.2.2-8015 and older.
• NSv on ESX, KVM, Hyper-V, AWS and Azure is included. Match each appliance against the model list in SNWLID-2026-0014.

1. Check which build is running. Record the model, generation and running SonicOS build for each appliance, including virtual ones, and compare it to the fixed versions below. Confirm the fixed build is running after the upgrade.
2. Check whether SAML is on for SSL VPN logins. Look at the SSL VPN authentication settings specifically. If SAML is off for SSL VPN logins, SonicWall says this flaw does not affect that interface or service.
3. Check which accounts have another way in. Review which accounts can sign in to the SSL VPN through a method other than SAML. SonicWall doesn't name those methods in its advisory.
4. Check who can reach the SSL VPN. Review the listener, interfaces, routing and access rules, and confirm exposure from the networks an attacker could use. An internal network counts too.

Fixed versions. SonicOS 7.3.4-7013 and higher for Gen7, and 8.2.3-8015 and higher for Gen8.

Other flaws in the same update. The same advisory and fix cover CVE-2026-82308, a pre-authentication heap overflow in the SSL VPN service that SonicWall says could let a remote unauthenticated attacker cause an application-level denial of service (7.5). It also covers CVE-2026-107154 and CVE-2026-107155 (management interface), CVE-2026-77708 and CVE-2026-77709 (TACACS+ client) and CVE-2026-19703 (weak password hashing). Only CVE-2026-19868 carries SonicWall's exploitation note, and none of the other six is on CISA KEV as of November 6.

SonicWall lists no workaround. Upgrading SonicOS is the fix.

SonicWall's advisory publishes no indicators of compromise, log signatures or compromise checks for this CVE. CISA's KEV entry lists ransomware use as "Unknown" and the forensic triage flag as "No."

Is CVE-2026-19868 being exploited?

CISA added it to KEV on November 6, 2026, due November 20. SonicWall says "SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability." CISA lists ransomware use as "Unknown."

Can an attacker use it without a password?

No, per SonicWall. The attacker must be "a user with valid credentials for an alternate authentication method." The flaw lets that user get past SAML and SAML-enforced MFA.

Am I affected if SAML is off for SSL VPN logins?

No. SonicWall says the flaw "ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins."

Is there a patch?

Yes. SonicOS 7.3.4-7013 and higher on Gen7, and 8.2.3-8015 and higher on Gen8. The same update fixes the six other CVEs in SNWLID-2026-0014.

Is there a workaround?

No. SonicWall's workaround section says "None."

I patched late. Does that prove I was not compromised?

No. Upgrading doesn't undo a login that already happened, and the sources don't say when exploitation started. SonicWall gives no compromise-check procedure for this CVE.

Nov 6, 2026. First published. CISA added it to KEV on Nov 6 with a Nov 20 due date.

• SonicWall advisory SNWLID-2026-0014 (Nov 6, 2026)
• CISA Known Exploited Vulnerabilities catalog (checked Nov 6)
• NIST NVD, CVE-2026-19868 (Undergoing Analysis, CISA-ADP 7.5 as a secondary score, checked Nov 6)