---
title: CISA KEV: SonicWall SonicOS SSLVPN CVE-2026-19868 — valid alternate-method credentials can bypass SAML and SAML-enforced MFA | ctxsec
url: https://ctxsec.com/items/cisa-kev-cve-2026-19868-sonicwall-sonicos-sslvpn-saml-mfa-bypass-nov-6
description: "CISA added CVE-2026-19868 to the Known Exploited Vulnerabilities catalog on Nov 6 (catalog 2026.11.06, federal due Nov 20). SonicWall's CNA record describes an authentication-enforcement flaw in the SonicOS SSLVPN service: a user with valid credentials for an alternate authentication method may bypass SAML controls, and that bypass can also skip SAML-enforced MFA. Affected builds named in the CVE: Gen7 SonicOS 7.3.3-7015 and older, Gen8 8.2.2-8015 and older. CISA's ADP scoring marks Exploitation as active. Apply SNWLID-2026-0014 and BOD 26-04 guidance; the public CVE record does not yet list a fixed build string, so confirm the current firmware on SonicWall's advisory before upgrading."
status: "official (CISA KEV catalog 2026.11.06, added Nov 6, due Nov 20; SonicWall CNA CVE record / SNWLID-2026-0014); CISA ADP marks Exploitation: active; ransomware use Unknown"
published: 2026-11-06
---

> CISA added CVE-2026-19868 to the Known Exploited Vulnerabilities catalog on Nov 6 (catalog 2026.11.06, federal due Nov 20). SonicWall's CNA record describes an authentication-enforcement flaw in the SonicOS SSLVPN service: a user with valid credentials for an alternate authentication method may bypass SAML controls, and that bypass can also skip SAML-enforced MFA. Affected builds named in the CVE: Gen7 SonicOS 7.3.3-7015 and older, Gen8 8.2.2-8015 and older. CISA's ADP scoring marks Exploitation as active. Apply SNWLID-2026-0014 and BOD 26-04 guidance; the public CVE record does not yet list a fixed build string, so confirm the current firmware on SonicWall's advisory before upgrading.

[← Cybersecurity News](/news) · [markdown](/items/cisa-kev-cve-2026-19868-sonicwall-sonicos-sslvpn-saml-mfa-bypass-nov-6.md)

official (CISA KEV catalog 2026.11.06, added Nov 6, due Nov 20; SonicWall CNA CVE record / SNWLID-2026-0014); CISA ADP marks Exploitation: active; ransomware use Unknown

2026-11-06

### CISA KEV: SonicWall SonicOS SSLVPN CVE-2026-19868 — valid alternate-method credentials can bypass SAML and SAML-enforced MFA

- **Who cares:** any org running SonicWall Gen7/Gen8 SSLVPN with SAML (and especially SAML-tied MFA) in the named build ranges.
- **Do now:** inventory SSLVPN firmware; open `SNWLID-2026-0014` and install the vendor-stated fix; review recent SSLVPN logins for unexpected local/LDAP/RADIUS successes that should have been SAML-only; rotate credentials for accounts that can hit the VPN.
- **Note:** this still needs valid credentials for some auth method — it is not a no-auth RCE — but it defeats SAML/MFA policy that many teams treat as the hard gate.
- SSHole (CVE-2026-123158) is still **not** in KEV as of this catalog refresh.

Sources: [CISA Known Exploited Vulnerabilities Catalog (CVE-2026-19868, added Nov 6)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) · [CISA KEV JSON feed (catalogVersion 2026.11.06)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) · [SonicWall PSIRT: SNWLID-2026-0014](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014) · [CVE Program: CVE-2026-19868 (SonicWall CNA)](https://www.cve.org/CVERecord?id=CVE-2026-19868)