CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on 6 November 2026, describing SonicWall SonicOS SSLVPN as containing a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls, and that successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA); CISA lists CWE-308, known ransomware campaign use Unknown, forensic triage No, and a US federal due date of 20 November 2026, and points to SonicWall advisory SNWLID-2026-0014. (source: CISA KEV)

BleepingComputer, reporting on 6 November 2026 and quoting SonicWall, says SonicWall released updates fixing seven SonicOS flaws including this SSL-VPN authentication bypass (CVSS 7.1 per that report), that the flaw only affects SonicOS SSL-VPN services configured to use SAML, that SonicWall PSIRT investigated a report of potential exploitation and urged upgrades with no workarounds, that Ryan Harris of The Electronic Office discovered and reported it, and that affected builds are Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier, fixed in 7.3.4-7013 and 8.2.3-8015; BleepingComputer also notes six other SonicOS fixes in the same advisory (including two management-interface flaws it rates 8.8). Desk could not read SonicWall's SNWLID-2026-0014 page as prose (JS app shell). (source: BleepingComputer)

Correction (08 Nov 2026): The card previously gave CVSS 7.1 per BleepingComputer quoting a SonicWall advisory. BleepingComputer reports a CVSS of 7.1 without quoting a SonicWall figure, and SonicWall's CNA CVE record publishes no CVSS metric. CISA-ADP enrichment on the CVE record scores CVE-2026-19868 as CVSS 3.1 base 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) (source: CVE record (CISA-ADP))