Attackers are exploiting SonicWall CVE-2026-19868, a SonicOS SSLVPN flaw that can let someone with valid credentials for an alternate login method get past SAML-enforced multi-factor authentication. SonicWall confirmed the exploitation on November 6, 2026, and CISA added the bug to its Known Exploited Vulnerabilities catalog the same day, setting a November 20 remediation deadline for federal civilian agencies.
The timing leaves little room. SonicWall VPN appliances are common at small and mid-sized US businesses, and organizations without a dedicated security team may not have a patch process that moves in two weeks. That makes this flaw a priority well beyond federal agencies.
What the SonicWall CVE-2026-19868 advisory says
SonicWall's security advisory carries serial AV26-1133 and is dated November 6, 2026. Its advisory ID is SNWLID-2026-0014, published on the company's PSIRT site. A copy of the advisory hosted by defconlevel.com circulates on third-party sites, so the details here draw on those copies and on CVE records. Readers should confirm the fixed build on SonicWall's own PSIRT page before making changes.
A Mallory report says SonicWall reported that CVE-2026-19868, affecting SonicOS, was being exploited. That report and the advisory agree on the core facts: the flaw is in SSLVPN, and it touches the SAML login path.
CISA's action is a separate step with its own clock. The agency added one new vulnerability to its KEV Catalog on November 6, 2026. It has not named an actor, a campaign or the scale of exploitation. The mirrored KEV entry lists known ransomware use as 'Unknown,' according to WindowsForum's summary.
Which SonicWall firewalls are affected
The CVE Threat Intel record and Strix's CVE page list SonicOS 7.3.3-7015 and older, and 8.2.2-8015 and older, as affected. The advisory wording does not match that cleanly. It reads 'prior to 7.3.4-7013' for the 7.x line and 'prior to 8.2.2-8015' for the 8.x line.
| SonicOS line | Affected per CVE record | Fixed-build wording in advisory |
|---|---|---|
| 7.x | 7.3.3-7015 and older | prior to 7.3.4-7013 |
| 8.x | 8.2.2-8015 and older | prior to 8.2.2-8015 |
The exposure also depends on configuration. SecurityOnline reports that the advisory says the bug only affects the SSLVPN interface when SAML is enabled for SSLVPN logins. The site quotes the advisory as saying: "This vulnerability ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins." That wording had not been checked against SonicWall's own page when this story was prepared.
How the SAML MFA bypass works
The CVE record classifies the weakness as use of single-factor authentication, tracked as CWE-308. It describes an authentication enforcement gap. A user with valid credentials for an alternate authentication method may bypass SAML authentication controls, and successful exploitation may also skip SAML-enforced multi-factor authentication.
That sets a real limit on the attack. An attacker needs one set of valid credentials for an alternate login path before the bypass helps. For an organization that reuses passwords or has weak credential hygiene, though, a single stolen login may be enough to reach the VPN without the second factor that the SAML setup was supposed to require.
How to check if SonicWall SSLVPN is enabled
Work through these steps this week rather than waiting for the November 20 date.
- Inventory every SonicWall firewall, including branch-office units and any appliance a managed service provider administers for you.
- Check whether SSLVPN is enabled and whether it accepts connections from the internet.
- Confirm each firewall's firmware against SNWLID-2026-0014 and the PSIRT page, and record the exact build.
- If SAML is enabled for SSLVPN logins, list every login method the SSLVPN accepts and confirm that each one enforces MFA.
- Review authentication logs for SSLVPN sessions that completed without an MFA prompt.
- Until the patch is applied, restrict SSLVPN access to trusted IP addresses. SonicWall gave similar advice in its product notice on SSLVPN and SSH vulnerabilities.
What the November 20 deadline means
Federal civilian agencies have until November 20 to remediate under the KEV listing. CISA's bulletin on BOD 26-04 sets the vulnerability-management requirements that agencies work under, and the agency urges all organizations to prioritize KEV entries. Private companies are not bound by that date, but a KEV listing is CISA's signal that exploitation is confirmed.
Severity scoring is inconsistent, which makes a scanner less reliable here. One tracker lists a CVSS score of 7.5 in a GitHub vulnerability alert. SecurityOnline reports 7.1, and CVE Security says the flaw is not scored. A team that filters only on score could rank this bug too low, so the KEV status should drive the priority.
SonicWall SSLVPN has a track record
This is not the first time SonicWall's remote access has drawn attacks. In 2025, the company's own notice covered CVE-2024-53704, an SSLVPN authentication bypass. It told administrators to limit SSLVPN access or disable it from the internet, and TechRadar reported on that warning at the time.
Ransomware groups have also gone after SonicWall weaknesses. SecurityWeek has reported that the INC Ransomware gang targeted vulnerable SMA1000 appliances to gain root access and move laterally through networks.
The pattern extends across edge devices. CISA recently added Ivanti Connect Secure flaws to the same catalog, and USA 24 has covered a chain that gave attackers root on fully patched Ivanti VPNs. USA 24 has also reported a Zyxel GS1900 zero-day that bypassed a June patch on nearly 1,000 switches. Firewalls and VPN appliances sit at the network edge, where they face the internet and sit outside the endpoint tools many teams rely on.
What remains unconfirmed
- The attacker, the number of compromised devices and any ransomware involvement have not been confirmed.
- The fixed build number is unclear because the advisory wording and the CVE record list different version strings.
- A SecurityOnline report says the advisory also covers CVE-2026-107155 and six other SonicOS fixes. That report has not been confirmed on SonicWall's own page.
- At least one aggregator page still lists the CVE as not in KEV and as 'Info' severity. That page is outdated.
The next signals are concrete. Watch for SonicWall to confirm the fixed build and the scope of the advisory on its PSIRT page, and for CISA to revise the KEV entry if it names an actor or ransomware use. Organizations that run SonicWall SSLVPN should not wait for those answers before checking their logs.
