CVE-2026-19868

CVE Enrichment

CVSS: 7.5 HIGH
CISA KEV: Not listed

Description

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 07-Nov-2026 02:17
Last Modified: 07-Nov-2026 04:17
CWE: CWE-308

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:N /
                            UI:N /
                            S:C /
                            C:H /
                            I:L /
                            A:N

CNA Products / Version Status

SonicWall · SonicOS Source: CNA · [email protected]
Default status: unknown

7.3.3-7015 and older versions — affected
8.2.2-8015 and older versions — affected

Platforms: Gen7, Gen8

References

Last enrichment sync: 07-Nov-2026 04:34
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

Tracked as CVE-2026-19868, the flaw affects the SSL VPN component of SonicOS, the operating system that runs on SonicWall firewalls. SonicWall Patches SonicOS Flaw That Can Bypass SAML and MFA
CVE-2026-19868 SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability CISA Adds Actively Exploited SonicWall SonicOS SSLVPN Vulnerability to KEV Catalog
The vulnerability, tracked as CVE-2026-19868, allows attackers with valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially including SAML-enforced multi-factor SonicWall Patches Exploited SonicOS SSL-VPN SAML Authentication Bypass

CVE (1)

People (1)

Vendors (1)

Products (2)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.