Skip to content
Threat Feed
Subscribe
medium advisory exploited updated

SonicWall SonicOS SSLVPN: SAML authentication bypass (CVE-2026-19868)

SonicWall SonicOS SSLVPN is vulnerable to a single-factor authentication flaw that may allow users with valid credentials for an alternate authentication method to bypass SAML authentication and SAML-enforced MFA.

CVE search metadata

CVE search record: CVE-2026-19868. KEV: no. Product: SonicOS SSLVPN, SonicOS (Gen7 <= 7.3.3-7015), SonicOS (Gen8 <= 8.2.2-8015), SonicOS (Gen7 TZ, NSa, NSsp, NSv <= 7.3.3-7015), SonicOS (Gen8 TZ, NSa, NSv <= 8.2.2-8015). Brief: SonicWall SonicOS SSLVPN: SAML authentication bypass (CVE-2026-19868). Brief link: https://feed.craftedsignal.io/briefs/2026-11-sonicwall-sslvpn-bypass/

CVE search record: CVE-2026-82308. KEV: no. Product: SonicOS SSLVPN, SonicOS (Gen7 <= 7.3.3-7015), SonicOS (Gen8 <= 8.2.2-8015), SonicOS (Gen7 TZ, NSa, NSsp, NSv <= 7.3.3-7015), SonicOS (Gen8 TZ, NSa, NSv <= 8.2.2-8015). Brief: SonicWall SonicOS SSLVPN: SAML authentication bypass (CVE-2026-19868). Brief link: https://feed.craftedsignal.io/briefs/2026-11-sonicwall-sslvpn-bypass/

CVE search record: CVE-2026-107154. KEV: no. Product: SonicOS SSLVPN, SonicOS (Gen7 <= 7.3.3-7015), SonicOS (Gen8 <= 8.2.2-8015), SonicOS (Gen7 TZ, NSa, NSsp, NSv <= 7.3.3-7015), SonicOS (Gen8 TZ, NSa, NSv <= 8.2.2-8015). Brief: SonicWall SonicOS SSLVPN: SAML authentication bypass (CVE-2026-19868). Brief link: https://feed.craftedsignal.io/briefs/2026-11-sonicwall-sslvpn-bypass/

CVE search record: CVE-2026-107155. KEV: no. Product: SonicOS SSLVPN, SonicOS (Gen7 <= 7.3.3-7015), SonicOS (Gen8 <= 8.2.2-8015), SonicOS (Gen7 TZ, NSa, NSsp, NSv <= 7.3.3-7015), SonicOS (Gen8 TZ, NSa, NSv <= 8.2.2-8015). Brief: SonicWall SonicOS SSLVPN: SAML authentication bypass (CVE-2026-19868). Brief link: https://feed.craftedsignal.io/briefs/2026-11-sonicwall-sslvpn-bypass/

CVE search record: CVE-2026-19703. KEV: no. Product: SonicOS SSLVPN, SonicOS (Gen7 <= 7.3.3-7015), SonicOS (Gen8 <= 8.2.2-8015), SonicOS (Gen7 TZ, NSa, NSsp, NSv <= 7.3.3-7015), SonicOS (Gen8 TZ, NSa, NSv <= 8.2.2-8015). Brief: SonicWall SonicOS SSLVPN: SAML authentication bypass (CVE-2026-19868). Brief link: https://feed.craftedsignal.io/briefs/2026-11-sonicwall-sslvpn-bypass/

CVE search record: CVE-2026-77708. KEV: no. Product: SonicOS SSLVPN, SonicOS (Gen7 <= 7.3.3-7015), SonicOS (Gen8 <= 8.2.2-8015), SonicOS (Gen7 TZ, NSa, NSsp, NSv <= 7.3.3-7015), SonicOS (Gen8 TZ, NSa, NSv <= 8.2.2-8015). Brief: SonicWall SonicOS SSLVPN: SAML authentication bypass (CVE-2026-19868). Brief link: https://feed.craftedsignal.io/briefs/2026-11-sonicwall-sslvpn-bypass/

CVE search record: CVE-2026-77709. KEV: no. Product: SonicOS SSLVPN, SonicOS (Gen7 <= 7.3.3-7015), SonicOS (Gen8 <= 8.2.2-8015), SonicOS (Gen7 TZ, NSa, NSsp, NSv <= 7.3.3-7015), SonicOS (Gen8 TZ, NSa, NSv <= 8.2.2-8015). Brief: SonicWall SonicOS SSLVPN: SAML authentication bypass (CVE-2026-19868). Brief link: https://feed.craftedsignal.io/briefs/2026-11-sonicwall-sslvpn-bypass/

Triage facts

Revision 3
Applicability
SonicOS SSLVPN, SonicOS (Gen7 <= 7.3.3-7015) +3
Evidence
Confirmed activeMedium confidence
Severity
Medium
Sources
15 public sources
Freshness
Revision 3Nov 7, 11:54 UTC
Vulnerabilities
7 CVEs
Source quality
A2Roughly even chance
Revision history 2 entries · Revision 3
  1. Revision 3

    exploited:true

    Changed: affected_products, exploitation_evidence, lastmod, references, updates

    Sources: 1

  2. Revision 2

    new product

    Changed: affected_products, claim_state, lastmod, references, updates

    Sources: 1

SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability (CVE-2026-19868). This vulnerability may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls and SAML-enforced multi-factor authentication (MFA). Stakeholders are advised to apply mitigations in accordance with vendor instructions and CISA BOD 26-04 guidance.