CISA Warns of SonicWall SonicOS SSLVPN Vulnerability Exploited in Attacks
CISA warns of SonicWall SonicOS SSLVPN authentication bypass (CVE-2026-19868) exploited in attacks.
CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog, affecting SonicWall SonicOS SSLVPN on Gen7 and Gen8 platforms. The vulnerability allows valid-credential users to bypass SAML authentication controls and potentially evade multi-factor authentication through an alternate authentication method. CISA set a November 20, 2026 remediation deadline, with fixed versions available (7.3.4-7013 for Gen7, 8.2.3-8015 for Gen8).
AI summary of the linked source. Not reviewed by an editor. How this works
Run SonicWall?
Get an email when a new story names SonicWall, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA vulnerability in SonicWall SonicOS (CVE-2026-19868) allows authenticated users to bypass SAML-based authentication controls and circumvent multi-factor authentication, granting attackers elevated or unintended access through an alternate authentication path. This is particularly dangerous because it undermines a core compensating control — MFA — that organizations rely on as a last line of defence against credential compromise. The flaw affects widely deployed Gen7 and Gen8 VPN gateways, making internet-facing perimeter devices an attractive target. Patches have been released, yet CISA's addition to the KEV catalog confirms active exploitation, highlighting the gap between patch availability and patch deployment in many organizations.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-19868
- cve — CVE-2024-53704