Overview
CISA has added CVE-2026-19868, a high-severity flaw in SonicWall SonicOS, to its Known Exploited Vulnerabilities (KEV) catalog after reports of possible real-world exploitation. SonicWall says it "investigated a report indicating potential exploitation." It has not shared attack details or actors.
The Flaw
CVE-2026-19868 is an authentication enforcement flaw in the SonicOS SSL-VPN. A user with valid credentials for an alternate authentication method can bypass SAML authentication controls, which may also bypass SAML-enforced MFA. The source gives CVSS as 7.1 and 7.5 without explaining the difference.
Affected and fixed version numbers were not stated in the coverage; check SonicWall's advisory for exact builds.
Other Flaws in the Same Release
| CVE | CVSS | Issue |
|---|---|---|
| CVE-2026-107155 | 8.8 | Permissive cross-domain policy in the management interface |
| CVE-2026-107154 | 8.8 | Session validation flaw in the management interface |
| CVE-2026-82308 | 7.5 | Pre-auth heap overflow in SSL-VPN, causing application-level denial of service |
SonicWall is also not patching CVE-2026-109593 and CVE-2026-109594 in end-of-life Global Management System (GMS) products. It recommends moving to Network Security Manager (NSM).
Deadline
Federal Civilian Executive Branch agencies should apply patches by November 20, 2026.
What to Do
- Update SonicOS to the latest release as soon as possible.
- Review SSL-VPN logins for accounts authenticating through unexpected methods, especially where SAML is meant to be required.
- Restrict management interface exposure to trusted networks.
- Migrate off end-of-life GMS products.