CISA Tracks Active Exploitation of SonicWall SSLVPN Vulnerability; Fixes Available

The CVE-2026-19868 vulnerability in SonicOS SSLVPN was added on November 6, 2026, to the Known Exploited Vulnerabilities (KEV) catalog managed by CISA. The flaw affects authentication enforcement in the SonicWall SSLVPN service, and CISA tracks it as actively exploited. The manufacturer lists fixed SonicOS versions for both Gen 7 and Gen 8 devices.

What SonicWall SSLVPN CVE-2026-19868 Enables

The CVE-2026-19868 vulnerability involves insufficient authentication enforcement. An attacker with valid credentials for an alternative sign-in method may bypass SAML checks. This may also bypass multifactor authentication if MFA is enforced through SAML.

The practical impact concerns environments where an organization uses SAML for VPN sign-ins. Under these circumstances, a compromised password or other valid credentials from an alternative authentication flow may be sufficient to gain remote network access without completing SAML MFA.

By adding the flaw to the KEV catalog, CISA confirmed that it tracks active exploitation of the vulnerability.

Affected Versions and Available Fixes

According to SonicWall’s advisory, the following releases are vulnerable:

• SonicOS Gen 7 version 7.3.3-7015 and earlier,
• SonicOS Gen 8 version 8.2.2-8015 and earlier.

For Gen 7, the manufacturer lists SonicOS 7.3.4-7013 or later as the fix. For Gen 8, the fix is available in SonicOS 8.2.3-8015. Administrators should verify the version on devices with an exposed SSLVPN service and deploy the relevant update without unnecessary delay.

Because the issue is related to sign-in flows, the update itself should be supplemented by a review of SSLVPN sign-ins. Organizations may compare VPN session records with identity provider records, particularly for accounts using SAML and multifactor authentication.

Public Exploitation Details Are Still Lacking

Publicly available materials do not provide details about specific attacks, affected organizations, or indicators of compromise. It has also not been confirmed whether exploitation occurred before the fix was released. Inclusion in KEV confirms active exploitation, but does not describe the number or extent of successful intrusions.

For administrators, updating affected firewalls and reviewing access logs therefore remains a priority. It would also be appropriate to watch for further information from SonicWall and CISA, especially if they publish detection or forensic guidance for suspicious SSLVPN sessions.

Verified and updated: 11/08/2026 15:20