CISA lists SonicWall VPN flaw as exploited
CISA listed CVE-2026-19868 as exploited. SonicWall says the flaw affects SAML-enabled SSLVPN only and lists platform-scoped fixes.
Owners using SonicWall SonicOS SSLVPN for staff logins should check their exposure now. CISA added vulnerability CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on November 6. Its warning says, "Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA)."
SonicWall says the flaw only affects SSLVPN when SAML is enabled for SSLVPN logins. CISA says the flaw "may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls." SonicWall says its security response team investigated a report indicating potential exploitation. CISA records ransomware-campaign use as unknown.
SonicWall lists fixes by platform
SSLVPN gives staff a remote connection to a business network. SAML handles sign-in through an identity service; MFA adds checks beyond a password.
SonicWall's affected and fixed lists cover the whole multi-flaw advisory and only the platforms it lists. SonicWall lists Gen7 7.3.3-7015 and older versions and Gen8 8.2.2-8015 and older versions as affected. The National Vulnerability Database (NVD) records the same affected-version strings.
For listed Gen7 platforms, SonicWall lists 7.3.4-7013 and higher versions as fixed; for listed Gen8 platforms, 8.2.3-8015 and higher versions. SonicWall says it strongly urges customers to upgrade to the latest release.
CVSS is a scoring system for technical severity. SonicWall says it scores this flaw at 7.1 under CVSS v3.1. SonicWall credits Ryan Harris of The Electronic Office.
November 20 is a federal deadline
The catalog gives November 20 as the remediation deadline for US federal civilian executive branch agencies. It is not a mandate for small businesses.
CISA's instructions call for vendor mitigations and evaluating each asset's internet exposure. Its federal guidance also calls for discontinuing use when mitigations are unavailable.
What this means for your business
For the owner of a small firm with staff working remotely, in our view this deserves action today. Check whether SAML is enabled for SSLVPN logins and record the device model and SonicOS version.
Match those details against SonicWall's listed platforms and fixes. For a listed model, upgrade to the listed fixed release or later. Ask SonicWall support if you're unsure whether your model is listed; a version absent from NVD's affected list isn't proof of safety.
Sources
- CISA, Known Exploited Vulnerabilities catalog.
- CISA, federal directive.
- NVD, CVE-2026-19868 record.
- SonicWall, security advisory SNWLID-2026-0014.
This article was researched, written and fact-checked by MasterNodeAI's AI newsroom agents.
Related: Security & Regulation desk
MasterNodeAI is building an AI interface that helps small and medium business owners run their business. Join the waitlist and we will let you know when you can try it.