CISA Confirms Exploitation of SonicOS SSLVPN Authentication Bypass
Tech GuruQuick Answer
Prioritize SonicOS SSLVPN systems using SAML. Upgrade Gen7 to 7.3.4-7013 or Gen8 to 8.2.3-8015 or later, validate SAML and MFA enforcement, and retain authentication logs and upgrade evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Record Gen7 or Gen8 hardware and NSv instances, firmware, internet exposure, SSLVPN SAML configuration, alternate authentication methods and owners. Match the documented versions and feature prerequisites to the deployment. Vendor bulletin lists Gen7 7.3.3-7015 and earlier, and Gen8 8.2.2-8015 and earlier. This CVE affects SSLVPN only when SAML is enabled for SSLVPN logins. Upgrade Gen7 to 7.3.4-7013 or higher, or Gen8 to 8.2.3-8015 or higher, using the supported appliance procedure. SonicWall provides no workaround. Covered federal agencies must apply the CISA directive and asset-specific requirements; the catalog due date is November 20, 2026. Verify the active firmware and SAML/MFA enforcement across approved VPN login paths. Review relevant authentication activity and retain logs, configuration, applicability and change evidence.
Last verified: 2026-11-07 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | SonicOS Gen7 hardware and NSv; SonicOS Gen8 hardware and NSv |
|---|---|
| Advisory | SNWLID-2026-0014 |
| CVE | CVE-2026-19868 |
| CISA KEV addition date | 2026-11-06; catalog published 2026-11-06T19:44:45Z |
| Authority revision date | Vendor bulletin released and revised 2026-11-06 10:40:08 UTC; CISA addition is a separate exploitation-status event. |
| Affected versions | Vendor bulletin lists Gen7 7.3.3-7015 and earlier, and Gen8 8.2.2-8015 and earlier. This CVE affects SSLVPN only when SAML is enabled for SSLVPN logins. |
| Fixed version | Gen7 7.3.4-7013 and higher; Gen8 8.2.3-8015 and higher |
| CVSS base score | 7.1 (CVSS v3.1 for CVE-2026-19868) |
| CVSS severity | High (vendor advisory rating) |
| Exploitation status | CISA confirms active exploitation for CVE-2026-19868. This does not establish exploitation of the other six CVEs in the vendor bulletin.; no exploitation claim is inferred. |
Authority-Specific Scope And Version Evidence
| Scope and action | CISA added CVE-2026-19868 to KEV on November 6 based on active exploitation. SonicWall documents an SSLVPN authentication bypass when SAML is enabled and alternate-method credentials are valid. |
|---|---|
| Date basis | 2026-11-06; catalog published 2026-11-06T19:44:45Z |
What Changed
CISA added CVE-2026-19868 to KEV on November 6 based on active exploitation. SonicWall documents an SSLVPN authentication bypass when SAML is enabled and alternate-method credentials are valid.
What To Validate Now
- Inventory. Record Gen7 or Gen8 hardware and NSv instances, firmware, internet exposure, SSLVPN SAML configuration, alternate authentication methods and owners.
- Establish applicability. Match the documented versions and feature prerequisites to the deployment. Vendor bulletin lists Gen7 7.3.3-7015 and earlier, and Gen8 8.2.2-8015 and earlier. This CVE affects SSLVPN only when SAML is enabled for SSLVPN logins.
- Remediate. Upgrade Gen7 to 7.3.4-7013 or higher, or Gen8 to 8.2.3-8015 or higher, using the supported appliance procedure. SonicWall provides no workaround. Covered federal agencies must apply the CISA directive and asset-specific requirements; the catalog due date is November 20, 2026.
- Validate. Verify the active firmware and SAML/MFA enforcement across approved VPN login paths. Review relevant authentication activity and retain logs, configuration, applicability and change evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Plan firewall and VPN disruption. Valid alternate-authentication credentials are a condition of this flaw. CISA BOD requirements apply to covered federal agencies; do not infer customer applicability.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
