Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LiveHighPartly patchedPatch now

SonicWall SonicOS SSLVPN: SAML / MFA bypass via alternate auth (CVE-2026-19868, CISA KEV) — SNWLID-2026-0014 batch

SonicWall SonicOS (Gen7 / Gen8) SSLVPN and related services

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

SonicWall published SNWLID-2026-0014 covering multiple SonicOS flaws. Primary tracked here: CVE-2026-19868, a use-of-single-factor-authentication issue in the SonicOS SSLVPN service that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls and SAML-enforced MFA (CWE-308). CISA added it to the KEV catalog on 2026-11-06 (due 2026-11-20; ransomware use Unknown). NVD (published 2026-11-06T19:17:48Z by PSIRT@sonicwall.com) lists Gen7 SonicOS 7.3.3-7015 and older and Gen8 8.2.2-8015 and older as affected; no CVSS in NVD yet. Same advisory also covers sibling SonicOS CVEs CVE-2026-82308 (pre-auth SSL-VPN heap overflow DoS), CVE-2026-107154 / CVE-2026-107155 (management interface), CVE-2026-19703 (weak password hashing on virtual appliances), and CVE-2026-77708 / CVE-2026-77709 (pre-auth TACACS+ buffer overflows). Confirm fixed builds on the vendor advisory.

Why this severity: CISA KEV same-day (2026-11-06, due 2026-11-20); no CVSS in NVD yet for CVE-2026-19868; CWE-308; requires valid alternate-auth credentials (not unauthenticated). Sibling CVE-2026-82308 is CVSS 7.5 (CISA ADP) pre-auth DoS.

Started
Nov 6, 2026
CVEs
CVE-2026-19868CVE-2026-82308CVE-2026-107154CVE-2026-107155CVE-2026-19703CVE-2026-77708CVE-2026-77709

Follow this incident

Discuss on X ↗

Affected

  • SonicOS Gen7 7.3.3-7015 and older versions (NVD / PSIRT)
  • SonicOS Gen8 8.2.2-8015 and older versions (NVD / PSIRT)

Fixed in

  • See SNWLID-2026-0014 for fixed SonicOS builds; NVD lists Gen7 newer than 7.3.3-7015 and Gen8 newer than 8.2.2-8015 as outside the affected range

Timeline2

  1. SonicWall PSIRT publishes SNWLID-2026-0014; NVD receives CVE-2026-19868 (SSLVPN SAML/MFA bypass via alternate auth) and sibling SonicOS CVEs CVE-2026-82308, CVE-2026-107154, CVE-2026-107155, CVE-2026-19703, CVE-2026-77708, CVE-2026-77709. Affected: Gen7 7.3.3-7015 and older; Gen8 8.2.2-8015 and older.

  2. CISA adds CVE-2026-19868 to the Known Exploited Vulnerabilities Catalog (due 2026-11-20; known ransomware use Unknown). Required action: apply vendor mitigations per BOD 26-04.

Advisories10

Notes & caveats

Distinct from older tracked sonicwall-sonicos-cve-2024-53704 (different CVE). Vendor SPA did not yield fixed-build strings via curl; fixedVersions inferred from NVD affected ceilings — verify against SNWLID-2026-0014. Do not cite cve.now.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo