{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "SonicWall SonicOS SSLVPN: SAML / MFA bypass via alternate auth (CVE-2026-19868, CISA KEV) — SNWLID-2026-0014 batch · updates",
  "home_page_url": "https://pwn.watch/i/sonicwall-sonicos-sslvpn-saml-bypass-cve-2026-19868",
  "feed_url": "https://pwn.watch/i/sonicwall-sonicos-sslvpn-saml-bypass-cve-2026-19868/feed.json",
  "description": "SonicWall published SNWLID-2026-0014 covering multiple SonicOS flaws. Primary tracked here: CVE-2026-19868, a use-of-single-factor-authentication issue in the SonicOS SSLVPN service that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls and SAML-enforced MFA (CWE-308). CISA added it to the KEV catalog on 2026-11-06 (due 2026-11-20; ransomware use Unknown). NVD (published 2026-11-06T19:17:48Z by PSIRT@sonicwall.com) lists Gen7 SonicOS 7.3.3-7015 and older and Gen8 8.2.2-8015 and older as affected; no CVSS in NVD yet. Same advisory also covers sibling SonicOS CVEs CVE-2026-82308 (pre-auth SSL-VPN heap overflow DoS), CVE-2026-107154 / CVE-2026-107155 (management interface), CVE-2026-19703 (weak password hashing on virtual appliances), and CVE-2026-77708 / CVE-2026-77709 (pre-auth TACACS+ buffer overflows). Confirm fixed builds on the vendor advisory.",
  "language": "en",
  "_pwn": {
    "slug": "sonicwall-sonicos-sslvpn-saml-bypass-cve-2026-19868",
    "severity": "high",
    "status": "live",
    "patchStatus": "partial",
    "rss": "https://pwn.watch/i/sonicwall-sonicos-sslvpn-saml-bypass-cve-2026-19868/feed.xml",
    "llms": "https://pwn.watch/i/sonicwall-sonicos-sslvpn-saml-bypass-cve-2026-19868/llms.txt",
    "json": "https://pwn.watch/i/sonicwall-sonicos-sslvpn-saml-bypass-cve-2026-19868.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/sonicwall-sonicos-sslvpn-saml-bypass-cve-2026-19868#2026-11-06-215a91a9",
      "url": "https://pwn.watch/i/sonicwall-sonicos-sslvpn-saml-bypass-cve-2026-19868#2026-11-06-215a91a9",
      "title": "SonicWall SonicOS SSLVPN: SAML / MFA bypass via alternate auth (CVE-2026-19868, CISA KEV) — SNWLID-2026-0014 batch: SonicWall PSIRT publishes SNWLID-2026-0014; NVD receives CVE-2026-19868 (SSLVPN SAML/MFA bypass via alternate auth) and sibling SonicOS CVEs CVE-2026-82308, CVE-2026-107154, CVE-2026-107155, CVE-2026-19703, CVE-2026-77708, CVE-2026-77709. Affected: Gen7 7.3.3-7015 and older; Gen8 8.2.2-8015 and older.",
      "content_text": "SonicWall SonicOS SSLVPN: SAML / MFA bypass via alternate auth (CVE-2026-19868, CISA KEV) — SNWLID-2026-0014 batch: SonicWall PSIRT publishes SNWLID-2026-0014; NVD receives CVE-2026-19868 (SSLVPN SAML/MFA bypass via alternate auth) and sibling SonicOS CVEs CVE-2026-82308, CVE-2026-107154, CVE-2026-107155, CVE-2026-19703, CVE-2026-77708, CVE-2026-77709. Affected: Gen7 7.3.3-7015 and older; Gen8 8.2.2-8015 and older.\n\nSource: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/sonicwall-sonicos-sslvpn-saml-bypass-cve-2026-19868#2026-11-06-1cda3ec6",
      "url": "https://pwn.watch/i/sonicwall-sonicos-sslvpn-saml-bypass-cve-2026-19868#2026-11-06-1cda3ec6",
      "title": "SonicWall SonicOS SSLVPN: SAML / MFA bypass via alternate auth (CVE-2026-19868, CISA KEV) — SNWLID-2026-0014 batch: CISA adds CVE-2026-19868 to the Known Exploited Vulnerabilities Catalog (due 2026-11-20; known ransomware use Unknown). Required action: apply vendor mitigations per BOD 26-04.",
      "content_text": "SonicWall SonicOS SSLVPN: SAML / MFA bypass via alternate auth (CVE-2026-19868, CISA KEV) — SNWLID-2026-0014 batch: CISA adds CVE-2026-19868 to the Known Exploited Vulnerabilities Catalog (due 2026-11-20; known ransomware use Unknown). Required action: apply vendor mitigations per BOD 26-04.\n\nSource: https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "tags": [
        "high"
      ]
    }
  ]
}