# SonicWall SonicOS SSLVPN: SAML / MFA bypass via alternate auth (CVE-2026-19868, CISA KEV) — SNWLID-2026-0014 batch · pwn.watch

> SonicWall published SNWLID-2026-0014 covering multiple SonicOS flaws. Primary tracked here: CVE-2026-19868, a use-of-single-factor-authentication issue in the SonicOS SSLVPN service that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls and SAML-enforced MFA (CWE-308). CISA added it to the KEV catalog on 2026-11-06 (due 2026-11-20; ransomware use Unknown). NVD (published 2026-11-06T19:17:48Z by PSIRT@sonicwall.com) lists Gen7 SonicOS 7.3.3-7015 and older and Gen8 8.2.2-8015 and older as affected; no CVSS in NVD yet. Same advisory also covers sibling SonicOS CVEs CVE-2026-82308 (pre-auth SSL-VPN heap overflow DoS), CVE-2026-107154 / CVE-2026-107155 (management interface), CVE-2026-19703 (weak password hashing on virtual appliances), and CVE-2026-77708 / CVE-2026-77709 (pre-auth TACACS+ buffer overflows). Confirm fixed builds on the vendor advisory.

Page: https://pwn.watch/i/sonicwall-sonicos-sslvpn-saml-bypass-cve-2026-19868 · generated 2026-11-06T23:56:58.608Z

## Status
- Severity: high · status: live · patch: partial
- Product: SonicWall SonicOS (Gen7 / Gen8) SSLVPN and related services
- Started: 2026-11-06
- CVEs: CVE-2026-19868, CVE-2026-82308, CVE-2026-107154, CVE-2026-107155, CVE-2026-19703, CVE-2026-77708, CVE-2026-77709
- Affected: SonicOS Gen7 7.3.3-7015 and older versions (NVD / PSIRT); SonicOS Gen8 8.2.2-8015 and older versions (NVD / PSIRT)
- Fixed in: See SNWLID-2026-0014 for fixed SonicOS builds; NVD lists Gen7 newer than 7.3.3-7015 and Gen8 newer than 8.2.2-8015 as outside the affected range

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/sonicwall-sonicos-sslvpn-saml-bypass-cve-2026-19868/feed.xml
- JSON Feed: https://pwn.watch/i/sonicwall-sonicos-sslvpn-saml-bypass-cve-2026-19868/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/sonicwall-sonicos-sslvpn-saml-bypass-cve-2026-19868.json
- This file: https://pwn.watch/i/sonicwall-sonicos-sslvpn-saml-bypass-cve-2026-19868/llms.txt

## Updates (newest first)
- 2026-11-06: SonicWall PSIRT publishes SNWLID-2026-0014; NVD receives CVE-2026-19868 (SSLVPN SAML/MFA bypass via alternate auth) and sibling SonicOS CVEs CVE-2026-82308, CVE-2026-107154, CVE-2026-107155, CVE-2026-19703, CVE-2026-77708, CVE-2026-77709. Affected: Gen7 7.3.3-7015 and older; Gen8 8.2.2-8015 and older. (https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014)
- 2026-11-06: CISA adds CVE-2026-19868 to the Known Exploited Vulnerabilities Catalog (due 2026-11-20; known ransomware use Unknown). Required action: apply vendor mitigations per BOD 26-04. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Fix brief
# Security brief: SonicWall SonicOS SSLVPN: SAML / MFA bypass via alternate auth (CVE-2026-19868, CISA KEV) — SNWLID-2026-0014 batch

Source: https://pwn.watch/i/sonicwall-sonicos-sslvpn-saml-bypass-cve-2026-19868 · status: live · severity: high · updated Nov 6, 2026, 23:00 UTC

## Patch status
**PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.**

## What it is
SonicWall published SNWLID-2026-0014 covering multiple SonicOS flaws. Primary tracked here: CVE-2026-19868, a use-of-single-factor-authentication issue in the SonicOS SSLVPN service that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls and SAML-enforced MFA (CWE-308). CISA added it to the KEV catalog on 2026-11-06 (due 2026-11-20; ransomware use Unknown). NVD (published 2026-11-06T19:17:48Z by PSIRT@sonicwall.com) lists Gen7 SonicOS 7.3.3-7015 and older and Gen8 8.2.2-8015 and older as affected; no CVSS in NVD yet. Same advisory also covers sibling SonicOS CVEs CVE-2026-82308 (pre-auth SSL-VPN heap overflow DoS), CVE-2026-107154 / CVE-2026-107155 (management interface), CVE-2026-19703 (weak password hashing on virtual appliances), and CVE-2026-77708 / CVE-2026-77709 (pre-auth TACACS+ buffer overflows). Confirm fixed builds on the vendor advisory.

Severity detail: CISA KEV same-day (2026-11-06, due 2026-11-20); no CVSS in NVD yet for CVE-2026-19868; CWE-308; requires valid alternate-auth credentials (not unauthenticated). Sibling CVE-2026-82308 is CVSS 7.5 (CISA ADP) pre-auth DoS.

- Product: SonicWall SonicOS (Gen7 / Gen8) SSLVPN and related services
- CVE / advisory ids: CVE-2026-19868, CVE-2026-82308, CVE-2026-107154, CVE-2026-107155, CVE-2026-19703, CVE-2026-77708, CVE-2026-77709

## Affected versions
- SonicOS Gen7 7.3.3-7015 and older versions (NVD / PSIRT)
- SonicOS Gen8 8.2.2-8015 and older versions (NVD / PSIRT)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- See SNWLID-2026-0014 for fixed SonicOS builds; NVD lists Gen7 newer than 7.3.3-7015 and Gen8 newer than 8.2.2-8015 as outside the affected range

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Mitigations
The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows).

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
Re-checked PSIRT/NVD 2026-11-06 ~21:24Z: sibling NVD lastModified churn only; no new fixed-build strings beyond prior NVD ceilings. Plex2Shell posts still held.

## Latest updates
- Nov 6, 2026: SonicWall PSIRT publishes SNWLID-2026-0014; NVD receives CVE-2026-19868 (SSLVPN SAML/MFA bypass via alternate auth) and sibling SonicOS CVEs CVE-2026-82308, CVE-2026-107154, CVE-2026-107155, CVE-2026-19703, CVE-2026-77708, CVE-2026-77709. Affected: Gen7 7.3.3-7015 and older; Gen8 8.2.2-8015 and older.
- Nov 6, 2026: CISA adds CVE-2026-19868 to the Known Exploited Vulnerabilities Catalog (due 2026-11-20; known ransomware use Unknown). Required action: apply vendor mitigations per BOD 26-04.

## Advisories
- [SonicWall PSIRT SNWLID-2026-0014](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014) (SonicWall)
- [NVD: CVE-2026-19868](https://nvd.nist.gov/vuln/detail/CVE-2026-19868) (NVD)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (CISA)
- [CISA KEV JSON feed (catalogVersion 2026.11.06)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) (CISA)
- [NVD: CVE-2026-82308](https://nvd.nist.gov/vuln/detail/CVE-2026-82308) (NVD)
- [NVD: CVE-2026-107154](https://nvd.nist.gov/vuln/detail/CVE-2026-107154) (NVD)
- [NVD: CVE-2026-107155](https://nvd.nist.gov/vuln/detail/CVE-2026-107155) (NVD)
- [NVD: CVE-2026-19703](https://nvd.nist.gov/vuln/detail/CVE-2026-19703) (NVD)
- [NVD: CVE-2026-77708](https://nvd.nist.gov/vuln/detail/CVE-2026-77708) (NVD)
- [NVD: CVE-2026-77709](https://nvd.nist.gov/vuln/detail/CVE-2026-77709) (NVD)

## Caveats
Distinct from older tracked sonicwall-sonicos-cve-2024-53704 (different CVE). Vendor SPA did not yield fixed-build strings via curl; fixedVersions inferred from NVD affected ceilings — verify against SNWLID-2026-0014. Do not cite cve.now.

---
Machine-readable: https://pwn.watch/i/sonicwall-sonicos-sslvpn-saml-bypass-cve-2026-19868.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.