HIXOR
Threat Intelligence — Vulnerability information
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability (CVE-2026-19868)
The 3 key points
- Summary： On November 6, 2026, CISA added the SonicWall SonicOS SSLVPN use of single-factor authentication vulnerability (CVE-2026-19868, CWE-308) to its Known Exploited Vulnerabilities (KEV) catalog.
- Who is affected： Organizations and users running the SonicWall SonicOS SSLVPN feature
- Recommended actions： Upgrade to the fixed version following the vendor's guidance (per the vendor, there is no workaround — an upgrade is required)
Source and verification
- Source
- CISA (Cybersecurity and Infrastructure Security Agency, US) — Known Exploited Vulnerabilities Catalog
- Original
- Official announcement page (original)
- Published
- November 6, 2026
- Last verified by HIXOR
- November 7, 2026 (the date HIXOR checked the original)
- Remediation due (US federal agencies)
- November 20, 2026
This page summarizes an announcement by a public authority. Please check the original for exact details. If this summary and the original differ, the original prevails.
Summary
On November 6, 2026, CISA added the SonicWall SonicOS SSLVPN use of single-factor authentication vulnerability (CVE-2026-19868, CWE-308) to its Known Exploited Vulnerabilities (KEV) catalog. A user with valid credentials for an alternate authentication method may be able to bypass SAML authentication controls and SAML-enforced multifactor authentication (MFA).
Who is affected
- Organizations and users running the SonicWall SonicOS SSLVPN feature
- Configurations relying on SAML authentication and SAML-enforced MFA need particular attention
Recommended actions
- Upgrade to the fixed version following the vendor's guidance (per the vendor, there is no workaround — an upgrade is required)
- Check whether your organization uses the affected product
- Check the original (the CISA KEV catalog) for the latest information