Vulnerability report

Trusted Third Party Report Confirmed Confidence In CISA KEV

CVE-2026-19868

SonicOS

SonicWall / SonicOS · 7.3.3-7015 and older versions

Watch CVE-2026-19868 Browse KEV feed
Severity
CVSS 7.5 · High
Confidence
Confirmed
Exploit status
Trusted Third Party Report
EPSS
0.6%
First observed
—
Last observed
—

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-19868 is an unauthenticated vulnerability affecting SonicWall SonicOS.

Have exploitation attempts been observed?

Yes. Exploitation attempts have been reported for this vulnerability. Previdian lists it as a known exploited vulnerability. Listed in CISA KEV. Also reported by third-party sources. Confidence is confirmed.

Who is affected?

SonicWall / SonicOS, including 7.3.3-7015 and older versions and 8.2.2-8015 and older versions.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

SonicOS

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls.

Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

SonicWall Affected
SonicOS
7.3.3-7015 and older versions 8.2.2-8015 and older versions
View vendor advisory (opens in new tab)
Published
06 Nov 2026
Exploitation Attempts Reported
06 Nov 2026
Attack vector
Remote
Complexity
High
Privileges
None
User interaction
None

Tags

edge cisa

CVE References

Exploitation evidence

Evidence of exploitation attempts

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploitation Attempts Observed in the Wild

Sonicwall PSIRT

Recorded 06 Nov 2026

A trusted third party reported exploitation attempts.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access
Source Added
Sonicwall PSIRT First 2026-11-06 20:13 UTC
CISA 2026-11-06 20:20 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

7.5 High

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

EPSS

0.6%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Use of Single-factor Authentication CWE-308

Recent mention · Security Affairs

U.S. CISA adds SonicWall SonicOS SSLVPN flaw to its Known Exploited Vulnerabilities catalog

U.S. CISA adds SonicWall SonicOS SSLVPN vulnerability CVE-2026-19868 to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a SonicWall SonicOS SSLVPN flaw, tracked as CVE-2026-19868 (CVSS score of 7.5), to its...

Read full advisory

All Mentions

Recent mention · Security Affairs

U.S. CISA adds SonicWall SonicOS SSLVPN flaw to its Known Exploited Vulnerabilities catalog

Security Affairs · 07 Nov 2026

U.S. CISA adds SonicWall SonicOS SSLVPN vulnerability CVE-2026-19868 to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a SonicWall SonicOS SSLVPN flaw, tracked as CVE-2026-19868 (CVSS score of 7.5), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-19868 is an authentication bypass vulnerability affecting the SSL VPN service in SonicWall SonicOS. […]

Recent mention · Sonicwall PSIRT

SonicWall SonicOS Affected By Multiple Vulnerabilities

Sonicwall PSIRT · 06 Nov 2026

1) CVE-2026-107155 - Permissive Cross-domain Policy VulnerabilityA permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.CVSS Score: 8.8CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCWE-942: Permissive Cross-domain Security Policy with Untrusted Domains2) CVE-2026-107154 - Session Validation VulnerabilityA session validation vulnerability has been identified in the SonicOS management interface, which in specific...

Timeline

From disclosure to observed exploitation attempts

  1. 20:20 UTC

    Added to CISA KEV

    Listed in the CISA Known Exploited Vulnerabilities catalog

  2. 20:13 UTC

    Added to Previdian KEV Feed

    High-confidence, third-party report of exploitation attempts

  3. 19:03 UTC

    CVE published

    Vulnerability disclosed publicly

  4. 11:22 UTC

    CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-19868

Sample API response 
{
  "cve_id": "CVE-2026-19868",
  "confidence": "Confirmed",
  "cvss_score": 7.5,
  "cvss_estimated": false,
  "epss_score": 0.00621,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}