{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2026-19868","sourceIdentifier":"PSIRT@sonicwall.com","published":"2026-11-06T19:17:48.437","lastModified":"2026-11-09T19:42:13.887","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA)."}],"affected":[{"source":"PSIRT@sonicwall.com","affectedData":[{"vendor":"SonicWall","product":"SonicOS","defaultStatus":"unknown","platforms":["Gen7","Gen8"],"versions":[{"version":"7.3.3-7015 and older versions","status":"affected"},{"version":"8.2.2-8015 and older versions","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-06T00:00:00+00:00","id":"CVE-2026-19868","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2026-11-06","cisaActionDue":"2026-11-20","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability","weaknesses":[{"source":"PSIRT@sonicwall.com","type":"Secondary","description":[{"lang":"en","value":"CWE-308"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3.4-7015","matchCriteriaId":"639FC5E5-9895-4770-9663-0DCC1DB9CC2D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:sonicwall:nsv_270:-:*:*:*:*:*:*:*","matchCriteriaId":"50F3A318-F082-4BDD-80EA-51DB15D3458C"},{"vulnerable":false,"criteria":"cpe:2.3:a:sonicwall:nsv_470:-:*:*:*:*:*:*:*","matchCriteriaId":"09CAD976-F02B-40D6-9584-B8146A5A2EA1"},{"vulnerable":false,"criteria":"cpe:2.3:a:sonicwall:nsv_870:-:*:*:*:*:*:*:*","matchCriteriaId":"9079ED9F-0458-4EA8-8E89-5D3D4CA8096F"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:nsa_2700:-:*:*:*:*:*:*:*","matchCriteriaId":"8D8B0C7A-FD65-47CA-A625-150A90EFA7A1"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:nsa_3700:-:*:*:*:*:*:*:*","matchCriteriaId":"A69E000B-5806-46FD-A233-4E2CC9DD38D2"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:nsa_4700:-:*:*:*:*:*:*:*","matchCriteriaId":"8DF4A322-7CC7-4AB9-B10E-FFF34DF2182D"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:nsa_5700:-:*:*:*:*:*:*:*","matchCriteriaId":"4C15FED5-C48C-47CF-9645-0563D77883C1"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:nsa_6700:-:*:*:*:*:*:*:*","matchCriteriaId":"A884B1BB-F201-4C77-9F6E-B8A884DCD4C2"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:nssp_10700:-:*:*:*:*:*:*:*","matchCriteriaId":"7C3BA5A3-1160-4793-A8D6-40B9D264BCC4"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:nssp_11700:-:*:*:*:*:*:*:*","matchCriteriaId":"6739DEA3-06FF-4FEB-9931-0DB27F63B70E"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:nssp_13700:-:*:*:*:*:*:*:*","matchCriteriaId":"0250EDF9-0AEF-4711-8EF6-D447CF48BCAF"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:nssp_15700:-:*:*:*:*:*:*:*","matchCriteriaId":"7D6CF3CF-256C-4C04-8BDF-B16398CD0459"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz270:-:*:*:*:*:*:*:*","matchCriteriaId":"70340DD4-687B-402C-85AF-C2B80D0F1600"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz270w:-:*:*:*:*:*:*:*","matchCriteriaId":"52847BA2-470B-4078-A79B-52095DB9214B"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz370:-:*:*:*:*:*:*:*","matchCriteriaId":"9853AE3A-B0EA-4249-AA7D-1F2051C9BF91"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz370w:-:*:*:*:*:*:*:*","matchCriteriaId":"4DBDD10C-F89D-4051-BC70-67B41167FF9B"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz470:-:*:*:*:*:*:*:*","matchCriteriaId":"6C23940E-2F9D-447B-A740-42035ED5D400"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz470w:-:*:*:*:*:*:*:*","matchCriteriaId":"90C790AD-C40E-4527-8F83-D278282A9600"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz570:-:*:*:*:*:*:*:*","matchCriteriaId":"C7DF76E0-8E3D-4E0D-A3BB-F5AE05A4C7C9"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz570p:-:*:*:*:*:*:*:*","matchCriteriaId":"352DFCF9-E333-41C0-8033-91265768FD8E"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz570w:-:*:*:*:*:*:*:*","matchCriteriaId":"4C882C38-9DA5-4C03-BB23-AB2B448E3307"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz670:-:*:*:*:*:*:*:*","matchCriteriaId":"AEEA6065-48D3-4EC7-BD94-CBAE3D1010FF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*","versionEndExcluding":"8.2.2-8015","matchCriteriaId":"5A473DAB-8000-444D-BEA2-3B0B38E8375E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:sonicwall:nsv_l:-:*:*:*:*:*:*:*","matchCriteriaId":"0E181C4C-8FB3-492A-8202-9C48EC07B76F"},{"vulnerable":false,"criteria":"cpe:2.3:a:sonicwall:nsv_m:-:*:*:*:*:*:*:*","matchCriteriaId":"2D8A8488-D765-4F6F-93CF-61E188B1B7D6"},{"vulnerable":false,"criteria":"cpe:2.3:a:sonicwall:nsv_s:-:*:*:*:*:*:*:*","matchCriteriaId":"0372B9D5-9774-4CF5-8D3A-7131B0A03061"},{"vulnerable":false,"criteria":"cpe:2.3:a:sonicwall:nsv_xs:-:*:*:*:*:*:*:*","matchCriteriaId":"855302DC-3FD6-48EE-BD9F-789AEBB3A518"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:nsa_2800:-:*:*:*:*:*:*:*","matchCriteriaId":"559FE8B8-E5E1-4E74-98AF-79AF0ECF9064"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:nsa_3800:-:*:*:*:*:*:*:*","matchCriteriaId":"3ED8014A-C7A4-4624-8D50-A9844871C1B6"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:nsa_4800:-:*:*:*:*:*:*:*","matchCriteriaId":"1BDD4AB6-878B-41BE-BA33-6A2ECE2BC85B"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:nsa_5800:-:*:*:*:*:*:*:*","matchCriteriaId":"D28BF416-D019-438B-954E-FB94697DC011"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz280:-:*:*:*:*:*:*:*","matchCriteriaId":"56EC904E-4FCA-4B35-B188-639AE688DD14"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz280w:-:*:*:*:*:*:*:*","matchCriteriaId":"4B1618BE-A465-4E2F-BB7F-79E0AA930B1C"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz380:-:*:*:*:*:*:*:*","matchCriteriaId":"83B9556B-0A33-4A27-B9E2-00F47969A566"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz380w:-:*:*:*:*:*:*:*","matchCriteriaId":"72D94F4D-CEC8-473B-A49C-466F6F7274D3"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz480:-:*:*:*:*:*:*:*","matchCriteriaId":"DCFE3403-6A5B-4735-9248-99297A2E4461"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz580:-:*:*:*:*:*:*:*","matchCriteriaId":"AAEE386F-5FE4-4F21-AD34-33B862AAD1CC"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz680:-:*:*:*:*:*:*:*","matchCriteriaId":"AE6BC579-21A1-4C2F-B655-73B14C3409A7"},{"vulnerable":false,"criteria":"cpe:2.3:h:sonicwall:tz80:-:*:*:*:*:*:*:*","matchCriteriaId":"129CC10F-E822-4BF7-9EB5-0D702020CB0C"}]}]}],"references":[{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014","source":"PSIRT@sonicwall.com","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19868","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}}