The facts
A 6 November Canadian Centre for Cyber Security advisory said SonicWall indicates CVE-2026-19868 is being exploited and that CISA added it to the Known Exploited Vulnerabilities catalog. [1]
BleepingComputer reported the flaw can let an attacker with valid credentials for an alternate authentication method bypass SAML authentication controls, potentially including SAML-enforced MFA. [3]
The reported bypass affects SonicOS SSL-VPN services configured to use SAML; it does not establish that all SonicWall deployments are vulnerable. [3]
The Canadian advisory lists SonicOS versions before 7.3.4-7013 and 8.2.2-8015 as affected. [1]
BleepingComputer reported SonicWall investigated a report indicating potential exploitation and urged customers to upgrade, but the company did not disclose campaign or victim details. [2][3]
Still unconfirmed
- The number and identity of compromised organizations and the scope of attacker access have not been disclosed.
- Whether exploitation resulted in data theft or other follow-on activity is unknown.
Sources
References support the numbered facts above. Source checks: 7 Nov 2026, 22:29 UTC.
The Canadian Cyber Centre advisory is an authoritative primary government source for affected versions and the reported KEV addition. SonicWall’s official advisory loaded without extractable text, and direct CISA catalog access returned HTTP 403; BleepingComputer quotes the vendor warning and describes the technical scope. No victim count or post-compromise outcome is known.
- SonicWall security advisory (AV26-1133)
Canadian Centre for Cyber Security · Primary source · 6 Nov 2026
Opened government advisory confirms affected version thresholds, reported exploitation and CISA KEV addition.
- SonicWall security advisory SNWLID-2026-0014
SonicWall PSIRT · Primary source · 6 Nov 2026
Official page opened but returned no extractable text; scope and warning cross-checked against Canadian advisory and BleepingComputer.
- SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
BleepingComputer · Reporting · 6 Nov 2026
Opened independent report on authentication requirements and SAML scope.