CVE-2026-19868
SonicWall SonicOS
What this is
SonicOS may fail to enforce the required sign-in checks. Someone who can sign in through another authentication method may bypass those checks, including extra verification.
How it can harm you
Someone with valid sign-in details for another authentication method may gain access without completing the required checks. Exactly what they could then read or change is not specified.
How urgent it is
This vulnerability is already being used in attacks. Address it promptly using verified guidance from SonicWall because required sign-in checks can be bypassed.
Who is affected
SonicOS on Gen7 and Gen8 is affected: 7.3.3-7015 and older versions, and 8.2.2-8015 and older versions.
What to do
Consult the SonicWall advisory for verified remediation. No fixed release or workaround is specified in the available information.
How to check your server
Check which SonicOS version is installed and compare it with the affected versions and remediation guidance in the SonicWall advisory.
Technical details
- CVE
- CVE-2026-19868
- Published
- November 6, 2026
- CWE
- CWE-308
- CVSS
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
- EPSS
- 0.5% chance of an attack attempt in the next 30 days
- Attack evidence
- attacks observed; public exploit on GitHub
CVSS measures technical severity on a scale up to 10. Attack conditions and urgency are explained above.
EPSS estimates the chance of an exploitation attempt in the next 30 days, not the chance of your server being breached.