CVE-2026-19868: tz80 — Actively Exploited & Fix

Description

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

Is your site exposed to CVE-2026-19868?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

EPSS — Exploit Prediction

0.0053

Probability of exploitation

0.45%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild.

Added: Nov 6, 2026 Remediation due: Nov 20, 2026

Weakness Type (CWE)

CWE-308 CWE-308

Affected Products

Vendor	Product	Versions
sonicwall	sonicos	< 7.3.4-7015
sonicwall	nsv_270	All
sonicwall	nsv_470	All
sonicwall	nsv_870	All
sonicwall	nsa_2700	All
sonicwall	nsa_3700	All
sonicwall	nsa_4700	All
sonicwall	nsa_5700	All
sonicwall	nsa_6700	All
sonicwall	nssp_10700	All
sonicwall	nssp_11700	All
sonicwall	nssp_13700	All
sonicwall	nssp_15700	All
sonicwall	tz270	All
sonicwall	tz270w	All
sonicwall	tz370	All
sonicwall	tz370w	All
sonicwall	tz470	All
sonicwall	tz470w	All
sonicwall	tz570	All
sonicwall	tz570p	All
sonicwall	tz570w	All
sonicwall	tz670	All
sonicwall	sonicos	< 8.2.2-8015
sonicwall	nsv_l	All
sonicwall	nsv_m	All
sonicwall	nsv_s	All
sonicwall	nsv_xs	All
sonicwall	nsa_2800	All
sonicwall	nsa_3800	All
sonicwall	nsa_4800	All
sonicwall	nsa_5800	All
sonicwall	tz280	All
sonicwall	tz280w	All
sonicwall	tz380	All
sonicwall	tz380w	All
sonicwall	tz480	All
sonicwall	tz580	All
sonicwall	tz680	All
sonicwall	tz80	All

References

Advisories & Patches

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014

Other References

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19868

Frequently Asked Questions

What is CVE-2026-19868? +

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA). It has a CVSS v3.1 base score of 7.5 (HIGH). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.

How severe is CVE-2026-19868? +

CVE-2026-19868 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0053, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-19868? +

CVE-2026-19868 affects products from sonicwall, specifically: nsa_2700, nsa_2800, nsa_3700, nsa_3800, nsa_4700, nsa_4800, nsa_5700, nsa_5800, nsa_6700, nssp_10700, nssp_11700, nssp_13700, nssp_15700, nsv_270, nsv_470, nsv_870, nsv_l, nsv_m, nsv_s, nsv_xs, sonicos, tz270, tz270w, tz280, tz280w, tz370, tz370w, tz380, tz380w, tz470, tz470w, tz480, tz570, tz570p, tz570w, tz580, tz670, tz680, tz80. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-19868? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-27928

vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, if an attacker hacks into a vantage6 …

CVE-2026-85590

phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable functionality. The removeTwofactorConfig() handler (reachable via …

CVE-2025-64103 9.8

Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled …

CVE-2026-58240 9.8

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker …

CVE-2026-15616 9.1

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.

CVE-2026-111884 8.3

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the …