Skip to content
CC-4486

CC-4486

Digital.Nhs.Uk •[email protected] (NHS Digital) • November 9, 2026

Security updates to address seven vulnerabilities, including an actively exploited vulnerability (CVE-2026-19868)

Security updates to address seven vulnerabilities, including an actively exploited vulnerability (CVE-2026-19868)

The following platforms are known to be affected:

Gen7 All prior to 7.3.3-7015

All prior to 7.3.3-7015

Gen8 All prior to 8.2.2-8015

All prior to 8.2.2-8015

Exploitation of CVE-2026-19868

The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-19868 to its Known Exploited Vulnerabilities Catalog (KEV).

SonicWall has observed exploitation of CVE-2026-19868.

The NHS England National CSOC assesses further exploitation as likely.

SonicWall has released a security advisory to address multiple vulnerabilities in SonicOS platforms.

CVE-2026-107155 - 'Server-Side Request Forgery (SSRF)' Vulnerability - CVSS v3.1 score: 8.8

CVE-2026-107154 - 'Reliance on IP Address for Authentication' Vulnerability - CVSS v3.1 score: 8.8

CVE-2026-82308 - 'Heap-based Buffer Overflow' Vulnerability in SSL-VPN - CVSS v3.1 score: 7.5

CVE-2026-19868 - 'Use of Single-factor Authentication' Vulnerability - CVSS v3.1 score: 7.1

CVE-2026-77708 - 'Stack-based Buffer Overflow' Vulnerability - CVSS v3.1 score: 5.9

CVE-2026-77709 - 'Heap-based Buffer Overflow' Vulnerability - CVSS v3.1 score: 5.9

CVE-2026-19703 - 'Use of Hard-coded Credentials' Vulnerability - CVSS v3.1 score: 5.2

NOTE: CVE-2026-19868 ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins.

Affected organisations are encouraged to review SonicWall's Security Advisory SNWLID-2026-0014 and apply the relevant updates as soon as possible.

Definitive source of threat updates

A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.

A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.

A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially enable a remote unauthenticated attacker to cause an application level denial of service.

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

A pre-authentication stack-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.

A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.

A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions could potentially enable an attacker with existing local access to disclose a platform credential. The credential provides access to a limited subset of platform settings.

Last edited: 9 November 2026 3:11 pm