Skip to content
audiotale.net
Sign in
NewsNews

CVE-2026-19868: SonicWall SonicOS SSL-VPN SAML MFA bypass exploited, upgrade now

CISA added the SonicOS SSL-VPN flaw to its exploited-vulnerabilities list on 6 November. It matters only where VPN logins use SAML, and SonicWall lists no workaround.

audiotale.net team

· 5 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. The numbers
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

SonicWall has fixed a SonicOS SSL-VPN authentication bypass, CVE-2026-19868, that CISA added to its Known Exploited Vulnerabilities (KEV) catalog on 6 November 2026. The flaw only matters on firewalls where SSL-VPN logins use SAML, and it can let someone who holds valid credentials for another login method skip SAML controls, including SAML-enforced multi-factor authentication. SonicWall says there is no workaround, so the fix is to upgrade to SonicOS 7.3.4-7013 (Gen7) or 8.2.3-8015 (Gen8).

Key points

  • CVE-2026-19868 is an SSL-VPN authentication bypass in SonicOS, tracked in SonicWall advisory SNWLID-2026-0014; it affects only SSL-VPN configured with SAML logins.
  • Affected: SonicOS Gen7 7.3.3-7015 and earlier, and Gen8 8.2.2-8015 and earlier. Fixed: Gen7 7.3.4-7013 and Gen8 8.2.3-8015, according to BleepingComputer's reading of the advisory.
  • CISA added it to the KEV catalog on 6 November 2026 with a federal deadline of 20 November 2026.
  • SonicWall says there are no workarounds; the same advisory fixes six other SonicOS flaws, including two management-interface issues rated 8.8.
  • The severity score is reported two ways: 7.1 by BleepingComputer, and 7.5 (CVSS 3.1, scored by CISA-ADP) on a CVE aggregator.

What to do

Who is affected: organisations running SonicWall firewalls on SonicOS Gen7 (7.3.3-7015 and earlier) or Gen8 (8.2.2-8015 and earlier) that let VPN users sign in through SAML (for example with an identity provider such as Entra ID or Okta). If SSL-VPN is off, or does not use SAML, this particular flaw does not apply: the advisory says it affects the SSL-VPN service "only" when SAML is enabled for SSL-VPN logins, according to a quote reproduced in search summaries of the advisory, which we could not open directly.

Fix: upgrade to SonicOS 7.3.4-7013 on Gen7 or 8.2.3-8015 on Gen8. SonicWall's statement, as quoted by BleepingComputer: "Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks."

Check whether you are affected: in the firewall's SSL-VPN settings, see whether SAML is enabled for logins, and read the running version under System, Status. Then look at authentication logs. One analysis cited in search results suggests comparing SonicWall SSL-VPN logins against your identity provider's sign-in logs and looking for VPN sessions with no matching SAML sign-in event. We could not confirm that method with a vendor source, so treat it as a starting idea.

If you cannot upgrade today: SonicWall lists no workaround. CISA's required action is to apply the vendor's mitigations or, if none exist, follow its binding operational directive guidance for the product, which can include discontinuing use. For everyone else, limiting who can reach the SSL-VPN portal from the internet is a general hardening step, not a SonicWall-endorsed mitigation for this flaw.

What happened

On 6 November 2026 SonicWall's product security team published advisory SNWLID-2026-0014 covering seven vulnerabilities in SonicOS, and CISA added CVE-2026-19868 to the KEV catalog the same day. CISA's entry lists the vendor as SonicWall, the product as SonicOS SSLVPN, and the weakness as "Use of Single-factor Authentication" (CWE-308). It says the flaw "may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls", and that this may include bypassing SAML-enforced MFA. The due date for federal civilian agencies is 20 November 2026. CISA marks known ransomware use as "Unknown" and says forensic triage is not required under its directive BOD 26-04.

BleepingComputer reports that SonicWall's PSIRT investigated a report of potential exploitation but has not shared details of the attacks. The flaw was reported by Ryan Harris of The Electronic Office, the outlet says. The CVE ID was reserved by SonicWall on 14 August 2026 and published on 6 November, according to a CVE aggregator that mirrors the record.

The same advisory fixes six other flaws, per BleepingComputer: two management-interface flaws rated 8.8 that let unauthenticated attackers perform unauthorised operations under specific conditions, pre-authentication buffer overflows in the SSL-VPN and TACACS+ services that can cause denial of service, and a weak password hashing flaw affecting virtual appliances.

Background

SSL-VPN appliances sit on the edge of corporate networks and are a repeated target. BleepingComputer's article notes a run of SonicWall incidents in 2026, all involving the separate SMA1000 line: attacks in July that used two other zero-days to deploy malware, attacks in September that chained two SMA1000 zero-days to achieve remote code execution, and exploitation attempts in October against CVE-2026-102255, a maximum-severity flaw that allows unauthenticated access to internal functionality. Those are different products from the SonicOS firewalls in this advisory, but they show the pressure on the vendor's remote-access products.

The mechanism here fits a familiar pattern. SAML moves sign-in to an identity provider, which is where MFA is usually enforced. If the VPN service still accepts another valid login route, an attacker with stolen or reused credentials for that route may never be sent through the identity provider's MFA step. That reading matches CISA's description, though SonicWall has not published a technical write-up that we could open.

The numbers

Reported figures for this advisory:

SonicOS SSL-VPN CVE-2026-19868 and related flaws: CVSS scores reportedCVSS base score
SonicOS SSL-VPN CVE-2026-19868 and related flaws: CVSS scores reported (CVSS base score)
CVSS base score
CVE-2026-19868 (BleepingComputer)7.1
CVE-2026-19868 (CISA-ADP)7.5
Two management-interface flaws8.8

Source: BleepingComputer; CVE aggregator listing CISA-ADP score

The scores differ because different parties score the same flaw: BleepingComputer reports 7.1 for CVE-2026-19868, while an aggregator shows 7.5 under CVSS 3.1 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) scored by CISA-ADP. Neither changes the practical priority: a KEV listing means exploitation has been seen, and CISA gave civilian agencies two weeks.

What it means

For administrators: this is an upgrade task with a condition check. Even if you believe SAML is not in use on SSL-VPN, confirm it in the configuration instead of assuming.

For security teams: an MFA bypass undermines the control that was meant to contain stolen passwords. Review recent VPN logins and compare them against the identity provider's sign-in records.

For the vendor: SonicWall has now had KEV-listed or exploited flaws across two product lines in 2026 (SMA1000 and now SonicOS), as BleepingComputer's recap shows. Customers weighing remote-access options will notice the pattern.

Who gains and who loses: attackers with a pool of valid credentials (from infostealers or leaks) gain the most while unpatched devices remain. Organisations that enforced MFA only at the VPN edge, relying on the SAML step alone, lose the protection they thought they had.

What we don't know yet

  • How the attacks happened. SonicWall has not shared details of the reported exploitation, according to BleepingComputer.
  • Who is exploiting it and at what scale. CISA lists known ransomware use as "Unknown".
  • The exact severity. Sources give 7.1 and 7.5.
  • The primary advisory text. SonicWall's advisory page loads only through JavaScript, so we relied on CISA's entry, BleepingComputer and an aggregator copy of the CVE record for the details above. Fixed-version numbers come from BleepingComputer's reading of the advisory.
  • Whether logs show a clean detection method. We found no vendor-published way to spot exploitation.

What to watch next

  • SonicWall's advisory page for any updated fix list, exploitation details or indicators.
  • Whether CISA's catalog notes ransomware use for CVE-2026-19868.
  • Follow-up research that describes the bypass in technical terms.
  • The 20 November 2026 federal deadline, a useful benchmark for your own patch window.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next