SonicWall SSL-VPN Flaw Bypasses SAML MFA, Update SonicOS Now

A SonicWall flaw tracked as CVE-2026-19868 lets an attacker who holds valid credentials sign in to a SonicWall firewall’s SSL-VPN without passing SAML checks, including multi-factor authentication (MFA) enforced through SAML. CISA added it to its catalog of exploited vulnerabilities on November 6, 2026. Fixes are in SonicOS 7.3.4-7013 and 8.2.3-8015.

How CVE-2026-19868 works

An SSL-VPN is the remote access gateway employees use to reach the office network from home or while traveling. On SonicWall firewalls, this service runs on the device operating system, SonicOS.

Many organizations connect their SSL-VPN to single sign-on through SAML, a standard that lets the firewall hand identity checks to an identity provider such as the company’s account service. That way, everyone who connects to the VPN goes through the same rules as other office applications, including an MFA code from a phone.

According to SonicWall’s official advisory SNWLID-2026-0014, SonicOS does not enforce those rules consistently. A user with valid credentials for an alternate authentication method, such as a local account on the firewall, can bypass SAML controls. SonicWall states that successful exploitation may also bypass SAML-enforced MFA.

In practice, MFA configured at the identity provider stops being a barrier while another sign-in path remains active. The attacker still needs a valid username and password, which can come from leaked data, phishing, or reused passwords. Research from Ostorlab explains that the outcome is a VPN session with that account’s access rights. The advisory does not describe code execution or privilege escalation on the firewall itself.

SonicWall stresses that the flaw only affects SSL-VPN services that use SAML for sign-in. Firewalls that do not use SAML on the SSL-VPN are not exposed to this CVE, although they still need the update because the same advisory covers other flaws.

Exploitation status and CVSS score

SonicWall published the advisory on November 6, 2026. In it, the company’s product security team (PSIRT) said it had investigated a report indicating potential exploitation of this flaw. On the same day, CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog, the list of flaws confirmed to be used in real attacks. U.S. federal agencies have until November 20, 2026 to fix it.

Attack details have not been released. SecurityWeek noted that neither SonicWall nor CISA has shared information about the suspected attacks, and it is unclear whether the flaw was used before a fix was available. Ostorlab also noted that no indicators of compromise have been published.

Severity ratings differ between sources. SonicWall rates it CVSS 7.1 (high), with high attack complexity and a low-privilege account required. Ostorlab and Security Affairs cite a score of 7.5, which Ostorlab attributes to CISA’s assessment. The score is lower than that of most critical bugs, but confirmed exploitation puts it near the top of the patch list.

SonicWall devices are frequent targets. SecurityWeek counts 20 SonicWall-related vulnerabilities in the KEV catalog. BleepingComputer also pointed out that a maximum-severity flaw in SonicWall’s SMA1000 remote access appliances, CVE-2026-102255, saw exploitation attempts in October.

Affected devices and fixed versions

SonicWall’s advisory lists two firewall generations. Generation 7 (Gen7) covers the TZ, NSa, and NSsp series plus the NSv 270, 470, and 870 virtual firewalls. Generation 8 (Gen8) covers the TZ and NSa series plus NSv virtual firewalls in sizes XS through L. The virtual firewalls run on ESX, KVM, Hyper-V, AWS, and Azure, so organizations running firewalls in the cloud need to check them as well.

Affected versions are SonicOS 7.3.3-7015 and earlier on Gen7, and 8.2.2-8015 and earlier on Gen8. The fixes are SonicOS 7.3.4-7013 and later for Gen7, and 8.2.3-8015 and later for Gen8. SonicWall says there is no workaround. In the advisory, the company wrote, “Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks.”

Six other flaws in the same advisory

The update also closes six other flaws that have not been reported as exploited. Two sit in the SonicOS management interface and carry a CVSS score of 8.8: CVE-2026-107155 (a permissive cross-domain policy) and CVE-2026-107154 (session validation). SonicWall says that under specific conditions either one could let an unauthenticated remote attacker perform unauthorized operations.

Three more are pre-authentication buffer overflows that can knock a service offline: CVE-2026-82308 in the SSL-VPN (CVSS 7.5), and CVE-2026-77708 and CVE-2026-77709 in the TACACS+ authentication client (5.9 each). The last one, CVE-2026-19703 (CVSS 5.2), is weak password hashing on virtual appliances and can only be used by someone who already has high-privilege local access.

What this means for teams running office VPNs

An SSL-VPN has to be reachable from the internet so staff can work outside the office, which also keeps it in plain view of attackers. In a hospital, for example, the VPN may be how on-call doctors, IT staff, or application vendors reach the hospital information system from outside the building. If MFA on that path can be skipped, a single leaked password is enough to open access to sensitive data. We cover how health providers protect these systems on our digital healthcare solutions page.

Check SonicOS versions and SAML settings

List every SonicWall firewall you manage, including virtual firewalls in the cloud and devices at branch offices, along with the SonicOS version on each. Then check whether the SSL-VPN uses SAML for sign-in. Ostorlab recommends listing every account and authentication method the SSL-VPN accepts, since any non-SAML method is a path that can be abused.

Install the fixed version quickly

Because SonicWall offers no workaround, upgrading to SonicOS 7.3.4-7013 or 8.2.3-8015 is the only official fix. Ostorlab advises backing up the configuration and recording the current version before upgrading. For virtual firewalls, confirm that the running image is the new one, since restoring an old image with a new configuration brings the flaw back.

Reduce non-SAML sign-in paths until the upgrade

If the update cannot go in today, Ostorlab suggests disabling or removing SSL-VPN accounts that do not use SAML, while keeping an administrative path that does not depend on the SSL-VPN. Limiting SSL-VPN access to trusted IP addresses also reduces exposure, although it does not fix the flaw.

Review VPN sign-in logs

Look for successful sign-ins by accounts that should only use SAML but were recorded with another method. Compare source addresses and times against each account’s normal pattern, then check for unusual access to internal servers. Ostorlab recommends treating any doubtful sign-in as a possible compromise, resetting that account’s password, and reviewing the systems it could reach.

The case resembles the exploited Cisco ASA and FTD flaw from early November, where internet-facing VPN devices were the first target. Teams that want to map all their remote access gateways can start with a list of devices, versions, and the authentication methods active on each one.

Frequently asked questions

Can attackers get in without a password?

No. According to SonicWall’s advisory, the attacker still needs valid credentials for an alternate authentication method. The flaw skips the SAML and MFA checks, which makes a leaked or reused password enough to open the VPN.

Are SonicWall firewalls without SAML safe from this flaw?

For CVE-2026-19868, yes. SonicWall says the flaw only applies when SAML is enabled for SSL-VPN sign-in. The same advisory, however, includes two management interface flaws rated 8.8 and several others, so the update is still needed.

Are SonicWall SMA appliances affected?

Advisory SNWLID-2026-0014 only lists SonicOS Gen7 and Gen8 firewalls. The SMA remote access series has its own advisories, including CVE-2026-102255, which BleepingComputer reports saw exploitation attempts in October.

Conclusion

CVE-2026-19868 shows that MFA is only as strong as the weakest sign-in path next to it. Installing the fixed SonicOS release, cutting authentication methods that are not needed, and reviewing VPN logs remove most of the risk. If your organization needs help mapping its remote access devices and building an update routine, Merakit’s cybersecurity services team is ready to help.

Sources

• SonicWall PSIRT, SNWLID-2026-0014: SonicWall SonicOS Affected by Multiple Vulnerabilities (November 6, 2026)
• CISA, CISA Adds One Known Exploited Vulnerability to Catalog (November 6, 2026)
• BleepingComputer, SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks (November 6, 2026)
• SecurityWeek, SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins (November 7, 2026)
• Security Affairs, U.S. CISA adds SonicWall SonicOS SSLVPN flaw to its Known Exploited Vulnerabilities catalog (November 7, 2026)
• Ostorlab, SonicWall SSLVPN SAML Bypass, Exploited in the Wild (CVE-2026-19868) (November 7, 2026)