SonicWall SSL-VPN flaw CVE-2026-19868 lets attackers skip SAML MFA and is already exploited. What to do

SonicWall has fixed an SSL-VPN authentication flaw in SonicOS, tracked as CVE-2026-19868, that attackers are already using. According to SonicWall's advisory SNWLID-2026-0014, as reported by BleepingComputer, a user who has valid credentials for an alternate authentication method can get around SAML authentication controls on the VPN, including multi-factor authentication enforced through SAML. CISA added the bug to its Known Exploited Vulnerabilities catalog on November 6, and SonicWall says there is no workaround.

Why it matters: many organisations put SAML single sign-on in front of their SonicWall VPN precisely so that a stolen password alone isn't enough to get in. This flaw undercuts that. If an attacker has a working password for another login path on the same appliance, the identity provider's MFA prompt may never come into play. It's also not the first SonicWall exploitation this year: BleepingComputer notes attacks on the company's SMA1000 remote-access appliances in July, September and October, though nothing links those to this bug.

Who is affected

Only SSL-VPN services configured to use SAML authentication are exposed to CVE-2026-19868, per SonicWall's advisory as summarised by BleepingComputer and runZero. Physical and virtual (NSv) Gen 7 and Gen 8 firewalls are covered.

WindowsForum, citing SonicWall's release notices, says 7.3.4-7013 became available on October 20 and 7.3.4-7015 on November 5, with 8.2.3-8015 scheduled for November 6. Gen 6 and older firewalls no longer receive firmware updates; SonicWall's guidance for those is to move to newer hardware.

SonicWall rates the flaw 7.1 (high), according to BleepingComputer; runZero lists it at 7.5, so you may see either figure in scanners. The CVE record classes it as CWE-308, use of single-factor authentication.

What we know about the attacks

Very little. SonicWall says only that its PSIRT investigated a report indicating potential exploitation; it hasn't published indicators of compromise, attacker details or how many devices were hit. The KEV listing is what confirms in-the-wild use. CISA gave US federal civilian agencies until November 20, 2026 to fix it. That deadline is binding only on those agencies, but it's a sensible ceiling for everyone else.

Because the bypass requires valid credentials for an alternate method, it's reasonable to assume attackers are pairing it with leaked or phished passwords. That's an inference, not something SonicWall has stated.

Six other fixes in the same release

The advisory covers seven SonicOS bugs in total. runZero lists them as:

Only CVE-2026-19868 is on CISA's exploited list so far.

What to do now

1. Find your SonicWall firewalls and their SonicOS versions. Anything at or below 7.3.3-7015 (Gen 7) or 8.2.2-8015 (Gen 8) is vulnerable. runZero has published an inventory query for its platform that filters on these version ranges.
2. Upgrade to SonicOS 7.3.4-7013 or later on Gen 7, or 8.2.3-8015 or later on Gen 8. SonicWall offers no workaround, so firmware is the fix.
3. Check whether SAML is enabled for SSL-VPN logins. If it is, treat the appliance as a priority and review VPN logs for sessions that authenticated without going through your identity provider.
4. Review alternate login methods. Third-party write-ups suggest disabling local or LDAP VPN logins you don't need and restricting where the VPN is reachable from. These steps reduce exposure but are not vendor guidance and don't replace the patch.
5. Rotate credentials for VPN-capable accounts if you find suspicious sessions, and don't expose the management interface to the internet: two of the other bugs in this advisory are in that interface.
6. Retire Gen 6 and older hardware. It won't receive this or future fixes.

What to watch

Look for SonicWall or CISA to publish indicators of compromise, and for incident-response firms to say who is behind the attacks. If exploitation details emerge, the management-interface bugs rated 8.8 are the next ones attackers are likely to examine.