# SonicWall SSL-VPN flaw CVE-2026-19868 lets attackers skip SAML MFA and is already exploited. What to do

> SonicWall has patched a SonicOS SSL-VPN bug that lets someone holding valid credentials for another login method bypass SAML authentication, including SAML-enforced MFA. CISA added it to its exploited-vulnerabilities list on November 6, and there is no workaround, so Gen 7 and Gen 8 firewalls using SAML for VPN logins need the new firmware.

Published Nov 6, 2026 by TechMeasured Staff · Security · Canonical: https://techmeasured.com/security/sonicwall-sonicos-cve-2026-19868-ssl-vpn-saml-mfa-bypass-exploited-what-to-do

**SonicWall** has fixed an **SSL-VPN authentication flaw in SonicOS**, tracked as **CVE-2026-19868**, that attackers are already using. According to SonicWall's advisory **SNWLID-2026-0014**, as reported by BleepingComputer, a user who has valid credentials for an *alternate* authentication method can get around SAML authentication controls on the VPN, including multi-factor authentication enforced through SAML. **CISA added the bug to its Known Exploited Vulnerabilities catalog on November 6**, and SonicWall says there is no workaround.

Why it matters: many organisations put SAML single sign-on in front of their SonicWall VPN precisely so that a stolen password alone isn't enough to get in. This flaw undercuts that. If an attacker has a working password for another login path on the same appliance, the identity provider's MFA prompt may never come into play. It's also not the first SonicWall exploitation this year: BleepingComputer notes attacks on the company's SMA1000 remote-access appliances in July, September and October, though nothing links those to this bug.

## Who is affected

Only SSL-VPN services **configured to use SAML authentication** are exposed to CVE-2026-19868, per SonicWall's advisory as summarised by BleepingComputer and runZero. Physical and virtual (NSv) Gen 7 and Gen 8 firewalls are covered.

| Platform | Vulnerable | Fixed |
|---|---|---|
| Gen 7 firewalls and NSv 270/470/870 | SonicOS 7.3.3-7015 and earlier | 7.3.4-7013 or later |
| Gen 8 firewalls and NSv | SonicOS 8.2.2-8015 and earlier | 8.2.3-8015 or later |

WindowsForum, citing SonicWall's release notices, says 7.3.4-7013 became available on October 20 and 7.3.4-7015 on November 5, with 8.2.3-8015 scheduled for November 6. Gen 6 and older firewalls no longer receive firmware updates; SonicWall's guidance for those is to move to newer hardware.

SonicWall rates the flaw **7.1** (high), according to BleepingComputer; runZero lists it at 7.5, so you may see either figure in scanners. The CVE record classes it as CWE-308, use of single-factor authentication.

## What we know about the attacks

Very little. SonicWall says only that its PSIRT investigated a report indicating potential exploitation; it hasn't published indicators of compromise, attacker details or how many devices were hit. The KEV listing is what confirms in-the-wild use. CISA gave US federal civilian agencies until **November 20, 2026** to fix it. That deadline is binding only on those agencies, but it's a sensible ceiling for everyone else.

Because the bypass requires valid credentials for an alternate method, it's reasonable to assume attackers are pairing it with leaked or phished passwords. That's an inference, not something SonicWall has stated.

## Six other fixes in the same release

The advisory covers seven SonicOS bugs in total. runZero lists them as:

| CVE | Issue | CVSS (per runZero) |
|---|---|---|
| CVE-2026-107155 | Management interface: permissive cross-domain policy, unauthenticated actions under specific conditions | 8.8 |
| CVE-2026-107154 | Management interface: session validation flaw, unauthenticated actions under specific conditions | 8.8 |
| CVE-2026-82308 | Pre-auth heap overflow in SSL-VPN (denial of service) | 7.5 |
| CVE-2026-19868 | SSL-VPN SAML/MFA bypass (exploited) | 7.5 |
| CVE-2026-77708 | Pre-auth stack overflow in TACACS+ client (denial of service) | 5.9 |
| CVE-2026-77709 | Pre-auth heap overflow in TACACS+ client (denial of service) | 5.9 |
| CVE-2026-19703 | Weak password hashing on NSv virtual appliances | 5.1 |

Only CVE-2026-19868 is on CISA's exploited list so far.

## What to do now

1. **Find your SonicWall firewalls and their SonicOS versions.** Anything at or below 7.3.3-7015 (Gen 7) or 8.2.2-8015 (Gen 8) is vulnerable. runZero has published an inventory query for its platform that filters on these version ranges.
2. **Upgrade** to SonicOS 7.3.4-7013 or later on Gen 7, or 8.2.3-8015 or later on Gen 8. SonicWall offers no workaround, so firmware is the fix.
3. **Check whether SAML is enabled for SSL-VPN logins.** If it is, treat the appliance as a priority and review VPN logs for sessions that authenticated without going through your identity provider.
4. **Review alternate login methods.** Third-party write-ups suggest disabling local or LDAP VPN logins you don't need and restricting where the VPN is reachable from. These steps reduce exposure but are not vendor guidance and don't replace the patch.
5. **Rotate credentials** for VPN-capable accounts if you find suspicious sessions, and don't expose the management interface to the internet: two of the other bugs in this advisory are in that interface.
6. **Retire Gen 6 and older hardware.** It won't receive this or future fixes.

## What to watch

Look for SonicWall or CISA to publish indicators of compromise, and for incident-response firms to say who is behind the attacks. If exploitation details emerge, the management-interface bugs rated 8.8 are the next ones attackers are likely to examine.


## Sources

1. [BleepingComputer — SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/)
2. [runZero — SonicWall SonicOS vulnerabilities: find impacted appliances](https://www.runzero.com/blog/sonicwall/)
3. [WindowsForum — SonicWall SonicOS SSL-VPN SAML bypass: patch CVE-2026-19868 on Gen 7 and Gen 8 firewalls](https://windowsforum.com/news/sonicwall-sonicos-ssl-vpn-saml-bypass-patch-cve-2026-19868-on-gen-7-and-gen-8-firewalls.451277/)