A login page with multi-factor authentication is supposed to be the hard part of a hacker’s day. For anyone running a SonicWall firewall with SAML-based SSL-VPN, that guarantee just broke. SonicWall has patched seven flaws in SonicOS, including an SSL-VPN authentication bypass tracked as CVE-2026-19868 that the company confirms has been exploited in real attacks. CISA has added it to its Known Exploited Vulnerabilities catalog with a fix deadline of 20 November 2026. Here is what the flaw does, which versions are affected, and what to patch today.
What CVE-2026-19868 Does
CVE-2026-19868 is an authentication bypass in the SonicOS SSL-VPN service. An attacker who already holds valid credentials for an alternate authentication method can abuse the flaw to bypass SAML authentication controls. In plain terms, the MFA your users complete through SAML can be skipped by someone who authenticates through a different route.
- Severity: CVSS 7.1 (high)
- Scope: only SonicOS SSL-VPN services configured to use SAML authentication
- Attack requirement: valid credentials for an alternate authentication method
- Impact: bypass of SAML controls, potentially including SAML-enforced MFA
- Discovered by: Ryan Harris of The Electronic Office
- Tracked as: CVE-2026-19868, advisory SNWLID-2026-0014
The bug matters most for organisations that rely on SAML as their MFA layer for remote access. If your SSL-VPN uses SAML to enforce the second factor, this flaw can turn that second factor into a speed bump.
Exploited in the Wild: What SonicWall and CISA Say
SonicWall published its advisory on Friday and did not mince words. The company’s PSIRT said it “investigated a report indicating potential exploitation of this vulnerability” and urged customers to upgrade “as soon as possible to mitigate the associated risks”. SonicWall has not shared details of the reported attack.
CISA then added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog, which confirms the flaw has been exploited in the wild and sets a binding deadline for US federal civilian agencies: secure affected systems by 20 November 2026. Even if you are not a federal agency, the KEV entry is the clearest signal that this is being used in real attacks right now.
The Other Six SonicOS Flaws
The same advisory covers six more vulnerabilities fixed in the same release. Two of them are rated 8.8 and deserve as much attention as the headline flaw.
- Two management interface flaws (CVSS 8.8): under specific conditions, unauthenticated attackers can perform unauthorised operations on the management interface.
- Pre-authentication buffer overflows: flaws in the SSL-VPN and TACACS+ services that can crash the device and cause denial of service.
- Weak password hashing: affects virtual appliances, making stolen password stores easier to crack.
SonicWall says no workarounds are available for any of the seven. Patching is the only fix.
Affected Versions and the Fix
Check your SonicOS version before anything else.
- Gen7 affected: 7.3.3-7015 and earlier. Fixed in 7.3.4-7013.
- Gen8 affected: 8.2.2-8015 and earlier. Fixed in 8.2.3-8015.
- Services at risk: SSL-VPN with SAML authentication (for CVE-2026-19868), management interface, TACACS+, and virtual appliance password storage.
What Admins Should Do Now
- Upgrade SonicOS. Move Gen7 builds to 7.3.4-7013 or later, and Gen8 builds to 8.2.3-8015 or later. Schedule the reboot window today if you have not.
- Confirm your SSL-VPN authentication setup. If you use SAML for the VPN, treat this as urgent. Until patched, consider tightening the alternate authentication paths your users can hit.
- Lock down the management interface. The 8.8-severity flaws make this urgent even without the VPN angle. Keep management access off the open internet and restricted to trusted networks.
- Review VPN logs. Look for logins that completed without the expected SAML step, odd source IPs, and access from accounts that normally never use the VPN.
- Rotate exposed credentials. If anything in your logs looks off, rotate the affected accounts and force new MFA enrolment.
- Treat SonicWall appliances as a target. This is the fourth wave of SonicWall attacks in 2026. Keep firmware current even when nothing is being exploited yet.
How to Tell If You Were Targeted
SonicWall has not said how the reported exploitation looked in practice, but the flaw’s shape tells defenders where to look. The attacker needs valid credentials for an alternate authentication method, so the trail starts with accounts that suddenly behave differently.
- Logins that skip the SAML step. Compare VPN authentication logs against your SAML identity provider logs. A session that authenticated to the VPN without a matching SAML assertion is the exact pattern this flaw produces.
- Accounts that never use the VPN. Service accounts, dormant users and contractors showing up in SSL-VPN logs deserve immediate attention.
- New source locations. Sessions from IPs and countries your users have never connected from, especially in a short burst after a quiet period.
- Management interface access. Given the two 8.8-severity management flaws in the same advisory, review who reached the management plane and from where. If the interface is reachable from the internet, treat exposure itself as an incident to fix.
- Post-login behaviour. Once inside, look for internal scanning, unusual DNS queries and access to file shares the account never touches.
If any of these turn up, assume the VPN credentials are compromised. Rotate them, revoke active sessions, and rebuild MFA enrolment rather than just resetting passwords.
Why This Keeps Happening to SonicWall
CVE-2026-19868 is not an isolated incident. In October, attackers began exploiting CVE-2026-102255, a maximum-severity flaw in SMA1000 appliances that was patched just days earlier. In September, researchers saw two SMA1000 zero-days chained together for remote code execution. In July, two other zero-days were used to deploy malware on vulnerable appliances. Remote access products sit at the edge of the network with credentials attached, which makes them the most valuable door in the building.
The pattern in each case is the same: a flaw in an authentication path, a short window between disclosure and mass scanning, and a patch that many admins apply late. The fix for CVE-2026-19868 is public and free. The only variable is how fast it lands on your firewall.
FAQ
What is CVE-2026-19868?
It is a SonicOS SSL-VPN authentication bypass with a CVSS score of 7.1. Attackers with valid credentials for an alternate authentication method can bypass SAML controls, including SAML-enforced MFA. SonicWall patched it on 6 November 2026.
Which SonicWall versions are affected by CVE-2026-19868?
SonicOS Gen7 builds 7.3.3-7015 and earlier, and Gen8 builds 8.2.2-8015 and earlier, are affected. The fixes are in Gen7 build 7.3.4-7013 and Gen8 build 8.2.3-8015. Only SSL-VPN services configured for SAML authentication are exposed to the bypass itself.
Has CVE-2026-19868 been exploited in attacks?
Yes. SonicWall’s PSIRT investigated a report of potential exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities catalog with a 20 November 2026 remediation deadline for federal agencies.
Are there workarounds for the SonicWall SSL-VPN MFA bypass?
No. SonicWall says no workarounds are available for any of the seven vulnerabilities fixed in this release. Upgrading to the patched SonicOS builds is the only mitigation.
