Pricing Contact Case Studies Research Talk to a Pentester ↗
POCFORGE RESEARCH 3 MIN READ Threat intel

SonicWall SonicOS SSL VPN CVE-2026-19868: exploited SAML and MFA bypass, patch now

SonicWall has fixed CVE-2026-19868, a flaw in the SonicOS SSL VPN service that can let someone holding valid credentials for a different login method get past SAML authentication, including SAML-enforced MFA. SonicWall says it investigated a report of exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue on 6 November 2026. Only SSL VPNs with SAML login enabled are affected. There is no workaround: upgrade Gen7 firewalls to SonicOS 7.3.4-7013 and Gen8 to 8.2.3-8015, then review recent VPN sessions.

What changed

On 6 November 2026 SonicWall published advisory SNWLID-2026-0014 covering seven SonicOS vulnerabilities. The most urgent is CVE-2026-19868, an authentication enforcement weakness in the SSL VPN service. In SonicWall’s words, it "may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA)."

SonicWall rates it CVSS 7.1; the GitHub Advisory Database entry (GHSA-mq8w-j7h6-7q9w) lists 7.5. Exposure applies only where SSL VPN uses SAML-based login.

Exploitation evidence

  • SonicWall PSIRT: "has investigated a report indicating potential exploitation of this vulnerability."
  • CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalogue on 6 November 2026, with a federal remediation date of 20 November 2026.
  • Neither SonicWall nor CISA has published details of the attacks, and it is not yet clear whether the flaw was exploited before the fix was available.

Who is affected

  • Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or earlier.
  • Gen8 TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or earlier.
  • Exposure to CVE-2026-19868 applies only where SSL VPN uses SAML-based login.

This is not an unauthenticated flaw. An attacker needs working credentials for another authentication method, which is exactly what credential stuffing, phishing and older leaked VPN passwords tend to supply. Its real effect is to remove the MFA layer that many organisations rely on to make stolen passwords useless.

What to do now

  1. Patch. Upgrade Gen7 to SonicOS 7.3.4-7013 or later and Gen8 to 8.2.3-8015 or later. SonicWall states there are no workarounds.
  2. Check whether you are in scope. Confirm whether SSL VPN is configured for SAML login. If it is, treat the firewall as a priority even if MFA is enforced at your identity provider.
  3. Review alternate authentication paths. Identify any local, LDAP/RADIUS or other non-SAML accounts that can still authenticate to the SSL VPN. Disable those that are not needed and rotate passwords on those that remain.
  4. Look back at VPN activity. Review SSL VPN logins since well before the patch date for sessions that did not pass through your identity provider, unusual source locations, or accounts that normally sign in via SAML appearing through another method. Investigate anything that does not line up with IdP sign-in logs.
  5. Patch the rest of the bundle. The same advisory fixes six other SonicOS issues, including two management interface flaws rated 8.8 and pre-authentication denial-of-service bugs in SSL VPN and TACACS+. Keep management interfaces off the internet.

How PoCForge can help

If you run SonicWall SSL VPN, we can review your remote-access configuration for weak or unused authentication paths and check that MFA is enforced on every route into the network, not just the main one.

Sources