SonicWall CVE-2026-19868 Exploited to Bypass SAML MFA

SonicWall CVE-2026-19868 is an exploited authentication flaw in the SonicOS SSLVPN service. Someone holding valid credentials for an alternate login method can get past SAML controls, including SAML-enforced MFA. SonicWall published advisory SNWLID-2026-0014 on November 6, 2026, and CISA added the bug to its KEV catalog the same day, with a November 20 federal deadline. If SAML protects your SSLVPN logins, upgrade to 7.3.4-7013 or 8.2.3-8015 first, then review who logged in and how.

What happened with SonicWall CVE-2026-19868

SonicWall's advisory covers seven SonicOS vulnerabilities in Gen 7 and Gen 8 firewalls. CVE-2026-19868 is the one under attack. SonicWall says its PSIRT investigated a report indicating potential exploitation, and it has not published incident details. BleepingComputer names Ryan Harris of The Electronic Office as the reporter.

CISA's KEV entry is firmer than the vendor's wording. The bug was added on November 6 with a due date of November 20, and known ransomware use is listed as unknown. The Canadian Centre for Cyber Security's advisory AV26-1133 also says SonicWall indicates the flaw is being exploited.

No victim count, threat actor, indicator list or public proof of concept had been published when this article went live. Treat the absence of indicators as a gap in the public record, and do not read it as evidence that your firewall is clean.

Who is affected

The exposure has two conditions: the firewall runs an affected build, and SAML is enabled for SSLVPN logins. SonicWall says the flaw affects the SSLVPN service only in that configuration. Both hardware and NSv virtual firewalls are in scope.

Gen 7: SonicOS 7.3.3-7015 and older. Fixed in 7.3.4-7013 and later.
Gen 8: SonicOS 8.2.2-8015 and older. Fixed in 8.2.3-8015 and later.

Version listings differ slightly between sources. The CVE record and reporting on the SonicWall advisory say 8.2.2-8015 is itself affected, while the Canadian advisory reads "prior to 8.2.2-8015". Follow the CVE record and treat 8.2.2-8015 as vulnerable. The 8.2.3-8015 release notes list the fix as an SSLVPN authentication enforcement vulnerability via alternate authentication methods.

Technical analysis

The CVE record classes this as CWE-308, use of single-factor authentication. In plain terms, a login that policy says must go through SAML and the identity provider's MFA can succeed on one factor instead, if the attacker has working credentials for a different authentication method on the same account. If that weakness class is new to you, see our explainer on what CWE-308 single-factor authentication means.

This is an enforcement failure. The published descriptions do not claim a cryptographic break of SAML, and an attacker still needs a valid password or equivalent secret. That precondition offers less comfort than it seems to, because VPN passwords are a common target. In its 2025 SSLVPN notice, SonicWall reported incidents in which local passwords carried over from Gen 6 to Gen 7 migrations had not been reset.

The published impact is a VPN session with whatever reach that account has. The advisory material does not describe code execution, account creation or privilege escalation on the firewall itself. In practice, the blast radius depends on the VPN access rules attached to the account.

SonicWall has not listed which alternate methods apply. Do not assume the list is limited to local users. Review every authentication source configured on the firewall, including any LDAP, RADIUS or TACACS+ integration, and every account with SSLVPN access that could use one of them.

Severity scores disagree

SonicWall rates the flaw 7.1 with a vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N. CISA's ADP entry in the CVE record gives 7.5 and sets privileges required to none. The gap comes down to that one metric. Neither number should set your priority here, because vendor and CVSS scores often disagree and the KEV listing settles the question.

Other flaws in the same advisory

Upgrading also closes six flaws that are not on KEV:

CVE-2026-107155 and CVE-2026-107154: management interface flaws, both rated 8.8.
CVE-2026-82308: pre-authentication heap overflow in the SSL-VPN service, rated 7.5.
CVE-2026-77708 and CVE-2026-77709: overflows in the TACACS+ client, both rated 5.9.
CVE-2026-19703: weak password hashing on virtual appliances.

What to do now

Find every Gen 7 and Gen 8 firewall, including NSv instances. Record the current build from System > Status or with show version at the CLI.
Mark the firewalls with SAML enabled for SSLVPN. These come first. The rest still need the upgrade for the six other flaws.
Back up the configuration, then upgrade to 7.3.4-7013 or later on Gen 7 and 8.2.3-8015 or later on Gen 8. SonicWall lists no workaround.
On NSv, make sure the running image is the fixed build. Ostorlab warns that restoring a configuration onto an old image brings the flaw back.
Review SSLVPN authentication logs for successful logins by SAML users through any other method. Our guide on how to audit SSL VPN logins for non-SAML access walks through the comparison.
For any login you cannot explain, treat the account as compromised: reset its credentials, end its sessions and review what it could reach.

If the upgrade has to wait for a change window, reduce exposure in the meantime. Ostorlab suggests removing SSLVPN access from accounts that can use a non-SAML method, keeping a separate administrative path, and restricting SSLVPN to trusted source addresses. These steps narrow the risk and do not fix the flaw.

Patching closes this bug, but it does not change the design choice behind the exposure. SonicWall's 8.2.3 release notes say that upgraded firewalls keep their existing authentication configuration, so an account that had a second login method before the upgrade will still have one afterward. Use this upgrade to decide why SAML MFA needs every other login path closed.

What to watch next

Watch SNWLID-2026-0014 for changes, especially a list of the affected alternate methods or any indicators of compromise. Those details would make log review much more precise. Also watch for a change to KEV's ransomware field, which currently reads unknown.

SonicWall access products have seen repeated attacks this year. BleepingComputer reports attacks on SMA1000 appliances in July, September and October, although nothing published ties them to this flaw. ReliaQuest also described in-the-wild exploitation of an earlier SonicOS MFA bypass, CVE-2024-12802, between February and March 2026, and said that firmware alone left a configuration gap on Gen 6 devices. Check your firewall configuration against the advisory after the upgrade, and do not stop at the version number.