High
SonicWall, SonicOS, CVE-2026-19868, SSL-VPN, SAML, MFA bypass, CISA KEV, firewall, edge devices
SonicWall CVE-2026-19868: Exploited SSL-VPN MFA Bypass
SonicWall CVE-2026-19868 lets users skip SAML and MFA on SonicOS SSL-VPN. In CISA KEV, due Nov 20. Fixed in 7.3.4-7013 and 8.2.3-8015, no workaround.
CVE-2026-19868 is an exploited SonicWall SonicOS flaw that lets someone with valid credentials for another sign-in method skip SAML authentication on the SSL-VPN, including SAML-enforced multi-factor authentication (MFA). CISA added it to its Known Exploited Vulnerabilities catalog on November 6 with a November 20 deadline for federal agencies. Fixed versions are SonicOS 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8), and SonicWall says there is no workaround.
The flaw only matters on firewalls whose SSL-VPN is set up to use SAML, typically to push users through an identity provider like Okta or Microsoft Entra ID for MFA. If the same firewall also accepts another authentication method, such as local or LDAP accounts, a user holding a valid password for that other method can reach the VPN without passing the SAML step. In practice that turns a stolen or guessed VPN password back into a working login, which is exactly what MFA was meant to stop. SonicWall rates it 7.1 and NVD 7.5 (NVD entry), classed as CWE-308, use of single-factor authentication.
SonicWall's advisory SNWLID-2026-0014, published November 6, says its PSIRT "investigated a report indicating potential exploitation" and urges an immediate upgrade. It has not said who was attacked or how. Ryan Harris of The Electronic Office reported the bug, per BleepingComputer.
Which SonicOS versions are affected by CVE-2026-19868?
The same advisory fixes six more SonicOS flaws, and all seven share the same fixed builds.
CVE | Issue | CVSS | Auth needed |
|---|---|---|---|
CVE-2026-19868 | SSL-VPN SAML and MFA bypass, exploited | 7.1 to 7.5 | Valid alternate credentials |
CVE-2026-107155 | Permissive cross-domain policy in management interface | 8.8 | None, under specific conditions |
CVE-2026-107154 | Session validation flaw in management interface | 8.8 | None, under specific conditions |
CVE-2026-82308 | Pre-auth heap overflow in SSL-VPN, denial of service | 7.5 | None |
Three more | Pre-auth TACACS+ buffer overflows (DoS) and weak password hashing on virtual appliances | See advisory | Varies |
Affected: SonicOS Gen7 7.3.3-7015 and earlier, and Gen8 8.2.2-8015 and earlier. Fixed: 7.3.4-7013 and 8.2.3-8015.
Is CVE-2026-19868 being exploited, and what should SonicWall admins do?
CISA's catalog listing confirms exploitation, even though the flaw's EPSS score is just 0.6% (50th percentile). EPSS often lags on newly disclosed bugs, and the CISA KEV entry is the stronger signal. Upgrade first. Then, since the bypass needs valid credentials for a second method, review whether your SAML-protected SSL-VPN really needs local or LDAP sign-in enabled at all, and reset passwords for those accounts if it does. Check recent VPN logs for sessions that authenticated without a matching SAML assertion, and keep the management interface off the internet, given the two 8.8 management-plane bugs in the same release.
This is the latest in a run of SonicWall edge bugs. SMA1000 appliances were hit by zero-days in July and September and by attempts on a maximum-severity flaw in October, which we covered in the SMA 1000 zero-days report.
Our read
MFA bypasses rarely need clever exploits. They usually come from a second door nobody remembers is open, here an alternate sign-in method left enabled beside SAML. Upgrading is required, since SonicWall says there is no workaround and the same release fixes six other flaws. After that, the lasting lesson is configuration: one authentication path to the VPN, enforced everywhere. A rating of 7.1 will push this down most patch queues; a KEV listing on an internet-facing VPN should pull it to the top. For more on why, read what CISA KEV is and how attackers get around phishing-resistant MFA. For a recent edge VPN case, see our Check Point VPN coverage. To test what your exposed login paths actually allow, Nexus Void runs VAPT on web apps, APIs and mobile apps.
Reporting by BleepingComputer and The Hacker News; fixes per SonicWall PSIRT; KEV per CISA, EPSS per FIRST.