Skip to content

SonicWall SSL-VPN SAML and MFA bypass in KEV: CVE-2026-19868

CISA added SonicWall SonicOS SSL-VPN flaw CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on 6 November 2026: a user with valid credentials for another login method may bypass SAML, and with it "SAML-enforced multi-factor authentication (MFA)". Owners of SonicWall Gen 7 and Gen 8 firewalls, and MSPs who run them for customers, should upgrade any firewall that uses SAML for SSL-VPN logins; CISA's federal due date is 20 November 2026.

Runbook card

What changes: SonicWall says the SSL-VPN service "may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls", which may also bypass the MFA your identity provider enforces. SonicWall PSIRT "has investigated a report indicating potential exploitation"; CISA lists it as known exploited.
Who: Gen 7 firewalls (TZ, NSa, NSsp and NSv) on SonicOS 7.3.3-7015 and older, and Gen 8 firewalls (TZ, NSa and NSv) on SonicOS 8.2.2-8015 and older, but only where "SAML is enabled for SSLVPN logins".
By when: now. CISA due date for US federal agencies: 20 November 2026. SonicWall lists no workaround.
Do this: 1. List every firewall with SSL-VPN logins through SAML. 2. Upgrade Gen 7 to SonicOS 7.3.4-7013 or higher and Gen 8 to 8.2.3-8015 or higher. 3. Until then, look for SSL-VPN sessions that have no matching sign-in at your identity provider, and reset the credentials of any account you cannot explain.
Check: the firmware version in the SonicOS management interface (Device > Settings > Firmware and Settings) is 7.3.4-7013 or higher (Gen 7) or 8.2.3-8015 or higher (Gen 8).
Source: SonicWall advisory SNWLID-2026-0014 (6 November 2026) and the CISA KEV catalog (added 6 November 2026).

What SonicWall and CISA say

SonicWall's advisory SNWLID-2026-0014, first published 6 November 2026, titles the flaw "SSLVPN Authentication Enforcement Vulnerability via Alternate Authentication Methods". It rates it CVSS 7.1 (vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N, CWE-308 "Use of Single-factor Authentication"). The vector shows high attack complexity (AC:H) and low privileges required (PR:L): SonicWall says the attacker needs "valid credentials for an alternate authentication method".

The advisory says: "SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability." It also says the flaw "ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins." Workaround: "None."

CISA added CVE-2026-19868 to the KEV catalog on 6 November 2026 with a due date of 20 November 2026, under the name "SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability". Use in ransomware campaigns is listed as "Unknown".

What is not public yet: SonicWall has not published indicators, how the reported exploitation was carried out, or how many devices were affected.

Affected and fixed versions

Platform Affected Fixed
Gen 7 hardware (TZ 270 to TZ 670, NSa 2700 to NSa 6700, NSsp 10700 to NSsp 15700) and Gen 7 NSv (270, 470, 870) 7.3.3-7015 and older 7.3.4-7013 and higher
Gen 8 hardware (TZ 80 to TZ 680, NSa 2800 to NSa 5800) and Gen 8 NSv (XS, S, M, L) 8.2.2-8015 and older 8.2.3-8015 and higher

The NSv virtual appliances are listed for ESX, KVM, Hyper-V, AWS and Azure.

The other six flaws in the same release

The same advisory fixes six more SonicOS flaws. None of them is listed as exploited, but the upgrade covers them all:

  • CVE-2026-107155 and CVE-2026-107154 (CVSS 8.8 each): management interface flaws that "could potentially enable a remote unauthenticated attacker to perform unauthorized operations". Keep the management interface off the internet.
  • CVE-2026-82308 (7.5): pre-authentication heap buffer overflow in the SSL-VPN service, denial of service.
  • CVE-2026-77708 and CVE-2026-77709 (5.9 each): pre-authentication buffer overflows in SonicOS TACACS+ handling, denial of service.
  • CVE-2026-19703 (5.2): weak password hashing on virtual appliances, needs existing local access.

How to check (read-only)

  1. Firmware: in the SonicOS management interface, Device > Settings > Firmware and Settings shows the running version. Compare it with the table above.
  2. Exposure: for each firewall, confirm whether SSL-VPN is enabled and whether its logins use SAML. If SSL-VPN is off, or SAML is not used for SSL-VPN logins, SonicWall says this flaw does not apply (the other six may still apply).
  3. Our suggested hunt, not vendor guidance: export the SonicOS SSL-VPN login events for the last 30 days and compare them with your identity provider's sign-in log for the SonicWall SAML app. In Entra ID that is Entra admin center > Entra ID > Monitoring & health > Sign-in logs, filtered by the SonicWall enterprise application. An SSL-VPN session for a user with no matching identity provider sign-in at that time is the one to explain.

How to verify the fix

After the upgrade, the firmware page shows 7.3.4-7013 or higher (Gen 7) or 8.2.3-8015 or higher (Gen 8). Then sign in to SSL-VPN with a test account and confirm the login goes through your identity provider and its MFA prompt, and that the sign-in appears in the identity provider's log.

Rollback and impact

A firmware upgrade reboots the firewall, so plan a short outage for VPN users and site links, and export the configuration first. If you reset credentials for an account with unexplained sessions, end its active SSL-VPN sessions as well.

Related: the KEV catch-up for SharePoint, ScreenConnect and PAN-OS, the FortiOS, FortiMail and NetScaler KEV catch-up, the Conditional Access Baseline Kit for the identity provider side, every dated action on Microsoft 365 security deadlines, more Threats & vulnerabilities news and Identity & access news.

Sources

Last reviewed: 7 November 2026. Runbook Lab is not affiliated with SonicWall or Microsoft.