SonicWall SSLVPN CVE-2026-19868: attackers bypass SAML login and MFA

What happened

SonicWall firewalls running SonicOS can act as a VPN gateway (SSLVPN) for remote staff. Many organisations hand SSLVPN sign-in to their identity provider over SAML – Microsoft Entra ID, Okta and the like – and let that provider enforce multi-factor authentication (MFA).

CVE-2026-19868 undermines that setup. The CVE record, published by SonicWall and listed in the National Vulnerability Database (NVD), describes an authentication enforcement flaw in the SSLVPN service: a user who holds valid credentials for an alternate authentication method can bypass the SAML authentication controls. Because MFA lives behind SAML, it can be bypassed too. In practice, a username and password from an old breach or a phishing page may be enough to get onto the network.

On 6 November 2026 CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, which means it has evidence of real-world exploitation. Federal civilian agencies in the US must act by 20 November 2026. CISA lists use in ransomware campaigns as "unknown".

Technical details

The vector tells the story. The attack works over the network, needs no prior privileges and no user interaction, but is rated high complexity – the attacker first needs working credentials for another authentication method the gateway accepts. The scope is "changed": once through the VPN, the attacker reaches systems beyond the firewall itself.

The weak point is the policy, not the password check. When SSLVPN accepts SAML alongside another method (for example local firewall accounts or LDAP), vulnerable SonicOS versions don't reliably force users who are supposed to go through SAML to actually do so. A login with a password alone can then succeed where the organisation expected the identity provider – and its MFA prompt – to be in the way.

SonicWall's public advisory gives no further technical breakdown, and we haven't found an independent technical analysis we could verify. We won't speculate beyond the CVE description.

Who is affected

Organisations running SSLVPN on SonicWall firewalls with these versions, according to the CVE record and SonicWall:

• SonicOS Gen7 (physical and virtual) – 7.3.3-7015 and older
• SonicOS Gen8 (physical and virtual) – 8.2.2-8015 and older

The risk is highest where SSLVPN accepts SAML and at least one other way to sign in. Gen6 and older firewalls are outside the advisory: SonicWall says they are end of support and get no firmware updates at all. End users who simply connect to the VPN don't need to do anything – this is a job for the IT team.

How to tell if you were compromised

SonicWall hasn't published indicators of compromise or log guidance for this flaw, and CISA's entry doesn't include any either. Based on how the bypass works, this is where we would look in a SOC:

• SSLVPN logins that didn't go through SAML for users who should only ever sign in through your identity provider. Compare successful VPN sessions on the firewall with sign-ins recorded by the identity provider for the same time window – a VPN session with no matching IdP sign-in is the key signal.
• Unusual sources and timing – countries, ISPs or hours that don't fit the account.
• Accounts that rarely or never use the VPN, service accounts and old local accounts on the firewall.
• What happened after login – connections from the VPN address pool to file servers, domain controllers or admin interfaces.

Exported logs can be long. Our IOC extractor pulls IP addresses and domains out of them into a clean list, and it runs entirely in your browser. CISA also asks agencies to follow its forensic triage guidance under BOD 26-04 – a reasonable checklist for anyone.

What to do

1. Find your SonicOS version in the management interface and check whether SSLVPN is enabled.

2. Update. SonicWall's fixed versions for SNWLID-2026-0014:

   • Gen7 (physical and virtual): SonicOS 7.3.4-7013 and later. SonicWall also lists a newer build, 7.3.4-7015, released 5 November 2026.
   • Gen8 (physical and virtual): SonicOS 8.2.3-8015, which SonicWall scheduled for 6 November 2026.

   The advisory fixes several high- and medium-severity SonicOS flaws at once, so update even if you don't use SAML. SonicWall lists no workaround.

3. Limit exposure until you've updated. CISA's required action is to apply the vendor's mitigations, or stop using the product if none are available, and to assess internet exposure. Consider allowing SSLVPN only from known addresses, or switching it off for the time being. Check which sign-in methods besides SAML your SSLVPN accepts, and disable any you don't need. That last step is our recommendation based on the flaw description, not vendor guidance.

4. Review VPN logins from the past few weeks as described above.

5. If you find signs of abuse, reset the affected accounts' passwords (our password generator creates strong ones locally), end their active sessions and trace where they connected from the VPN. Report the incident to your national authority – in the US to CISA, in the UK to the NCSC.

Timeline