SonicWall CVE-2026-19868: SSL VPN MFA Bypass Under Attack

CVE-2026-19868 is a confirmed, actively exploited vulnerability in SonicWall's SonicOS SSLVPN service that lets an attacker who already holds valid credentials for one login method skip SAML authentication entirely — bypassing any SAML-enforced multi-factor authentication (MFA) protecting the SSL VPN. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on November 6, 2026, giving federal civilian agencies until November 20, 2026 to remediate it under Binding Operational Directive (BOD) 26-04. SonicWall says it has investigated a report pointing to likely real-world exploitation, and the company has not published a workaround — the only fix is upgrading SonicOS.

Here is what the vulnerability does, which firmware builds are exposed, why CISA moved so quickly, and what administrators should do today.

What is CVE-2026-19868?

CVE-2026-19868 is one of seven vulnerabilities SonicWall disclosed together in advisory SNWLID-2026-0014, but it is the only one of the seven that CISA has confirmed is being exploited. SonicWall's own description of the bug is narrow and specific: an authentication enforcement vulnerability in the SonicOS SSLVPN service "may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls," and successful exploitation "may also bypass SAML-enforced multi-factor authentication (MFA)."

The underlying weakness is catalogued as CWE-308, "Use of Single-factor Authentication." In plain terms, a login path that is supposed to require a second factor — because an administrator configured SAML with enforced MFA — can instead be satisfied with just one factor, because the SSLVPN service doesn't correctly enforce the SAML step when a different, valid authentication method is available for the same account. SonicWall's advisory is explicit that this only matters for deployments that have SAML enabled for SSLVPN logins in the first place; firewalls that authenticate SSL VPN users some other way aren't exposed to this specific flaw.

NVD's record for the CVE lists a CVSS 3.1 base score of 7.5 (High), while SonicWall's own advisory scores it 7.1 under a slightly different vector. Both place it well into high-severity territory, driven by the network attack vector and the fact that a successful bypass gives an attacker read access to whatever a legitimate VPN session would expose.

How the SAML/MFA bypass actually works

It's worth being precise about what this bug does — and doesn't — let an attacker do, because "MFA bypass" headlines can overstate the risk. CVE-2026-19868 is not a way to log in with no credentials at all. The attacker still needs valid credentials for some authentication method the firewall accepts for that account — for example, a local user database entry, LDAP, RADIUS, or another method configured alongside SAML. What the flaw removes is the guarantee that logging in through that alternate method still forces the user through the organization's SAML identity provider and whatever MFA policy is attached to it.

That distinction matters for two reasons. First, it means the realistic attack scenario involves an adversary who has already obtained one valid credential set — through phishing, credential stuffing, a prior breach, a leaked password, or an insider — and is using this bug to strip away the MFA layer an organization specifically added to stop exactly that kind of stolen-password attack from succeeding. Second, it explains why CISA's SSVC assessment for this CVE marks "automatable" as "no": exploitation isn't a mass, unauthenticated, point-and-shoot attack against every exposed SonicWall box; it requires an attacker to already have a foothold in the form of working credentials, then target devices where SAML is enabled for SSL VPN. CISA's SSVC data does mark the technical impact as "partial" and, critically, exploitation status as "active."

The practical effect is that SAML-enforced MFA — often deployed specifically to satisfy cyber-insurance requirements or compliance frameworks after earlier SonicWall SSL VPN credential-stuffing waves — stops doing its job for accounts an attacker can authenticate as through the alternate path. For organizations that treat SAML/MFA as the backstop against reused or stolen passwords on their VPN gateway, that backstop is the thing this bug removes.

Confirmed active exploitation and the CISA KEV listing

SonicWall's advisory carries an unusually direct warning for a vendor bulletin: "SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks." That statement, combined with CISA's own exploitation classification, is why CVE-2026-19868 — and not the other six CVEs in the same bulletin — landed in the Known Exploited Vulnerabilities catalog on November 6, 2026.

The KEV entry names the product as "SonicOS SSLVPN" and titles the vulnerability "SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability." CISA's catalog currently lists "Unknown" for known ransomware campaign use, meaning there's no confirmed link to a specific ransomware operation yet — exploitation has been observed, but its downstream purpose hasn't been publicly tied to ransomware at this time.

This is a different SonicWall product and bug class than the SSRF vulnerability CISA and SonicWall addressed in the company's SMA1000 appliance line earlier this month. That one was a maximum-severity server-side request forgery issue in the SMA1000 secure mobile access gateways; CVE-2026-19868 instead hits SonicOS, the operating system that runs SonicWall's TZ, NSa, NSsp, and related firewall hardware, and the flaw class here is authentication enforcement, not SSRF.

The November 20 deadline and BOD 26-04

CISA's required action for CVE-2026-19868 instructs agencies to "apply mitigations in accordance with vendor instructions," stay compliant with BOD 26-04, and "follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable." Agencies are also told they're responsible for evaluating each affected asset's internet exposure.

BOD 26-04 is CISA's current risk-based patching directive for federal civilian executive branch agencies, and it replaced the older BOD 19-02 and BOD 22-01. Rather than a single blanket deadline for every KEV entry, it sets remediation windows based on four factors: whether the asset is internet-exposed, whether the vulnerability is in the KEV catalog, whether exploitation can be automated, and the technical impact of a successful attack. The clock for a given CVE starts either when CISA adds it to KEV or when an agency identifies the affected asset on its network, whichever comes first. For CVE-2026-19868, that clock started on the November 6, 2026 KEV addition date, and the resulting window closes on November 20, 2026 — a 14-day turnaround consistent with how CISA treats confirmed, actively exploited network-edge vulnerabilities.

BOD 26-04 is binding only on federal civilian agencies, but CISA and most enterprise security teams treat KEV deadlines as the de facto patch-by date for any organization, public or private, running the affected product. If your organization runs SonicWall SSLVPN with SAML enabled, November 20 is a reasonable internal deadline even if BOD 26-04 doesn't technically apply to you.

Affected SonicOS versions and the fix

NVD's record for CVE-2026-19868, built from SonicWall's own vulnerability data, lists the affected SonicOS branches as follows:

SonicWall's advisory page doesn't publish a version-by-version table for this specific CVE; its guidance is simply to "upgrade to the latest release as soon as possible." SonicOS 7.3.4-7013, a maintenance release SonicWall shipped in October 2026, is the first Gen7 release after the last affected 7.3.3 build; SonicOS 8.2.3-8015, described in SonicWall's own release notes as a feature release that "includes the features and fixes of SonicOS 8.0.0 through 8.2.2," is the first Gen8 release after the last affected 8.2.2 build. Both release-note pages are maintained directly by SonicWall. Neither document itemizes CVE-2026-19868 by number — vendors frequently omit CVE references from release notes — so administrators should treat "run the current general-availability release for your platform" as the operative instruction rather than hunting for a single named hotfix.

There is no SonicOS version, Gen6 or otherwise, listed as a workaround path in SonicWall's advisory, and the company marks this bulletin's workaround field as unavailable. Upgrading firmware is the only remediation SonicWall has published for CVE-2026-19868.

Is your SonicWall firewall affected?

Two conditions both have to be true for a device to be exposed to this specific bug:

1. The firewall is running SonicOS Gen7 7.3.3-7015 or earlier, or Gen8 8.2.2-8015 or earlier.
2. SAML is enabled as an authentication method for SSLVPN logins on that device.

SonicWall's advisory is explicit that the vulnerability "ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins." Administrators who have never configured SAML for their SSL VPN portal, or who authenticate VPN users purely through local accounts, LDAP, or RADIUS without a SAML layer, are not exposed to this particular CVE — though six other vulnerabilities in the same SNWLID-2026-0014 bulletin may still apply to their deployment and should be checked separately. Organizations that did add SAML specifically to get MFA on the SSL VPN — a common step after earlier waves of SonicWall SSL VPN credential-stuffing attacks — are exactly the population this bug targets, since it's their MFA enforcement that gets bypassed.

What to do now: mitigation and next steps

Because SonicWall has not published an interim workaround, the available options are narrower than usual:

• Patch immediately. Upgrade Gen7 firewalls to SonicOS 7.3.4-7013 or later, and Gen8 firewalls to SonicOS 8.2.3-8015 or later, following SonicWall's standard firmware upgrade process. Back up your configuration first, since downgrading from newer SonicOS 8.2.x builds is unsupported once their settings are applied.
• Treat it as urgent if SAML is enabled. If your SSLVPN deployment uses SAML with enforced MFA and you cannot patch within CISA's window, assume the MFA protection on that gateway is not reliable until the firmware is updated.
• Follow CISA's required action if you're a federal agency. That means remediating by November 20, 2026, assessing the asset's internet exposure, and — per CISA's own wording — "discontinue use of the product if mitigations are unavailable" for cases where patching genuinely can't happen in time.
• Check logs for anomalous SSL VPN authentications. Given confirmed exploitation, review SSL VPN login logs for sign-ins that used an alternate (non-SAML) authentication method on accounts that should normally be going through SAML/MFA, particularly from unfamiliar source IPs.
• Review the rest of the SNWLID-2026-0014 bulletin. The advisory also covers a permissive cross-domain policy bug, a management-interface session validation flaw, buffer overflows in the SSL-VPN and TACACS+ services, and a weak password hashing issue on virtual appliances. None of those six are currently listed in CISA's KEV catalog, but the same firmware upgrade that fixes CVE-2026-19868 addresses all seven.

SonicWall's SSL VPN has been a recurring target: the vendor's own SMA1000 line needed an urgent fix for a maximum-severity SSRF bug just weeks ago, and — as with that incident and with unrelated VPN products like Palo Alto's GlobalProtect — the pattern of attackers moving quickly on edge VPN devices once a flaw becomes public is now routine. Internet-facing VPN concentrators, whichever vendor makes them, are consistently among the first systems probed once a KEV entry appears. If you're weighing whether SonicOS is still the right platform for your perimeter, our comparison of SonicWall against Fortinet's next-gen firewall lineup covers how the two vendors' security track records and feature sets stack up heading into 2026.

The other six vulnerabilities in SNWLID-2026-0014

For teams planning a single maintenance window, it helps to know the full scope of what SonicWall patched alongside CVE-2026-19868. The advisory's remaining six entries are a permissive cross-domain policy flaw and a session-validation flaw in the SonicOS management interface (both scored 8.8 by SonicWall, higher than CVE-2026-19868 itself), a pre-authentication heap buffer overflow in the SSL-VPN service, two pre-authentication buffer overflows in the TACACS+ authentication client, and a weak password hashing issue affecting SonicOS virtual appliances. None of those six currently appear in CISA's KEV catalog, and SonicWall's advisory does not claim observed exploitation for them — only CVE-2026-19868 carries that warning. Since all seven are fixed by upgrading to the same current SonicOS release, there's no reason to patch for CVE-2026-19868 alone and leave the rest for later.

Patching remains the only path SonicWall has published for closing this hole. Given confirmed exploitation and a federal deadline less than two weeks after the KEV listing, any organization running SonicOS SSLVPN with SAML enabled should move this to the top of the queue.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage