SonicWall Warns of an Exploited SSL VPN Flaw That Can Skip SAML and MFA: Patch Gen7 and Gen8 Firewalls Now
SonicWall patched CVE-2026-19868 in SonicOS SSL VPN, a high-severity authentication bypass that can skip SAML controls and SAML-enforced MFA. CISA added it to the KEV catalog the same day. Here is who is exposed and what to do.
If your company’s remote access rides on a SonicWall firewall with SAML login turned on, treat this as a same-day patch job. SonicWall has fixed a SonicOS SSL VPN flaw that can let someone with valid credentials for an alternate login method bypass SAML authentication—and with it, SAML-enforced multifactor authentication.
The details below are drawn from SecurityWeek’s report on SonicWall’s November 6 advisory and from CISA’s Known Exploited Vulnerabilities alert that listed the same CVE the same day.
What is broken
- CVE-2026-19868 sits in the SSL VPN service of SonicOS, the operating system on SonicWall firewalls.
- SonicWall describes an authentication-enforcement gap: a user with valid credentials for an alternate authentication method may bypass SAML authentication controls.
- Successful abuse may also bypass SAML-enforced MFA.
- CVSS is 7.1 (high). Exposure requires SAML-based login to be enabled on the SSL VPN.
- Reporter: Ryan Harris of The Electronic Office.
Who needs the upgrade
- Gen7 TZ, NSa, NSsp and NSv firewalls on SonicOS 7.3.3-7015 or older.
- Gen8 TZ, NSa and NSv firewalls on SonicOS 8.2.2-8015 or older.
- Fixed builds: SonicOS 7.3.4-7013 and 8.2.3-8015. SonicWall lists no workarounds.
Why this landed on the urgent list
SonicWall says its product security team investigated a report of potential exploitation. CISA added CVE-2026-19868 to the KEV catalog on November 6. Under Binding Operational Directive 26-04, federal civilian agencies must address it by November 20. Neither SonicWall nor CISA has published attack details, and it is not clear whether abuse began before the patch existed. The same advisory covers six other SonicOS issues that SonicWall did not mark as exploited, including two high-scoring management-interface flaws and several pre-authentication buffer overflows useful for denial of service.
Owner actions today
- Inventory every SonicWall appliance that terminates SSL VPN, and confirm whether SAML login is enabled.
- Upgrade to SonicOS 7.3.4-7013 or 8.2.3-8015 (or newer) as soon as change windows allow—there is no workaround in the advisory.
- After the upgrade, re-test remote login with SAML and MFA still required end to end.
- Review SSL VPN and authentication logs around the disclosure window for unexpected successful logins or alternate-method successes that should have been blocked by SAML.
- If you cannot patch immediately, tighten who can reach the SSL VPN listener and treat any unexplained remote session as suspect until the box is updated.
What this means for your company
Many small and mid-size firms put MFA “in front of” the VPN and assume that is enough. This bug is a reminder that MFA only helps if the firewall actually enforces the path you think it does. If SAML is your MFA gate and another login method still works on the same SSL VPN, an attacker who gets those alternate credentials can walk around the stronger control. Know every SonicWall in inventory, know which ones expose SSL VPN to the internet, and make firmware upgrades part of the same urgency you already give to edge appliances with public KEV listings.
Not sure which of your SonicWalls still run older SonicOS, or whether SSL VPN SAML is configured the way you think it is? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
