SonicWall CVE-2026-19868: SAML MFA bypass

Most teams that put SAML in front of their SSL-VPN did it for one reason: to force every remote login through the identity provider, and through the MFA prompt that lives there. CVE-2026-19868 breaks that promise on SonicWall firewalls. On 6 November 2026 SonicWall published advisory SNWLID-2026-0014, and the same day CISA added this CVE to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of 20 November.

What the vulnerability is

SonicWall describes it as an authentication enforcement flaw in the SonicOS SSL-VPN service. A user who holds valid credentials for an alternate authentication method can bypass the SAML authentication controls, and with them any MFA that SAML was enforcing. CISA files it under CWE-308, use of single-factor authentication. The vendor scores it CVSS 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).

Two details in the advisory matter more than the score:

• It needs a working credential. This is not an unauthenticated bypass. The attacker needs a username and password that the firewall will accept through some other method. Credentials from phishing, password reuse or an old breach dump are the obvious supply.
• It only applies when SAML is enabled for SSL-VPN logins. SonicWall says so explicitly. If your SSL-VPN does not use SAML, this particular CVE does not apply, though the rest of the advisory may.

The reason it is serious anyway: the whole point of MFA on a VPN is to make a stolen password worthless. This flaw turns a stolen password back into a working VPN session. SonicWall's advisory states that its PSIRT "has investigated a report indicating potential exploitation", and CISA's listing means it has evidence of exploitation in the wild. CISA marks known ransomware use as unknown.

The rest of SNWLID-2026-0014

CVE-2026-19868 is one of seven CVEs in the same advisory, and the fixed releases cover all of them. The highest-scored are two SonicOS management interface flaws, each CVSS 8.8:

• CVE-2026-107155, a permissive cross-domain policy issue that could let a remote unauthenticated attacker perform unauthorized operations under specific conditions.
• CVE-2026-107154, a session validation flaw (CWE-291, reliance on IP address for authentication) with the same stated impact.

The advisory also lists a pre-authentication heap overflow in the SSL-VPN service (CVE-2026-82308, CVSS 7.5, denial of service), two pre-authentication overflows in the TACACS+ client (CVE-2026-77708 and CVE-2026-77709, CVSS 5.9, denial of service) and weak password hashing on virtual appliances (CVE-2026-19703, CVSS 5.2, needs existing local access). Only CVE-2026-19868 is in KEV at the time of writing.

Affected and fixed versions

From the vendor advisory:

Platform	Affected	Fixed
Gen7 hardware (TZ 270–670, NSa 2700–6700, NSsp 10700–15700) and Gen7 NSv (270, 470, 870)	7.3.3-7015 and older	7.3.4-7013 and higher
Gen8 hardware (TZ 80–680, NSa 2800–5800) and Gen8 NSv (XS, S, M, L)	8.2.2-8015 and older	8.2.3-8015 and higher

NSv covers ESX, KVM, Hyper-V, AWS and Azure deployments. SonicWall lists no workaround. Gen6 and older platforms are not named in the advisory; if you still run one, check its support status with SonicWall directly rather than assuming it is unaffected.

What to do

1. Find every SonicWall firewall you own, including NSv instances in cloud accounts. Virtual firewalls are the ones most often left off a patch list, because they were stood up by whoever built that environment.
2. Upgrade to 7.3.4-7013+ (Gen7) or 8.2.3-8015+ (Gen8). There is no workaround, so the upgrade is the fix.
3. Check whether SSL-VPN uses SAML. If it does, you are in scope for the exploited flaw. Until you upgrade, review which other authentication methods are still enabled for SSL-VPN users (local users, LDAP, RADIUS) and turn off any that you do not need. This is our suggestion based on how the flaw is described, not vendor guidance.
4. Review recent SSL-VPN sessions. Look for logins that succeeded without a matching sign-in event at your identity provider. A VPN session with no IdP record is exactly what this bypass produces.
5. Reset passwords for VPN-capable accounts if you find anything odd. The attack relies on a credential that already works, so assume that credential is known.
6. Take the management interface off the internet. The two CVSS 8.8 flaws in this advisory are in the management interface. It should be reachable only from an admin network or VPN, never from the public internet.

Why edge devices keep showing up here

We have covered this class of bug before, in the Check Point IKEv1 authentication bypass and the October edge-device round-up. The pattern is the same each time: the device is internet-facing by design, it is patched less often than application servers, and getting past it puts the attacker inside the network rather than next to it.

CyberSpec does not test for CVE-2026-19868 and cannot tell from outside whether your SSL-VPN uses SAML. What it does is scan the IPs and domains you own on a schedule, keep an inventory of the services they expose, and flag exposed administrative interfaces, so a firewall management page answering on the public internet shows up as a finding. See how network scanning works.