SonicWall's CVE-2026-19868 Lets a Valid Login Skip SAML MFA on SonicOS SSLVPN, and CISA Says It Is Exploited

A remote attacker who holds valid credentials for one login method on a SonicWall firewall can skip the SAML check on its SSL VPN, including the multi-factor step SAML enforces (CVE-2026-19868). It applies only to SonicOS SSLVPN services configured for SAML, on Gen7 builds up to 7.3.3-7015 and Gen8 builds up to 8.2.2-8015. CISA put it in the Known Exploited Vulnerabilities catalog on November 6 with a federal due date of November 20.

The fixed builds are 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8. BleepingComputer reports that SonicWall's advisory, SNWLID-2026-0014, lists no workaround, so patching is the only mitigation.

What an attacker needs

The NVD description says a user "with valid credentials for an alternate authentication method" may bypass SAML authentication controls. The weakness is filed as CWE-308, use of single-factor authentication. Two preconditions follow from that wording: SAML must be switched on for SSLVPN logins, and the attacker must already hold working credentials for some other method the appliance accepts.

That second condition is why this is not a password-less break-in. It turns a stolen or phished credential that should have been stopped by the identity provider's MFA into a working VPN session. SonicWall told customers, per BleepingComputer, that it "investigated a report indicating potential exploitation" and gave no details. BleepingComputer names the reporter as Ryan Harris of The Electronic Office.

The score understates the position

Source	CVSS 3.1 score	Notes
SonicWall (via BleepingComputer)	7.1	Vendor score; vector not fetched
NVD secondary entry	7.5	AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

1. CVE-2026-19868, SonicWall score7.1 score
2. CVE-2026-19868, NVD secondary score7.5 score
3. Two management interface flaws, each8.8 score

Source: BleepingComputer (vendor 7.1 and two 8.8 management flaws) and NVD (secondary 7.5), accessed 2026-11-09

The score understates the position because exploitation status is not part of it. The NVD vector marks scope as changed, which fits a VPN session that reaches resources behind the firewall, but the number says nothing about whether anyone is using the flaw. CISA's decision data in the same NVD entry lists exploitation as active, automatable as no and technical impact as partial. A 7.1 or 7.5 on a flaw that is already being used belongs at the top of a patch queue, ahead of higher-scored bugs in the same advisory.

Six more flaws in the same advisory

BleepingComputer lists six other fixes in SNWLID-2026-0014:

• Two management interface flaws rated 8.8 that let unauthenticated attackers perform unauthorized operations under specific conditions.
• Pre-authentication buffer overflows in the SSL-VPN and TACACS+ services that can cause denial of service.
• Weak password hashing affecting virtual appliances.

Anyone patching for CVE-2026-19868 therefore picks these up too. Anyone who does not run SAML on SSLVPN is outside this CVE but not outside the advisory.

Four SonicWall exploitation reports since July

BleepingComputer's account of the vendor's recent record: attacks on two SMA1000 zero-days in July, a chain of two SMA1000 zero-days used for remote code execution in September, and exploitation attempts in October against CVE-2026-102255, a maximum-severity SMA1000 flaw. The SMA1000 is a different product line from SonicOS firewalls, so this is a pattern of attention to the vendor, not a shared bug.

The KEV deadlines also differ from the batch CISA listed three days later. The SonicWall entry is not flagged for forensic triage and carries a 14-day due date, while the four additions of November 9 (GPUStack, OpenSSH, FreeSWITCH and IBM Aspera Faspex) each carry three days and a forensic triage flag.

What to do

Check whether SSLVPN is set to SAML. If it is, move Gen7 to 7.3.4-7013 or later and Gen8 to 8.2.3-8015 or later before November 20 if the organisation is a federal agency, and sooner otherwise. Then review SSLVPN logins since the last firmware change for sessions that skipped the identity provider. For another recent KEV listing, see the site's report on an Apple flaw added on Sekoia's evidence; for the vendor side of vulnerability hunting, see OpenAI's GPT-6 Cyber.