SonicWall patches an SSLVPN flaw that lets a stolen password skip SAML and its MFA

November 6, 2026. SonicWall publishes advisory SNWLID-2026-0014 and fixes CVE-2026-19868, an authentication-enforcement flaw in the SSLVPN service of SonicOS. Same day. CISA adds the CVE to its KEV catalog of exploited vulnerabilities, with a federal deadline of November 20, 2026. 7.1. The CVSS v3.1 score assigned by the vendor — lower than the two 8.8 flaws in the same advisory. Why it matters: the flaw actually being exploited is not the highest-scored one in the bundle, and the KEV listing, not the score, is what dictates urgency.

What is broken: SAML enforcement, not the encryption

CVE-2026-19868 is classified CWE-308, Use of Single-Factor Authentication. The defect touches neither the tunnel encryption nor a memory overflow. It touches a trust decision: the SSLVPN portal does not enforce the SAML policy for an account that can authenticate through another method.

In practice, an administrator enables SAML on SSLVPN logins to require an identity provider and, often, the MFA it carries. SonicOS still accepts several authentication methods side by side. The flaw is that a user who presents valid credentials for an alternate method — a local account, for example — obtains a VPN session without passing through the SAML assertion, and therefore without the MFA that SAML enforces.

The impact is an MFA bypass, not an unauthenticated intrusion. The attacker must already hold a valid password: stolen, reused, or guessed. That password then becomes sufficient on its own, even though the administrator believed the door was locked behind a second step.

SonicWall publishes two scores. The vendor rates CVSS 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N); the CISA ADP in the CVE record carries 7.5 (PR:N). The difference is privileges required: the vendor assumes a valid account, CISA does not. Both agree on high confidentiality impact, low integrity, no availability — the profile of a read-oriented VPN foothold rather than a code-execution bug.

Seven fixes, one KEV entry

Advisory SNWLID-2026-0014 actually fixes seven vulnerabilities in the same builds. Two of them, on the management interface, are rated 8.8: CVE-2026-107155 (permissive cross-domain policy) and CVE-2026-107154 (session validation relying on the IP address). Another, CVE-2026-82308, is a pre-authentication heap overflow in the SSL-VPN service, rated 7.5. Then come two overflows in the TACACS+ client — CVE-2026-77708 and CVE-2026-77709, rated 5.9 — and a weak password-hashing flaw on virtual appliances, CVE-2026-19703, rated 5.2.

Yet the only one of the seven that CISA added to KEV is CVE-2026-19868, the lowest-scored of the network-exposure flaws. That is the lesson: a KEV entry signals real exploitation, which no CVSS score guarantees. A CISO who sorts patches by descending score risks fixing the two 8.8 management-interface flaws before the 7.1 SSLVPN flaw — the exact reverse of the operational priority.

SonicWall says it investigated “a report indicating potential exploitation.” Ryan Harris of The Electronic Office is credited with the report. No victim, no actor, and no attack date are published.

Who is exposed, and who is not

The flaw does not apply everywhere. SonicWall is explicit: CVE-2026-19868 only affects the SSLVPN if SAML is enabled for VPN logins. Four conditions must all hold:

• the firewall runs an affected SonicOS build;
• the SSLVPN service is enabled and reachable from the attacker’s network;
• SAML is enabled for SSLVPN logins;
• at least one account can authenticate through an alternate method, and the attacker holds its credentials.

The affected versions span both hardware lines. Gen7 (TZ 270 to 670, NSa 2700 to 6700, NSsp 10700 to 15700, NSv 270/470/870) is vulnerable at 7.3.3-7015 and earlier, fixed in 7.3.4-7013. Gen8 (TZ 80 to 680, NSa 2800 to 5800, NSv XS/S/M/L) is vulnerable at 8.2.2-8015 and earlier, fixed in 8.2.3-8015.

SonicWall offers no workaround. Before upgrading, the only mitigation is to shrink the surface: remove or disable SSLVPN accounts that can use a non-SAML method, and restrict SSLVPN access to controlled address ranges.

# Check the firmware version (SonicOS CLI)
show version

# Compare it with the fixed build for your platform line:
#   Gen7 -> 7.3.4-7013 or higher
#   Gen8 -> 8.2.3-8015 or higher

What an MFA bypass actually costs

The danger is not theoretical. An MFA bypass turns a weak or stolen password into a full VPN session, with the compromised account’s permissions and access to the internal resources it opens. SAML and MFA existed precisely to stop a single factor from being enough; the flaw restores the single-factor authentication the administrator thought they had eliminated.

The lesson extends beyond SonicWall. It illustrates a design principle: when several authentication methods coexist, the strictest policy must apply to all of them, without exception. A local backdoor left open next to a SAML SSO is the equivalent of locking the front door while leaving a ground-floor window ajar.

For detection, the advisory provides no publicly replayable request sequence. However, an SSLVPN login log showing a successful authentication through a non-SAML method, for an account that was supposed to use SAML, is a lead — not proof of compromise, but an anomaly worth investigating.

The deeper point is that identity hygiene matters as much as patching here. The flaw needs a valid password, so the two defenses that remain useful — even after the firmware is patched — are removing non-SAML SSLVPN accounts and enforcing strong, non-reused credentials. A bypass is only ever as strong as the weakest credential that can reach it.

The context: edge devices remain the preferred target

CVE-2026-19868 fits a pattern that 2026 has not contradicted: edge devices — firewalls, VPNs, access appliances — dominate the KEV catalog. The reason is simple: they sit on the internet, they grant access to the internal network, and they often age without patches. An authentication-bypass flaw there is worth more than an equivalent flaw on an internal workstation.

SonicWall has been here before. This blog has covered several SMA1000 flaws in recent months — exploited zero-days, SSRF, and remote code execution. What is new about CVE-2026-19868 is not the severity but the nature: an MFA bypass through an authentication decision, not through memory corruption. That kind of defect is easier to exploit than overflows, because it only requires a valid password — the most abundant resource on the compromise market.

That is also why CISA sets such a short deadline: fourteen days between the KEV listing and the federal requirement. A compromised firewall is an entry point, not an end in itself — it opens the path to the rest of the network.

Verdict

CVE-2026-19868 is not the most spectacular flaw of the year: no pre-authentication RCE, no memory corruption. It is a discrete authentication-enforcement defect — precise, and already exploited, which its KEV entry of November 6, 2026 makes indisputable.

If you run a SonicOS Gen7 or Gen8 firewall with SSLVPN and SAML enabled, move to 7.3.4-7013 or 8.2.3-8015 before November 20, 2026 — CISA’s federal deadline is a good benchmark for everyone, not just agencies. If the upgrade cannot happen immediately, remove non-SAML SSLVPN accounts and restrict SSLVPN to your own address ranges: you do not fix the flaw, you shrink its reach. If you manage a heterogeneous fleet, start with the internet-facing firewalls — they are the target. The rule to remember: KEV trumps CVSS when the two diverge, and a bypassed MFA is an absent MFA.

References

• SonicWall PSIRT — SNWLID-2026-0014, “SonicWall SonicOS Affected By Multiple Vulnerabilities” (November 6, 2026)
• CISA — Known Exploited Vulnerabilities Catalog, CVE-2026-19868 (added November 6, 2026, due November 20, 2026)
• Ostorlab — SonicWall SSLVPN SAML Bypass, Exploited in the Wild (CVE-2026-19868)
• BleepingComputer — SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks (November 6, 2026)
• CVE.org — CVE-2026-19868, CNA SonicWall