CVE-2026-19868, SonicWall SonicOS SSLVPN: valid credentials for an alternate authentication method bypass SAML and the MFA it enforces; SonicWall investigated a report of exploitation and CISA lists it as exploited (CVSS 3.1 7.1)
SonicWall SSL VPN bypasses SAML MFA and CISA lists it exploited; upgrade Gen7 to 7.3.4-7013, Gen8 to 8.2.3-8015
Defender actions
- Upgrade every SonicWall Gen7 firewall and NSv that serves SAML SSLVPN logins to SonicOS 7.3.4-7013 or later and every Gen8 firewall and NSv to 8.2.3-8015 or later now, because SonicWall lists no workaround and CISA lists the flaw as exploited.
Analysis
SonicWall's advisory SNWLID-2026-0014 of 2026-11-06 fixes seven SonicOS flaws on Gen7 and Gen8 firewalls, and one of them, CVE-2026-19868, is an authentication enforcement weakness in the SSLVPN service: a user with valid credentials for an alternate authentication method may bypass the SAML authentication controls, and successful exploitation may also bypass SAML-enforced multi-factor authentication (SonicWall PSIRT, 2026-11-06). SonicWall says the flaw only affects SSLVPN when SAML is enabled for SSLVPN logins, and scores it CVSS 3.1 7.1 as a use of single-factor authentication (CWE-308) (SonicWall PSIRT, 2026-11-06). The advisory says SonicWall PSIRT "has investigated a report indicating potential exploitation" and urges customers to upgrade, with no workaround available (SonicWall PSIRT, 2026-11-06); CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-11-06 "based on evidence of active exploitation" (CISA, 2026-11-06). SonicWall has not shared details about the reported exploitation (BleepingComputer, 2026-11-06).
The advisory applies one table to all seven flaws: Gen7 hardware firewalls (TZ, NSa and NSsp) and Gen7 NSv up to and including 7.3.3-7015 are fixed in 7.3.4-7013 and higher, and Gen8 hardware firewalls (TZ and NSa) and Gen8 NSv up to and including 8.2.2-8015 are fixed in 8.2.3-8015 and higher (SonicWall PSIRT, 2026-11-06). It also fixes two management-interface flaws scored 8.8 that in specific conditions could potentially let a remote unauthenticated attacker perform unauthorized operations, and that need user interaction, a pre-authentication heap overflow in the SSL-VPN service that could cause a denial of service, and three lower-severity flaws; no source reports them exploited (SonicWall PSIRT, 2026-11-06).
Triage: a legitimate SAML sign-in leaves an event at the identity provider; a login through the alternate path does not, which follows from the stated mechanism.
Cited evidence
SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability.
NOTE: This vulnerability ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins.
based on evidence of active exploitation
Sources3
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.