---
schema: 1
kind: vulnerability
title: "CVE-2026-19868, SonicWall SonicOS SSLVPN: valid credentials for an alternate authentication method bypass SAML and the MFA it enforces; SonicWall investigated a report of exploitation and CISA lists it as exploited (CVSS 3.1 7.1)"
headline: "SonicWall SSL VPN bypasses SAML MFA and CISA lists it exploited; upgrade Gen7 to 7.3.4-7013, Gen8 to 8.2.3-8015"
summary: >
  SonicWall's advisory SNWLID-2026-0014 of 2026-11-06 fixes CVE-2026-19868, an SSLVPN authentication enforcement flaw (CVSS 3.1 7.1) that lets a user with valid credentials for an
  alternate authentication method bypass SAML, MFA enforced through SAML included, on Gen7 firewalls up to 7.3.3-7015 and Gen8 up to 8.2.2-8015 when SAML is enabled for SSLVPN logins.
  SonicWall says it investigated a report indicating potential exploitation and CISA lists the flaw as exploited; there is no workaround, and 7.3.4-7013 and 8.2.3-8015 fix it.
discovered_at: "2026-11-07T03:58:00Z"
updated_at: null
event_date: "2026-11-06"
run_id: 2026-11-07T0256Z-intel
priority: high
immediate_action: null
tags: [vulnerabilities, auth-bypass, actively-exploited, cisa-kev, patch-available]
regions: [global]
sectors: []
entities: ["product:sonicwall-sonicos", "product:sonicwall-ssl-vpn"]
techniques: [T1190, T1133, T1078]
affected_products: ["SonicWall SonicOS", "SonicWall SSL VPN"]
cves:
  - id: CVE-2026-19868
    cvss: "7.1"
    epss: null
    type: auth-bypass
    vector: zero-click
    auth: post-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "SonicOS 7.3.3-7015 and older (Gen7 hardware firewalls and NSv 270, 470, 870) and 8.2.2-8015 and older (Gen8 hardware firewalls and NSv XS, S, M, L), only when SAML is enabled for SSLVPN logins"
    fixed: "7.3.4-7013 and higher (Gen7); 8.2.3-8015 and higher (Gen8); no workaround"
  - id: CVE-2026-107155
    cvss: "8.8"
    epss: null
    type: logic-flaw
    vector: user-interaction
    auth: pre-auth
    status: [patch-available]
    affected: "SonicOS management interface, same Gen7 and Gen8 builds; permissive cross-domain policy that in specific conditions could potentially let a remote unauthenticated attacker perform unauthorized operations (not reported exploited)"
    fixed: "7.3.4-7013 and higher (Gen7); 8.2.3-8015 and higher (Gen8)"
  - id: CVE-2026-107154
    cvss: "8.8"
    epss: null
    type: auth-bypass
    vector: user-interaction
    auth: pre-auth
    status: [patch-available]
    affected: "SonicOS management interface, same Gen7 and Gen8 builds; session validation flaw that in specific conditions could potentially let a remote unauthenticated attacker perform unauthorized operations (not reported exploited)"
    fixed: "7.3.4-7013 and higher (Gen7); 8.2.3-8015 and higher (Gen8)"
  - id: CVE-2026-82308
    cvss: "7.5"
    epss: null
    type: dos
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "SonicOS SSL-VPN service, same Gen7 and Gen8 builds; pre-authentication heap buffer overflow that could potentially cause an application-level denial of service (not reported exploited)"
    fixed: "7.3.4-7013 and higher (Gen7); 8.2.3-8015 and higher (Gen8)"
sources:
  - url: "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014"
    publisher: "SonicWall PSIRT (SNWLID-2026-0014)"
    date: "2026-11-06"
    role: primary
  - url: "https://www.cisa.gov/news-events/alerts/2026/11/06/cisa-adds-one-known-exploited-vulnerability-catalog"
    publisher: "CISA"
    date: "2026-11-06"
    role: corroborating
  - url: "https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/"
    publisher: "BleepingComputer"
    date: "2026-11-06"
    role: corroborating
closed_sources: []
evidence:
  - quote: "SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability."
    publisher: "SonicWall PSIRT"
    source_url: "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014"
  - quote: "NOTE: This vulnerability ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins."
    publisher: "SonicWall PSIRT"
    source_url: "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014"
  - quote: "based on evidence of active exploitation"
    publisher: "CISA"
    source_url: "https://www.cisa.gov/news-events/alerts/2026/11/06/cisa-adds-one-known-exploited-vulnerability-catalog"
verification: multi-source
sourcing_note: >
  SonicWall's own wording stops at a report of potential exploitation; the exploited status rests on CISA's catalog listing, whose evidence CISA does not describe. The CVSS 3.1 score is SonicWall's.
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "Upgrade every SonicWall Gen7 firewall and NSv that serves SAML SSLVPN logins to SonicOS 7.3.4-7013 or later and every Gen8 firewall and NSv to 8.2.3-8015 or later now, because SonicWall lists no workaround and CISA lists the flaw as exploited."
updates: []
migrated_from: null
---

SonicWall's advisory SNWLID-2026-0014 of 2026-11-06 fixes seven SonicOS flaws on Gen7 and Gen8 firewalls, and one of them, CVE-2026-19868, is an authentication enforcement weakness in the SSLVPN service: a user with valid credentials for an alternate authentication method may bypass the SAML authentication controls, and successful exploitation may also bypass SAML-enforced multi-factor authentication ([SonicWall PSIRT, 2026-11-06](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014)). SonicWall says the flaw only affects SSLVPN when SAML is enabled for SSLVPN logins, and scores it CVSS 3.1 7.1 as a use of single-factor authentication (CWE-308) ([SonicWall PSIRT, 2026-11-06](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014)). The advisory says SonicWall PSIRT "has investigated a report indicating potential exploitation" and urges customers to upgrade, with no workaround available ([SonicWall PSIRT, 2026-11-06](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014)); CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-11-06 "based on evidence of active exploitation" ([CISA, 2026-11-06](https://www.cisa.gov/news-events/alerts/2026/11/06/cisa-adds-one-known-exploited-vulnerability-catalog)). SonicWall has not shared details about the reported exploitation ([BleepingComputer, 2026-11-06](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/)).

The advisory applies one table to all seven flaws: Gen7 hardware firewalls (TZ, NSa and NSsp) and Gen7 NSv up to and including 7.3.3-7015 are fixed in 7.3.4-7013 and higher, and Gen8 hardware firewalls (TZ and NSa) and Gen8 NSv up to and including 8.2.2-8015 are fixed in 8.2.3-8015 and higher ([SonicWall PSIRT, 2026-11-06](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014)). It also fixes two management-interface flaws scored 8.8 that in specific conditions could potentially let a remote unauthenticated attacker perform unauthorized operations, and that need user interaction, a pre-authentication heap overflow in the SSL-VPN service that could cause a denial of service, and three lower-severity flaws; no source reports them exploited ([SonicWall PSIRT, 2026-11-06](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014)).

**Exposure:** a Gen7 or Gen8 SonicWall firewall or NSv at or below the builds above with the SSL VPN enabled and SAML configured as a login method for SSLVPN; the running SonicOS build is the first check and the SAML setting for SSLVPN the second, the vendor's stated precondition ([SonicWall PSIRT, 2026-11-06](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014)).

**Detection:** the advisory gives no indicators. From the stated mechanism, compare successful SSLVPN logins on the firewall with the identity provider's sign-in log: a VPN session with no matching SAML sign-in or MFA event, or a SAML-enrolled user who authenticated through another authentication method, is the signal. Patching does not evict an attacker who already holds a session or reuses the credentials, so review VPN sessions since SAML was enabled and reset the credentials of accounts that work through both authentication methods.

**Triage:** a legitimate SAML sign-in leaves an event at the identity provider; a login through the alternate path does not, which follows from the stated mechanism.

**Defender takeaway:** upgrade every Gen7 and Gen8 firewall that serves SAML SSLVPN logins to 7.3.4-7013 or 8.2.3-8015 or later now, because there is no workaround and the exploitation evidence is a vendor-investigated report plus CISA's listing; then review VPN sessions for logins that skipped the identity provider.