Menu
Breach Value Calculator

SonicWall SSLVPN Vulnerability CVE-2026-19868: Patch SAML Logins

SonicWall SonicOS SSLVPN flaw CVE-2026-19868 may let users bypass SAML and MFA, and CISA lists it as exploited. Affected versions and fixed builds.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Published 3 min read

CVE-2026-19868, a SonicWall SSLVPN vulnerability, lets someone with valid credentials for another login method get past SAML on a SonicWall firewall's SSLVPN, possibly including SAML-enforced MFA. CISA lists it as exploited, so if your Gen 7 or Gen 8 firewall uses SAML for SSLVPN logins, upgrade SonicOS to the fixed build now.

Sources checked 12 November 2026.

SSLVPN is the remote-access service on a SonicWall firewall: it's how staff connect to the office network from outside. SAML is the standard that hands that login to your identity provider, which is often where MFA is enforced. For why devices like this draw attackers, see why edge devices get exploited.

What happened

SonicWall published advisory SNWLID-2026-0014 on 6 November 2026 and updated it on 9 November. It covers seven SonicOS flaws; CVE-2026-19868 is the one with reported exploitation. SonicWall says it "investigated a report indicating potential exploitation of this vulnerability."

In SonicWall's words, the flaw "may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls", and "may also bypass SAML-enforced multi-factor authentication (MFA)." It "ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins." The CVE record classes it as CWE-308, "Use of Single-factor Authentication".

SonicWall scores it CVSS 3.1 7.1. CISA's score in the NVD record is 7.5: CISA assumes no prior privileges, SonicWall low ones.

CISA added it to its Known Exploited Vulnerabilities (KEV) catalogue on 6 November 2026, the same day the CVE was published. It is on our same-day exploited table. The due date for US federal agencies is 20 November 2026, with forensic triage required. CISA lists ransomware use as "Unknown". No attacker has been named.

Who is affected by the SonicWall SSLVPN vulnerability

Platform Affected (SonicWall) Fixed (SonicWall)
Gen 7: TZ 270-670, NSa 2700-6700, NSsp 10700-15700, NSv 270/470/870 SonicOS 7.3.3-7015 and older SonicOS 7.3.4-7013 and higher
Gen 8: TZ 80-680, NSa 2800-5800, NSv XS/S/M/L SonicOS 8.2.2-8015 and older SonicOS 8.2.3-8015 and higher

Source: SNWLID-2026-0014 and SonicWall's release notice for SonicOS 7.3.4 and 8.2.3.

The same advisory fixes six other SonicOS flaws, so firewalls without SAML still need the upgrade.

What to do now

  1. Find every Gen 7 and Gen 8 firewall and note its SonicOS version and whether SSLVPN uses SAML.
  2. Upgrade to SonicOS 7.3.4-7013 or higher (Gen 7) or 8.2.3-8015 or higher (Gen 8), SAML-enabled SSLVPN firewalls first.
  3. Can't upgrade yet? SonicWall's workaround: "If SAML authentication is in use and upgrading the firmware is not possible, disable or delete any active LDAP, RADIUS, and TACACS+ authentication server configured on the firewall." The servers are under Device > Users > Settings > Authentication. Our advice, not SonicWall's: before you disable them, check whether anything else relies on those servers.
  4. Check for misuse. SonicWall's advisory gives no indicators of compromise. As general practice, not vendor guidance, review recent SSLVPN sessions for logins that didn't go through SAML, and check your identity provider's logs for users who connected without an MFA prompt.
  5. Tell the right people: your MSP or firewall partner, and your incident responder if a session looks wrong. Plan your patch-and-check routine with time to exploit and emergency patching.

Sources

Spotted a mistake? Report a correction.