Vulnerabilities

SonicWall SSL-VPN flaw lets attackers skip SAML MFA, now exploited

SonicWall fixes exploited CVE-2026-19868, letting valid alternate credentials bypass SAML and potentially MFA on SonicOS SSL-VPN. Upgrade now.

Padlock graphic with the headline SonicWall VPN flaw bypasses SAML MFA

SonicWall has fixed an SSL-VPN flaw in SonicOS that lets a user with valid credentials for another login method get around SAML controls, and possibly SAML-enforced multi-factor authentication. The bug is already being exploited and there is no workaround, so UK organisations running Gen7 or Gen8 firewalls should upgrade now.

What happened

On 6 November 2026 SonicWall published security advisory SNWLID-2026-0014, which fixes seven vulnerabilities in SonicOS, the operating system on its Gen7 and Gen8 firewalls and NSv virtual appliances. One of them, CVE-2026-19868, is under attack. According to BleepingComputer, SonicWall’s product security team looked into a report of possible exploitation and then urged customers to “upgrade to the latest release as soon as possible.”

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalogue the same day. It gave US federal civilian agencies until 20 November to fix it, and marks any link to ransomware campaigns as “Unknown”. The Canadian Centre for Cyber Security published advisory AV26-1133 and repeated SonicWall’s statement that the flaw is being exploited.

SonicWall has not named the attackers or said how many devices were hit. BleepingComputer credits Ryan Harris of The Electronic Office with reporting the vulnerability.

The technical picture

The CVE record calls CVE-2026-19868 an authentication enforcement weakness in the SonicOS SSLVPN service, classified as CWE-308, use of single-factor authentication. A firewall can be set up so that remote users sign in to the SSL-VPN through a SAML identity provider, with that provider enforcing MFA. If the same firewall also has another authentication method that accepts the user’s credentials, an attacker can sign in through that method and skip the SAML process completely. CISA’s catalogue entry adds that exploitation “may also bypass SAML-enforced multi-factor authentication”.

There are two important limits. First, the attacker needs credentials that are valid for the alternative method, so this is not an anonymous route in. Second, SonicWall says only SSL-VPN services with SAML enabled are affected. Firewalls without SAML VPN logins still need the other fixes in the release.

The severity rating differs depending on where you look. BleepingComputer and SecurityOnline cite 7.1, which appears to be SonicWall’s advisory rating. The official CVE record contains no score from SonicWall at all. The 7.5 (High) score shown in the CVE record and on NVD was added by CISA’s vulnerability enrichment team, with the vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N. NVD had not produced its own assessment when this was written. Either way, the score matters less than the KEV listing. CISA’s SSVC data records exploitation as “active”, technical impact as partial, and the flaw as not automatable.

Affected releases are SonicOS 7.3.3-7015 and earlier on Gen7, and 8.2.2-8015 and earlier on Gen8. The fixed builds are 7.3.4-7013 and 8.2.3-8015. SonicWall says there is no workaround. Gen6 and older hardware is past end of support and will not be patched.

The other six CVEs fixed in the same release are:

  • CVE-2026-107155 and CVE-2026-107154: two web management flaws rated 8.8, covering a loose cross-domain policy and a weak IP session check.
  • CVE-2026-82308: a heap overflow in SSL-VPN that can be triggered before login.
  • CVE-2026-77708 and CVE-2026-77709: stack and heap overflows in the TACACS+ client.
  • CVE-2026-19703: weak password hashing on virtual appliances, which lets a local user read a limited password.

Only CVE-2026-19868 has been confirmed as exploited.

Timeline of the SonicWall CVE-2026-19868 advisory, KEV listing, affected setups, fixed builds and CISA deadline

Why it matters for UK organisations

SonicWall firewalls are common in UK small and mid-sized businesses, schools, local authorities and the managed service providers that support them. Many of these organisations moved VPN logins onto SAML with Entra ID or another identity provider because they wanted conditional access and MFA in one place. This flaw targets exactly that setup. The control they relied on can be skipped if an older login route, such as local firewall accounts or a directory-backed method, was never fully switched off.

Stolen VPN credentials are a common way into UK networks, and MFA is often the only thing that makes a leaked password useless. Attackers have shown real interest in getting past MFA on SonicWall VPNs before. In 2025, researchers investigating SonicWall SSL-VPN intrusions, which Arctic Wolf Labs linked to the Akira ransomware group, saw logins succeed on accounts protected by one-time passcodes. That was a different issue, but the interest is clear.

The KEV deadline formally applies only to US federal agencies, but UK organisations can use it as a benchmark. Cyber Essentials already requires updates fixing high and critical vulnerabilities to be applied within 14 days of release. A KEV-listed flaw in a VPN gateway should be fixed well inside that window.

Expert view

When we test remote access, mixed authentication is one of the most common weaknesses we find. A firewall gets moved to SAML, but the local administrator and user accounts created at installation are left in place “just in case”, together with an LDAP or RADIUS profile nobody remembers. On paper, MFA is enforced. In practice, the VPN accepts more than one type of credential, and an attacker only needs the weakest one to work.

The patch closes this flaw, but not the design choice behind it. If a firewall can authenticate VPN users in more than one way, every one of those methods needs to be as strong as SAML or removed.

Do not take comfort from the high attack complexity rating. It means little to an attacker who already holds valid passwords for your organisation, and patching does not tell you whether someone got in before you upgraded.

What to do now

  1. Find your exposure. List every SonicWall Gen7 and Gen8 firewall and NSv instance, including those run for you by an MSP. Record the SonicOS build and whether SAML is enabled for SSL-VPN.
  2. Upgrade. Move Gen7 to 7.3.4-7013 or later and Gen8 to 8.2.3-8015 or later, starting with internet-facing devices that use SAML (Cyber Essentials: security update management).
  3. Remove alternative login routes. Review SSL-VPN authentication settings and remove or disable local and directory-backed VPN accounts that are not needed, so SAML is the only way in (Cyber Essentials: user access control).
  4. Hunt in the logs. Look for SSL-VPN sessions that authenticated without a matching SAML assertion or MFA event at your identity provider, logins at unusual hours or from unfamiliar locations, and accounts that should not hold VPN access.
  5. Rotate credentials. If you find suspicious sessions, reset passwords for the affected VPN accounts and for any accounts held in the firewall’s local database, and treat the connected network as possibly compromised.
  6. Restrict the management interface. Keep web management off the internet, given the two management flaws rated 8.8 fixed in the same release (Cyber Essentials: firewalls and secure configuration).
  7. Plan Gen6 replacement. End-of-support hardware will not get this fix and no longer meets Cyber Essentials requirements for supported software.

Bottom line

CVE-2026-19868 does not hand attackers your firewall, but it can make a stolen password enough to get past your VPN’s MFA. With exploitation reported by the vendor and CISA, no workaround and a fix available, every SonicWall estate using SAML for SSL-VPN should be upgraded this week. After upgrading, check whether anyone used the gap before it closed and remove any alternative login routes that make this class of bug possible.

Sources

Related Posts