SonicWall CVE-2026-19868: SSL-VPN SAML MFA Bypass Exploited in the Wild

Attackers are using a SonicWall SSL-VPN flaw to get past the control many organizations count on to stop credential theft: multi-factor authentication. CVE-2026-19868 lets an attacker holding valid credentials for an alternate authentication method bypass SAML authentication controls on SonicOS firewalls, potentially including SAML-enforced MFA. SonicWall published the advisory on Friday, November 6, 2026, and CISA has since added the flaw to its Known Exploited Vulnerabilities catalog, confirming exploitation in the wild.

The flaw carries a CVSS score of 7.1. That number understates what it means operationally. The perimeter VPN is the front door for most SonicWall customers, and MFA is often the only thing between a phished or reused password and a live session inside the network. A bypass of that layer turns the most common class of credential compromise back into a working intrusion path.

What CVE-2026-19868 Does

The vulnerability only affects SonicOS SSL-VPN services configured to use SAML authentication. In those deployments, administrators expect every SSL-VPN login to pass through the SAML identity provider, where MFA and conditional access policies are enforced. CVE-2026-19868 breaks that assumption. An attacker with valid credentials for an alternate authentication method on the same appliance can authenticate without satisfying the SAML flow.

The precondition matters. This is not an unauthenticated bypass. The attacker needs working credentials for a non-SAML method. In practice, that bar is low. Local accounts, legacy directory accounts and service accounts tend to stay on firewalls long after SAML is rolled out, and credentials for exactly these kinds of accounts appear routinely in infostealer logs and past VPN breach dumps.

Affected and Fixed Versions

• Affected: SonicOS Gen7 versions 7.3.3-7015 and earlier
• Affected: SonicOS Gen8 versions 8.2.2-8015 and earlier
• Fixed: SonicOS Gen7 7.3.4-7013
• Fixed: SonicOS Gen8 8.2.3-8015
• Workarounds: none, according to SonicWall

With no workaround available, the vendor-supported remediation is the firmware upgrade. Organizations that cannot patch immediately have no vendor-sanctioned configuration change that closes the gap, which puts the KEV deadline in sharper focus for private sector teams as well as federal ones.

Six More SonicOS Flaws in the Same Advisory

The release fixes seven vulnerabilities in total. Several are arguably more severe on paper than the exploited bug:

• Two management interface flaws rated CVSS 8.8 that allow unauthenticated attackers to perform unauthorized operations under specific conditions
• Pre-authentication buffer overflows in the SSL-VPN service that can cause denial-of-service conditions
• Pre-authentication buffer overflows in the TACACS+ service that can cause denial-of-service conditions
• A weak password hashing vulnerability affecting SonicOS virtual appliances

The two 8.8 management interface bugs carry the most latent risk. Exploitation has not been reported for them yet, but SonicWall management interfaces exposed to the internet have been a recurring target, and unauthenticated access to administrative functions is the kind of primitive attackers move on quickly once patch diffs are available. The pre-auth overflows in SSL-VPN and TACACS+ give an attacker a way to knock a perimeter device offline without credentials.

A Pattern of SonicWall Targeting

CVE-2026-19868 lands after months of sustained attacks on SonicWall's remote access products, mostly the SMA1000 secure remote access appliances:

• July 2026: attackers exploited two SMA1000 zero-days to deploy malware on vulnerable appliances
• September 2026: attackers chained two more SMA1000 zero-days to achieve remote code execution
• October 2026: researchers detected exploitation attempts against CVE-2026-102255, a maximum-severity SMA1000 flaw that could let unauthenticated attackers access internal functionality and perform unauthorized operations
• November 2026: CVE-2026-19868 exploited against SonicOS SSL-VPN with SAML authentication

That makes four separate exploitation waves in roughly four months across SonicWall's remote access portfolio. Threat actors are clearly investing in this vendor's edge devices, and the shift from SMA1000 to SonicOS firewalls widens the exposed install base considerably. Edge appliances are attractive for the same reasons every time: they face the internet, sit outside most EDR coverage, and grant network-level access once compromised.

Why This Matters for Security Leaders

The real risk sits in the gap between policy and configuration. Many organizations completed a SAML and MFA rollout on their VPN and recorded it as finished. CVE-2026-19868 shows that the security of that control depends on every other authentication path on the device as well. Leftover local or alternate-method accounts are the precondition here, and they are seldom inventoried with the same rigor as the identity provider.

There is also a visibility problem. SonicWall has not published indicators of compromise or exploitation details, so detection depends on each organization's own log retention and its ability to tell legitimate alternate-method logins from malicious ones. Teams that forward firewall authentication logs to a SIEM have a meaningful head start over teams that rely on the appliance's local logs alone.

Bottom Line

CVE-2026-19868 is confirmed exploited, has no workaround, and targets the MFA layer on internet-facing VPN gateways. SonicWall's fix is SonicOS 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8, and the same upgrade closes six more flaws, including two unauthenticated 8.8 management interface bugs. With CISA's federal deadline set for November 20, 2026 and SonicWall edge devices under sustained attack since July, the patch window for this one is measured in days. RedEye Security can assess SonicWall exposure, review SSL-VPN authentication history for signs of bypass, and validate that SAML enforcement holds across every login path.