On 6 November 2026 the US Cybersecurity and Infrastructure Security Agency added CVE-2026-19868 in SonicWall SonicOS to its Known Exploited Vulnerabilities catalog. The flaw lets someone log in through SSL VPN without two-factor authentication, even when a company has it turned on.
- CISA added CVE-2026-19868 to the KEV catalog on 6 November 2026.
- The flaw bypasses SAML login and the two-factor authentication built on it for SonicWall SSL VPN.
- Fix: SonicOS 7.3.4-7015 (Gen7) or 8.2.2-8015 (Gen8).
It concerns companies that route remote employee access through a SonicWall firewall's SSL VPN with SAML login. A fix exists: according to the NVD database it is SonicOS 7.3.4-7015 for the Gen7 line and 8.2.2-8015 for the Gen8 line. Anyone running an older version with SSL VPN enabled has an open path for an attacker to bypass MFA.
Why SSL VPN is an attractive target
SSL VPN on a firewall is usually the one door a company leaves open from the internet into its network: sales staff log in from the field, administrators connect to servers from home, an accountant opens the system outside the office. It is exactly the spot where a company puts MFA as a last line of defence, because passwords on their own leak, get written on paper or get reused across services. Bypass that one layer, and the protection most companies lean on hardest is gone. An attacker who gets in this way also does not start on the public web; they land straight inside the internal network, where the next step, say to a file server or the accounting system, is a much shorter one.
What exactly the flaw does
NVD lists it as CWE-308, use of single-factor authentication, with a CVSS 3.1 score of 7.5 (vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N). The attack runs over the network with no need for physical access (AV:N) and no special privilege (PR:N), but it needs a higher degree of circumstance to line up (AC:H), and it does not affect the VPN's own availability (A:N). NVD's description: a user with valid credentials for an alternate authentication method can bypass SAML authentication, and with it the MFA that SAML enforces.
One condition matters here: the attacker already needs some valid credentials, just not for SAML itself. This is not a hole anyone on the internet can walk through without a password. It is, though, exactly the layer companies rely on when they turn MFA on as insurance against a leaked or guessed password.
Who it affects and who it doesn't
The flaw affects devices on SonicOS Gen7 older than 7.3.4-7015, or Gen8 older than 8.2.2-8015, where SSL VPN is enabled with SAML login alongside another authentication method. A company that does not use SSL VPN, or that already runs a fixed SonicOS build, is not exposed to this flaw.
Anyone unsure which version they run can check it under System, Firmware in SonicOS, or on the admin login page. SonicWall describes the flaw in its own advisory, SNWLID-2026-0014, at psirt.global.sonicwall.com.
How to check it in 10 minutes
The check needs no vendor involvement and no downtime. It takes one administrator roughly ten minutes, and it can be done before the update is even scheduled:
- Log into the SonicOS admin panel and read the exact firmware version under System, Firmware.
- In the SSL VPN settings, confirm whether SAML login is on, and whether another authentication method stayed enabled alongside it.
- In the SSL VPN login log, look for unusual logins outside working hours or from an unfamiliar location over the past two weeks.
- If the version predates the fix and SSL VPN with SAML is running, treat the update as a priority, not routine maintenance.
What to do
CISA gave US federal agencies until 20 November 2026 to update or take offline any device that cannot be patched, and ties the remediation to its own BOD 26-04 guidance on prioritizing security updates based on risk. That deadline carries no formal weight for a private company, but it is a reasonable benchmark.
The practical steps:
- Check the SonicOS version on every SonicWall device with SSL VPN enabled.
- Update to 7.3.4-7015 or later (Gen7), or 8.2.2-8015 or later (Gen8).
- Where an update cannot happen right away, CISA's guidance points to limiting or disabling SSL VPN until it can.
The exact fixed version numbers differ between sources. Some news sites report 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8, while NVD's own database lists 7.3.4-7015 and 8.2.2-8015. This piece follows NVD's numbers as the primary source; the gap cannot be settled without a further statement from the vendor, so anyone setting an exact target version should check it directly against advisory SNWLID-2026-0014.
Common questions
Does this affect the whole SonicWall firewall, or just SSL VPN?
Just the SSLVPN service in SonicOS. A firewall used without SSL VPN is not exposed to this particular flaw.
Do I need SAML login turned on to be affected?
Yes. The flaw bypasses SAML authentication specifically, and the MFA built on top of it. Without SAML login, this path does not exist.
Is the flaw already being exploited?
CISA added it to the KEV catalog on 6 November 2026 based on reports of possible exploitation. Whether any named ransomware group uses it, the catalog lists as unknown as of that date.
How long do I have to fix it?
CISA gave US federal agencies until 20 November 2026. Private companies have no binding deadline, but the date is usable as a benchmark.
Where do I find the exact fix procedure?
In the vendor's advisory SNWLID-2026-0014 at psirt.global.sonicwall.com, where SonicWall also lists fixed versions for specific hardware lines.
A company that is not sure about its own firewall configuration, or does not have the capacity to check it in-house, can have the setup reviewed through an independent cyber security assessment.
Is updating the firmware enough, or should I also change passwords?
Updating the firmware fixes the flaw itself. Neither SonicWall nor CISA explicitly prescribes a password change or forced logout of active sessions in the advisory for this specific flaw; anyone who suspects a login through this path may already have happened should still, as general incident practice, review active sessions and passwords on top of patching.
WordPress 7.1.4 Update Fixes a Critical Flaw Attackers Are Already Exploiting
PHP2Shell vulnerability: does it affect your website and what to do
ISMS: what it is and why not to build it only in Excel
