SonicWall has patched a SonicOS SSL VPN vulnerability, CVE-2026-19868, that can let an attacker holding valid credentials for a different authentication method get past SAML checks. That includes MFA enforced through SAML. SonicWall's PSIRT investigated a report of potential exploitation and strongly urged customers to upgrade.
What Happened
SonicWall disclosed the flaw on 6 November in advisory SNWLID-2026-0014, which covers seven SonicOS vulnerabilities. CVE-2026-19868 is rated CVSS 7.1 (high) and is a use of single-factor authentication weakness (CWE-308). It only affects SSL VPN when SAML is enabled for SSLVPN logins.
CISA added it to the Known Exploited Vulnerabilities catalog, the only one of the seven to be listed. Federal civilian agencies must secure affected systems by 20 November 2026. It remains unconfirmed whether attackers used the bug as a zero-day before disclosure.
Affected and Fixed Versions
| Platform | Affected | Fixed |
|---|---|---|
| Gen7 TZ, NSa, NSsp, NSv | SonicOS 7.3.3-7015 and earlier | 7.3.4-7013 |
| Gen8 TZ, NSa, NSv | SonicOS 8.2.2-8015 and earlier | 8.2.3-8015 |
SonicWall offers no workaround.
Recommended Actions
- Upgrade to SonicOS 7.3.4-7013 or 8.2.3-8015.
- Check whether SAML is enabled on SSL VPN. Those are the only exposed configurations.
- Review VPN authentication logs for logins that succeeded through a non-SAML method on SAML-enforced portals.
- Rotate credentials for accounts with suspicious sign-ins, and restrict SSL VPN exposure where possible.