SECURITYCRITICALCVE-2026-19868

CVE-2026-19868: SonicWall SonicOS SSLVPN SAML and MFA Bypass

SonicOS SSLVPN lets a user with valid credentials for another auth method bypass SAML and SAML-enforced MFA. Added to CISA KEV.

Dylan H.

Vulnerability Research

November 6, 2026
2 min read
CVE-2026-19868: SonicWall SonicOS SSLVPN SAML and MFA Bypass

Actively exploited

Reported as exploited in the wild (e.g. CISA KEV). Patch or mitigate immediately.

Affected Products

  • SonicWall SonicOS 7.3.3-7015 and older (Gen7)
  • SonicWall SonicOS 8.2.2-8015 and older (Gen8)

Overview

CVE-2026-19868 is a use of single-factor authentication flaw (CWE-308) in the SonicWall SonicOS SSLVPN service. A user who holds valid credentials for an alternate authentication method can bypass the SAML authentication controls configured on the appliance. Successful exploitation can also bypass SAML-enforced multi-factor authentication (MFA).

CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on November 6, 2026, which means it is being exploited in the wild. NVD lists the record as "Undergoing Analysis" and has not published a CVSS score. We rate it critical because it sits on an internet-facing VPN gateway, defeats MFA, and is under active exploitation.

Affected Versions

ProductAffectedFixed
SonicOS (Gen7)7.3.3-7015 and olderSee vendor advisory SNWLID-2026-0014
SonicOS (Gen8)8.2.2-8015 and olderSee vendor advisory SNWLID-2026-0014

Technical Summary

SSLVPN can accept more than one authentication method at once. When SAML is meant to be the only gate, the appliance still honors a different method for the same account. An attacker with valid credentials for that alternate method, for example stolen or reused local or LDAP credentials, can sign in without ever passing the SAML identity provider. Any MFA step enforced at the identity provider is skipped along with it.

The attacker still needs a valid username and password. That is a low bar given how often VPN credentials are phished, reused, or sold, and it turns a stolen password into full VPN access.

Remediation

  1. Apply the fixed SonicOS build listed in SonicWall advisory SNWLID-2026-0014 as soon as possible.
  2. Until patched, disable alternate authentication methods on SSLVPN so SAML is the only accepted method.
  3. Restrict SSLVPN access to known source ranges where practical.
  4. Review SSLVPN logs for logins that used a non-SAML method, especially from unfamiliar IP addresses.
  5. Reset credentials for accounts with suspicious activity and review any sessions opened through the VPN.
  6. Federal agencies should follow the KEV remediation deadline set by CISA.

References

  • NVD: CVE-2026-19868
  • SonicWall PSIRT advisory SNWLID-2026-0014
  • CISA Known Exploited Vulnerabilities catalog