SonicWall flaw lets SSL-VPN users skip SAML login and its MFA

SonicWall flaw lets SSL-VPN users skip SAML login and its MFA

6 November 2026: SonicWall has fixed CVE-2026-19868, a SonicOS flaw rated 7.1 that lets someone with valid credentials for another login method bypass SAML on SSL-VPN, and with it any multi-factor step SAML enforces. CISA added it to its exploited list, and the fix is SonicOS 7.3.4-7013 on Gen7 or 8.2.3-8015 on Gen8.

Not yet independently verified. The exploitation claim rests on one line from SonicWall about a report it investigated, plus CISA's listing. Canada's Cyber Centre gives the Gen8 line as 8.2.2-8015, while we use the vendor's 8.2.3-8015. We will update this when it can be confirmed, and remove this note.

Who is exposed and what is fixed

The flaw matters only where SAML is enabled for SSL-VPN logins. SonicWall says its security team "has investigated a report indicating potential exploitation" and urges an upgrade. It lists no workaround, and CISA's due date for federal agencies is 20 November.

• Gen7 hardware (TZ, NSa and NSsp ranges) and NSv 270, 470 and 870, running 7.3.3-7015 or older: move to 7.3.4-7013 or higher
• Gen8 hardware (TZ, NSa ranges) and NSv XS, S, M and L, running 8.2.2-8015 or older: move to 8.2.3-8015 or higher

Virtual firewalls are included on ESX, KVM, Hyper-V, AWS and Azure for Gen7, so a cloud deployment should not be assumed out of scope.

Why an old local account undoes a SAML rollout

Many organisations move VPN users to SAML so that the identity provider applies its own MFA and conditional access. The word that matters in this advisory is "alternate": an attacker needs valid credentials for another authentication method on the same firewall. Old local users or LDAP accounts left behind after a SAML rollout are the obvious place to look, because they were often forgotten rather than removed.

After upgrading, administrators should list which authentication methods the SSL-VPN still accepts, remove accounts that no longer need them and rotate the passwords of those that stay. VPN logs are worth a review for sessions from accounts that should have gone through SAML but show no matching entry at the identity provider. Ryan Harris of The Electronic Office is credited with the report.

Six other flaws in the same release

The upgrade also closes six further issues, and the first two are rated higher than the exploited one:

• CVE-2026-107155: permissive cross-domain policy on the management interface, CVSS 8.8
• CVE-2026-107154: session validation on the management interface, CVSS 8.8
• CVE-2026-82308: pre-authentication heap overflow in SSL-VPN causing denial of service, CVSS 7.5
• CVE-2026-77708 and CVE-2026-77709: pre-authentication stack and heap overflows in the TACACS+ client, denial of service, CVSS 5.9 each
• CVE-2026-19703: weak password hashing on virtual appliances, local access, CVSS 5.2

Teams that have left the management interface reachable from outside have a second reason not to wait. This advisory is separate from the SonicWall GMS end-of-life flaw we reported this week, which affects a different product. Our VPN software category lists thirteen products and network security software lists six.

Sources

• SonicWall PSIRT: SNWLID-2026-0014, SonicOS affected by multiple vulnerabilities, 6 November 2026 (read through the PSIRT site's own data feed), 6 November 2026
• CISA: Known Exploited Vulnerabilities catalogue, CVE-2026-19868 added 6 November 2026, 6 November 2026
• Canadian Centre for Cyber Security: AV26-1133, 6 November 2026, 6 November 2026