SonicWall has patched CVE-2026-19868, a SonicOS SSL-VPN authentication flaw that is being exploited in the wild. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on November 6, 2026, with a federal remediation deadline of November 20, 2026. SonicWall states that no workaround exists, so patching is the only fix.

What Happened

The flaw is published in SonicWall advisory SNWLID-2026-0014 (November 6), which bundles seven SonicOS fixes. Only CVE-2026-19868 has a confirmed exploitation record so far. SonicWall says it investigated a report of potential exploitation but has not published details. It is not yet clear whether exploitation began before disclosure or around it.

The weakness is classified as CWE-308, Use of Single-factor Authentication. Severity is reported as CVSS 7.1 by SonicWall and 7.5 by some trackers.

Technical Details

The bug affects SSL-VPN deployments configured to use SAML authentication. An attacker who already holds valid credentials for a non-SAML login method can authenticate to the SSL-VPN without going through the SAML flow. The practical result is that SAML-enforced controls, including MFA delivered through the identity provider, can be bypassed.

This is not a pre-authentication bypass on its own: the attacker needs a working username and password (or another valid credential for a local or LDAP-style method). That matters less than it sounds. Credential stuffing, infostealer logs and reused passwords are the standard way into VPN edges, and MFA is the control meant to stop them. A flaw that quietly turns MFA off for a credential-holding attacker removes that backstop.

Affected and Fixed Versions

  • Gen7: SonicOS 7.3.3-7015 and earlier. Fixed in 7.3.4-7013.
  • Gen8: SonicOS 8.2.2-8015 and earlier. Fixed in 8.2.3-8015.

Only SSL-VPN configured for SAML is affected. Confirm exact model coverage in the vendor advisory.

Impact

Any internet-facing SonicWall firewall running SAML-based SSL-VPN is exposed to attackers who have harvested credentials. Successful login gives the attacker VPN access to the internal network at the privilege of the compromised account. SonicWall edge devices have been a repeated ransomware entry point; see our earlier coverage of Akira’s SonicWall VPN campaign and the SMA1000 zero-days.

Mitigation

  1. Patch now to 7.3.4-7013 (Gen7) or 8.2.3-8015 (Gen8). There is no workaround.
  2. Review SSL-VPN logs since at least late October for successful logins that did not produce a matching IdP/SAML assertion, and for logins using local or LDAP methods on accounts that should only use SAML.
  3. Disable unused authentication methods on the SSL-VPN realm and restrict local accounts where possible, once patched.
  4. Rotate credentials for VPN-enabled accounts if suspicious logins are found, and revoke active sessions.
  5. Restrict management and SSL-VPN exposure by source where business needs allow.
  6. Apply the other fixes from the same advisory, which SonicWall reports include a pre-authentication heap overflow.

References

  • SonicWall PSIRT advisory SNWLID-2026-0014 (psirt.global.sonicwall.com)
  • CISA Known Exploited Vulnerabilities catalog, entry for CVE-2026-19868
  • Ostorlab analysis: “SonicWall SSLVPN SAML Bypass, Exploited in the Wild”

Note: details are drawn from the vendor advisory summary and secondary reporting. SonicWall has not published exploitation specifics, and this post will be corrected if they do.