SonicWall patches SonicOS SSL-VPN flaw CVE-2026-19868 that can bypass SAML MFA and is exploited in attacks

TLDR

• SonicWall says SonicOS SSL-VPN flaw CVE-2026-19868 can bypass SAML authentication, including SAML-enforced MFA.²
• CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 6 November; SonicWall investigated an exploitation report.²³
• Fixes are in SonicOS 7.3.4-7013 and 8.2.3-8015, and SonicWall lists no workaround.²

SonicWall has released security updates for seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass that is exploited in attacks, BleepingComputer reports.¹ SonicWall's advisory, SNWLID-2026-0014, was first published on 6 November 2026.² It describes CVE-2026-19868 as an authentication enforcement flaw in the SonicOS SSLVPN service that may let a user with valid credentials for an alternate authentication method bypass SAML authentication controls, and that may also bypass SAML-enforced multi-factor authentication.² SonicWall notes that the flaw affects the SSLVPN interface or service only if SAML is enabled for SSLVPN logins.² The advisory credits Ryan Harris of The Electronic Office with reporting it.²

On exploitation, SonicWall's PSIRT says it has investigated a report indicating potential exploitation and strongly urges customers to upgrade as soon as possible.² BleepingComputer reports that SonicWall has not shared details about the reported exploitation.¹ CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 6 November, listing it as a SonicWall SonicOS SSLVPN use of single-factor authentication vulnerability, based on evidence of active exploitation.³ BleepingComputer reports that CISA ordered federal civilian agencies to secure affected systems by 20 November 2026.¹ The Canadian Centre for Cyber Security also issued an advisory on 6 November, saying SonicWall indicates the flaw is being exploited.⁵

The advisory lists Gen7 hardware firewalls and NSv virtual firewalls running 7.3.3-7015 and older, and Gen8 hardware firewalls and NSv virtual firewalls running 8.2.2-8015 and older, as affected.² Fixed releases are 7.3.4-7013 and higher for Gen7 and 8.2.3-8015 and higher for Gen8, and the advisory gives the workaround as none.² The same advisory covers six other flaws.² Two management interface flaws, CVE-2026-107154 and CVE-2026-107155, are rated 8.8 and could let a remote unauthenticated attacker perform unauthorised operations in specific conditions.² A pre-authentication heap overflow in SSL-VPN and two pre-authentication overflows in the TACACS+ client could cause denial of service, and a weak password hashing flaw affects virtual appliances.²

The sources differ on two details. SonicWall rates CVE-2026-19868 at CVSS 7.1, a figure BleepingComputer repeats, while Rapid7's database lists 7.5.¹²⁴ The Canadian Centre lists affected SonicOS versions as prior to 7.3.4-7013 and prior to 8.2.2-8015, whereas SonicWall lists 8.2.2-8015 and older as affected and 8.2.3-8015 as the fixed Gen8 release.²⁵ BleepingComputer adds that the warning follows attacks on SonicWall's SMA1000 secure remote access appliances, including exploitation attempts in October against CVE-2026-102255; those appliances are separate from the SonicOS firewalls in this advisory.¹

Why it matters: the flaw can bypass SAML-enforced MFA on SonicOS SSL-VPN, and SonicWall's advisory offers no workaround, only the fixed releases.²