SonicWall SSL-VPN MFA bypass exploited: CVE-2026-19868 fix

Your VPN asks for MFA. An attacker with the right password may not have to answer. SonicWall disclosed a SonicWall SSL-VPN MFA bypass, CVE-2026-19868, that can get past SAML login controls on SonicOS firewalls, including SAML-enforced multi-factor authentication. SonicWall says it is investigating "potential exploitation." CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 6, with a federal fix deadline of November 20. There is no workaround. You update.

What actually happened

SonicWall published advisory SNWLID-2026-0014 on Friday, November 6, BleepingComputer reported. It covers seven SonicOS flaws. One is known to be exploited.

• The bug. A user with valid credentials for an alternate login method can bypass the SAML authentication controls on the SSL-VPN. CISA's entry says that can also bypass SAML-enforced MFA. BleepingComputer lists the CVSS score as 7.1.
• Who's exposed. Only SonicOS SSL-VPN services configured for SAML authentication. Affected builds are Gen7 7.3.3-7015 and earlier, and Gen8 8.2.2-8015 and earlier.
• The fix. SonicOS 7.3.4-7013 and 8.2.3-8015. SonicWall says no workarounds are available.
• The rest of the advisory. Two management-interface flaws rated 8.8 that allow unauthenticated actions under specific conditions, pre-auth buffer overflows in the SSL-VPN and TACACS+ services that can crash the device, and weak password hashing on virtual appliances. None of those is reported as exploited yet. The same firmware fixes them all.

Why it matters for your business

Plenty of small offices put SAML in front of the VPN, point it at Microsoft or Google sign-in, and call MFA done. This bug is a reminder that MFA only protects the login path it sits on. If the firewall still accepts a second path, such as local users, LDAP or RADIUS, a stolen password on that path is the way in. Old breach dumps are full of those passwords.

Here's what we'd do this weekend:

1. Update the firmware. Get to 7.3.4-7013 or 8.2.3-8015. Schedule the reboot. Don't wait for the monthly window.
2. Count your login paths. In the SSL-VPN settings, list every authentication method that is turned on. If SAML is the only one you mean to use, turn off the others.
3. Clean up local accounts. Delete old local users, especially former staff and vendor accounts. Rotate passwords on the ones you keep.
4. Read the logs. Look for SSL-VPN sessions that did not go through your identity provider. A login with no matching SAML event is a red flag.
5. Close the admin page. The two 8.8 flaws are in the management interface. Keep it off the public internet.

Sources: BleepingComputer, CISA Known Exploited Vulnerabilities catalog, SonicWall advisory SNWLID-2026-0014.