93← Home

CVE-2026-19868: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

Headline from SonicWall — SonicOS SSLVPN · compiled from 5 sources

Our analysis · checked against 8 sources

Exploited SonicWall SSL-VPN flaw lets alternate-login users bypass SAML sign-in and MFA

SonicWall says a SonicOS SSL-VPN flaw lets someone with valid credentials for another login method bypass SAML and SAML-enforced MFA; CISA lists it as exploited and gave federal agencies until 20 November to fix it. It affects only SAML-enabled SSL-VPN on Gen7 7.3.3-7015/Gen8 8.2.2-8015 and earlier, fixed in 7.3.4-7013/8.2.3-8015; severity is 7.1 (SonicWall) or 7.5 (other trackers).

The framing'Critical CVE' fits the urgency: CISA lists the flaw as exploited and set a 20 November 2026 federal deadline. But SonicWall rates it 7.1 and other trackers 7.5, both 'High', and no source labels it Critical.

What the headline leaves out

  • Attackers need valid credentials for an alternate login method, and only SAML-enabled SSL-VPN is affected.
  • SonicWall says no workaround exists; upgrading firmware is the only fix.
  • Two companion bugs fixed in the same update score higher (CVSS 8.8).
  • CISA's 20 November deadline binds only federal civilian agencies.

What happens next

Federal civilian agencies must secure affected systems by 20 November 2026 under CISA's directive. CISA describes this type of flaw as 'a frequent attack vector for malicious cyber actors', and SonicWall says only a firmware upgrade fixes it. Watch for NVD's own severity assessment and for trackers filling in the fixed Gen7 build.

Possible knock-on effects
  • Attackers who have repeatedly targeted SonicWall remote access gear may keep probing unpatched SAML-enabled SSL-VPNs, which could matter most to organisations slow to upgrade firmware. (precedent: SonicWall remote access infrastructure was attacked in July, September and October 2026 (BleepingComputer via Tech Bytes). Those attacks involved the SMA1000 line, a different product; no source ties them to this SonicOS SSL-VPN flaw.. Watch for: Further exploitation reports or KEV additions for SonicOS SSL-VPN after 20 November.)
  • The federal 14-day deadline may serve private organisations as a patching benchmark, which could speed upgrades outside government even though they are not bound. (official assessment: CISA BOD 26-04 deadline; BleepingComputer notes it is a useful benchmark for private organisations.. Watch for: Vendor or industry reports of patch adoption rates on Gen7/Gen8 devices.)

Sources: NVD: CVE-2026-19868 (primary), VulDB entry 432101 (primary), BleepingComputer: SonicWall warns of new SSL VPN MFA bypass flaw exploited in attacks, SecurityOnline: SonicWall SonicOS SSLVPN CVE-2026-19868 exploited, daily.dev: SonicWall warns of new SSL VPN MFA bypass flaw, Windows Forum: SAML bypass patch on Gen 7 and Gen 8, Windows Forum: CISA flags exploited SonicWall SSLVPN SAML and MFA bypass, Tech Bytes: SonicWall warns of new SSL VPN MFA bypass flaw exploited

Written in our own words from the sources above, and checked claim by claim before it was published. The report below says only what each outlet said.

The report: what outlets said

According to SecurityOnline, threat actors are exploiting a SonicWall SonicOS SSLVPN login bug in the wild to skip multi-factor checks[1]. The site reports that the flaw, CVE-2026-19868, led CISA to issue an urgent federal patch order alongside six other SonicOS fixes[1]

SecurityOnline reports that on November 6, 2026, CISA added the bug to its Known Exploited Vulnerabilities catalog due to active attacks[1]. According to the same outlet, SonicWall's SNWLID-2026-0014 security advisory confirms real-world abuse of this flaw[1].Threat-intelligence site OffSeq says the vulnerability allows a user with valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially circumventing SAML-enforced multi-factor authentication (MFA)[2].GBHackers reports that the flaw affects SonicOS SSLVPN deployments only when SAML is enabled for VPN logins[3].According to GBHackers, affected platforms include Gen7 hardware firewalls and NSv appliances running SonicOS 7.3.3-7015 or earlier, alongside Gen8 hardware and NSv systems running 8.2.2-8015 or earlier[3]. The outlet says SonicWall lists 7.3.4-7013 and later for Gen7, and 8.2.3-8015 and later for Gen8, as fixed releases[3], and that no workaround is provided[3].WindowsForum notes that BleepingComputer reports[4] a CVSS score of 7.1, while other aggregators list 7.5[4].WindowsForum says the aggregator cve-security.com reports a federal remediation due date of November 20, 2026[5], but the forum adds that it couldn't confirm it on CISA's own catalog page[5].SecurityOnline quotes SonicWall as saying, "Customers are strongly urged to upgrade to the latest release as soon as possible"[1].

Listen to the songCritical CVEs (1 of 3) — November 07, 2026

Sources

  1. [1]Attackers Exploit SonicWall SonicOS SSLVPN Flaw CVE-2026-19868 in the Wild
  2. [2]CVE-2026-19868: SonicOS · Use of Single-factor Authentication | Threat Radar
  3. [3]Hackers Exploit SonicWall SSL-VPN Vulnerability to Bypass Multi-Factor Authentication in Active Attacks
  4. [4]SonicWall SonicOS SSL-VPN SAML Bypass: Patch CVE-2026-19868 on Gen 7 and Gen 8 Firewalls
  5. [5]CVE-2026-19868: CISA Flags Exploited SonicWall SSLVPN SAML and MFA Bypass

Every sentence here reports what a named outlet said, with a link to it. Compiled by 93 from the reporting below.

This topic, day by day

CVE-2026-19868: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability | 93