93← Home

CVE-2026-19868: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

Headline from SonicWall — SonicOS SSLVPN · compiled from 4 sources

Our analysis · checked against 8 sources

SonicWall patches SSL VPN flaw, listed as exploited, letting credentialed users skip SAML MFA

On 6 Nov 2026 SonicWall fixed a SonicOS SSL VPN flaw that lets someone with valid credentials for another login method bypass SAML login, including SAML-enforced MFA; CISA listed it as exploited that day. It is rated High (7.1 by SonicWall, 7.5 by NVD), and attack details, attackers and zero-day status remain undisclosed.

The framing"Critical CVEs" does reflect that CISA listed the flaw as exploited and set a 20 Nov federal deadline. But it scores 7.1 (SonicWall) or 7.5 (NVD), the High tier, and two bugs in the same advisory score 8.8.

What the headline leaves out

  • Only SSL VPNs with SAML-based login enabled are exposed, and the password step stays: an attacker with no account cannot use this path.
  • Six other flaws were fixed in the same advisory, two rated 8.8, higher than this one.
  • There is no workaround. Fixes are SonicOS 7.3.4-7013 and 8.2.3-8015, and US federal agencies must act by 20 Nov.

What happens next

US federal civilian agencies must remediate by 20 Nov 2026 under CISA's directive. SecurityOnline and Ostorlab report no workaround, so patching is the only fix. SecurityWeek notes it is unclear whether the flaw was exploited before the patch existed, and no attacker or campaign has been named. Watch for SonicWall or CISA releasing details of the suspected attacks.

Possible knock-on effects
  • Because the flaw removes only the SAML/MFA step, attackers holding stolen or reused passwords for an alternate login method could use them to reach the VPN without MFA. Organisations may respond by auditing or disabling alternate authentication methods alongside patching. (mechanism: Follows from the vendor's description: valid alternate-method credentials plus SAML-enabled SSL VPN login are required.. Watch for: Any SonicWall or CISA attack details that mention credential theft or reuse, or vendor guidance on alternate authentication methods.)
  • SonicWall remote-access products have been targeted repeatedly in 2026, so attackers may keep probing SonicWall edge devices, and customers' security teams could face further urgent patch cycles. (precedent: DEV Community analysis lists SMA1000 zero-days exploited in July and September 2026 and exploitation attempts on CVE-2026-102255 in October 2026; WindowsForum notes these are not tied to CVE-2026-19868 as one campaign.. Watch for: New SonicWall advisories or CISA KEV additions for SonicWall products in the coming weeks.)

Sources: SecurityWeek: SonicWall patches exploited SonicOS bug that weakens VPN logins, Ostorlab: SonicWall SSLVPN SAML bypass CVE-2026-19868, WindowsForum: SonicOS SSL VPN SAML bypass patch on Gen7 and Gen8, WindowsForum: CISA flags exploited SonicWall SSLVPN SAML and MFA bypass, Security Affairs: CISA adds SonicWall SonicOS SSLVPN flaw to KEV, Cybersecuritynews: SonicOS SSLVPN vulnerability exploited, SecurityOnline: SonicWall SonicOS SSLVPN CVE-2026-19868 exploited, DEV Community: SonicWall CVE-2026-19868 SSL VPN SAML MFA bypass exploited in the wild

Written in our own words from the sources above, and checked claim by claim before it was published. The report below says only what each outlet said.

The report: what outlets said

SecurityWeek reports that SonicWall has patched seven SonicOS vulnerabilities, including CVE-2026-19868, an SSL VPN flaw that has been exploited in attacks.[1] According to SecurityWeek, the bug can let attackers holding credentials for a different login method get past SAML checks, including SAML-enforced MFA.[1]

SonicWall's advisory, as quoted by SecurityWeek, says "An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls."[1]SonicWall said its product security team "has investigated a report indicating potential exploitation of this vulnerability."[1] Security Affairs quotes the company as saying "Customers are strongly urged to upgrade to the latest release as soon as possible."[2]SecurityWeek reports that CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog on the same day.[1] According to Security Affairs, CISA orders federal agencies to fix the flaw by November 20, 2026.[2]SecurityWeek says neither the vendor nor CISA has shared any details about the suspected attacks.[1] The outlet adds that it's also unclear whether the flaw was exploited as a zero-day.[1]According to SecurityWeek, impacted devices include Gen7 TZ, NSa, NSsp and NSv firewalls with SonicOS 7.3.3-7015 or older.[1] Ostorlab reports that the flaw is fixed in 7.3.4-7013 and 8.2.3-8015.[3]Ostorlab notes that SonicWall says the flaw "ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins".[3] Ostorlab also says an internet user with no account on the firewall or its identity sources cannot use this path.[3]SecurityWeek reports that CVE-2026-19868 has a CVSS score of 7.1[1]. Windows Forum reports that other aggregators list 7.5[4].

Listen to the songCritical CVEs — November 08, 2026

Sources

  1. [1]SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins - SecurityWeek
  2. [2]U.S. CISA adds SonicWall SonicOS SSLVPN flaw to its Known Exploited Vulnerabilities catalog
  3. [3]SonicWall SSLVPN SAML Bypass, Exploited in the Wild (CVE-2026-19868) | Ostorlab
  4. [4]SonicWall SonicOS SSL-VPN SAML Bypass: Patch CVE-2026-19868 on Gen 7 and Gen 8 Firewalls

Every sentence here reports what a named outlet said, with a link to it. Compiled by 93 from the reporting below.

This topic, day by day

CVE-2026-19868: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability | 93