SonicWall has patched an actively exploited vulnerability in its SonicOS SSL VPN service that can let an attacker with valid credentials for another authentication method bypass SAML controls, including SAML-enforced multifactor authentication. Tracked as CVE-2026-19868, the issue affects firewalls using SAML for SSL VPN logins and has been added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. [1][15]
The flaw affects SonicOS 7.3.3-7015 and earlier on Gen 7 physical and virtual firewalls, and SonicOS 8.2.2-8015 and earlier on Gen 8 appliances, according to the National Vulnerability Database. SonicWall lists fixes in SonicOS 7.3.4-7013 and later for the Gen 7 branch and SonicOS 8.2.3-8015 for Gen 8 devices. The affected product range includes Gen 7 TZ, NSa, NSsp and NSv firewalls. [1][2]
CISA added the vulnerability on Nov. 6 and set Nov. 20 as the remediation deadline for federal agencies. The agency’s catalog describes the issue as a single-factor authentication vulnerability, while SonicWall’s advisory, SNWLID-2026-0014, covers the security updates for Gen 7 and Gen 8 firewalls. SonicWall said it investigated a report of potential exploitation and urged customers to upgrade as soon as possible; no workaround has been identified. [4][16]
The vulnerability carries a CVSS 3.1 score of 7.5, rated high, under the CISA-ADP assessment recorded by NVD. Its vector reflects network reachability but high attack complexity and a requirement for no privileges under that scoring model; the weakness is nevertheless constrained by the need for valid credentials accepted through an alternate authentication path. NVD has not published its own independent score, and no CVSS v4 score is currently listed. [1]
For defenders, the immediate priority is to identify internet-facing SonicWall appliances with SAML-enabled SSL VPN, verify their exact SonicOS build, and install the applicable fixed release. Organizations should also review VPN and identity-provider logs for unexpected alternate-method authentication, unusual successful logins or sessions that did not complete the expected SAML flow, and investigate potentially exposed accounts. Public reporting reviewed for this article did not identify a public proof of concept or name a threat actor behind the observed attacks, so attribution remains unavailable. [1][5]
References
- NVD-CVE-2026-19868 – NIST
- SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
- SonicWall security advisory (AV26-1133) – Canadian Centre for Cyber Security
- SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
- CISA Adds One Known Exploited Vulnerability to Catalog
- SonicOS 7.3.4 and 8.2.3 Security Advisory — Gen 7 and Gen 8 Firewalls
