CVE-2026-19868: SonicWall SSL VPN flaw that skips SAML and MFA is being exploited

What the flaw does

Many companies put their SSL VPNthe service that lets employees reach the office network from outside over an encrypted connection behind SAMLa standard that hands the login to a central identity service, such as the company's single sign-on, so that every login also goes through multi-factor authenticationa second check after the password, such as a code or an approval on the phone. CVE-2026-19868 breaks that chain. According to SonicWall's advisory, a user "with valid credentials for an alternate authentication method" can bypass the SAML controls, and in doing so can also skip the MFA that SAML enforces.

The attacker still needs a working username and password, just not for SAML. If the firewall also accepts another way of logging in to the VPN, credentials for that method are enough to get past the stronger check. SonicWall classifies the weakness as CWE-308, use of single-factor authentication.

SonicWall stresses that the flaw "ONLY impacts" the SSL VPN when SAML is enabled for SSL VPN logins. Firewalls that do not use SAML for the VPN are not exposed to this CVE.

How serious it is

SonicWall scores it 7.1 (High) on CVSS 3.1, with the vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N. It works over the network, but the attack is rated complex and needs low privileges, which here means valid credentials. CISA's assessment in the CVE record gives a slightly higher 7.5, because it scores the attack as needing no privileges. Both put it in the High band.

The context matters more than the score. Attackers often try stolen passwords against VPN logins first, and MFA is usually what stops them. A flaw that removes the second check turns a leaked password into a way into the network.

Proof of concept or real attacks?

On November 6, CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalogCISA's public list of flaws with evidence of use in real attacks; US federal agencies must fix them by a deadline "based on evidence of active exploitation", and gave US federal civilian agencies until November 20 to act. SonicWall's advisory says its security team "has investigated a report indicating potential exploitation" and urges customers to upgrade "as soon as possible".

Neither has said who is behind the attacks, how many organizations were hit or where the credentials came from. We found no public exploit code. CISA lists ransomware use as unknown.

What to do now

1. Check whether SAML is enabled for SSL VPN logins on your SonicWall firewall. If it is, treat this as urgent.
2. Upgrade SonicOS to 7.3.4-7013 or later on Gen7 devices (TZ 270 to TZ 670, NSa 2700 to NSa 6700, NSsp and NSv 270, 470 and 870) or to 8.2.3-8015 or later on Gen8 devices (TZ 80 to TZ 680, NSa 2800 to NSa 5800 and the Gen8 NSv models). SonicWall lists no workaround.
3. Review which other login methods the VPN still accepts, and turn off the ones your users do not need.
4. Look through recent SSL VPN logins for accounts that signed in without the expected SAML and MFA step, and reset the password of any account that looks wrong.

Six other fixes in the same update

SonicWall's advisory, SNWLID-2026-0014, covers six more flaws fixed by the same versions. Two in the management interface, CVE-2026-107155 and CVE-2026-107154, score 8.8: under specific conditions and with some action by a user, they could let a remote attacker without an account perform unauthorized operations. CVE-2026-82308 is an overflow in the SSL VPN service that can crash it before login (7.5). Two flaws in the TACACS+ login client, CVE-2026-77708 and CVE-2026-77709 (5.9), can also cause a crash, and CVE-2026-19703 is a weak password hash on virtual appliances (5.2). SonicWall has not reported exploitation of these six.

SonicWall is the third maker of VPN or firewall gear to land on CISA's list in about a week. See our analysis of the Ivanti Connect Secure attacks and the Cisco firewall flaw among CISA's late-October additions.