2026-11-07
SonicWall SonicOS SSL-VPN CVE-2026-19868: SAML and its MFA can be bypassed, in CISA KEV (upgrade Gen7 and Gen8)
CVE-2026-19868 is a flaw in the SSL-VPN service of SonicWall SonicOS, the operating system of SonicWall's firewalls. Per SonicWall's advisory SNWLID-2026-0014 of November 6, 2026, on a firewall where SAML is enabled for SSL-VPN logins, a user with valid credentials for an alternate authentication method may bypass the SAML authentication controls, and with them the multi-factor authentication (MFA) that SAML enforces. SonicWall says its security team investigated a report indicating potential exploitation. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on November 6, with a due date of November 20. Affected: Gen7 firewalls on SonicOS 7.3.3-7015 and older, and Gen8 firewalls on 8.2.2-8015 and older. Fixed: 7.3.4-7013 and 8.2.3-8015 or later. There is no workaround. The same advisory covers six other CVEs, including flaws in the management interface and a pre-authentication flaw in SSL-VPN that can stop the service. Our conclusion: if you run a Gen7 or Gen8 SonicWall firewall, upgrade it now whether or not you use SAML, and if you rely on SAML and MFA for VPN logins, check which other accounts can still sign in to SSL-VPN.