A SonicWall SonicOS flaw that can let an attacker slip past SAML-based login checks on SSL VPN is being exploited, and CISA has added it to its Known Exploited Vulnerabilities (KEV) catalog. The bug, tracked as CVE-2026-19868, matters because many organizations rely on SAML single sign-on and MFA to protect their VPN entry point.
What happened
SonicWall published advisory SNWLID-2026-0014 on November 6, 2026. It covers seven vulnerabilities in SonicOS, including CVE-2026-19868 in the SSL VPN component. According to SecurityWeek and security firm Ostorlab, the problem affects only devices where SAML is enabled for SSL VPN logins. A person holding valid credentials for a different authentication method can bypass the SAML checks, including SAML-enforced MFA.
Both outlets report that SonicWall rates the flaw 7.1 (High), while the CISA-supplied score in the CVE record is 7.5. Ostorlab notes the attacker still needs a valid password, so this is not an unauthenticated takeover. CISA added the flaw to KEV on November 6 and, per both outlets, set a November 20 remediation deadline for U.S. federal agencies.
SecurityWeek reports that SonicWall’s security team investigated a report indicating potential exploitation. Neither SonicWall nor CISA has published details of the attacks, and SecurityWeek credits the discovery to Ryan Harris of The Electronic Office.
Who is affected
| Platform | Vulnerable | Fixed |
|---|---|---|
| Gen7 (TZ, NSa, NSsp, NSv) | SonicOS 7.3.3-7015 and older | 7.3.4-7013 |
| Gen8 (TZ, NSa, NSv) | SonicOS 8.2.2-8015 and older | 8.2.3-8015 |
Only appliances that use SAML for SSL VPN logins are exposed. Both sources say SonicWall lists no workaround, so upgrading is the fix.
What to do
- Check your SonicOS version (System > Status) and whether SAML is enabled for SSL VPN logins.
- Upgrade to 7.3.4-7013 (Gen7) or 8.2.3-8015 (Gen8). Do not wait for the CISA deadline if the VPN is internet-facing.
- Until patched, Ostorlab suggests disabling or removing SSL VPN accounts that can use a non-SAML login method, limiting which source addresses can reach the VPN, and reviewing logs for successful non-SAML logins. These steps reduce exposure but do not fix the flaw.
- Our analysis: because the bug targets MFA, review VPN logins since early November for unexpected users or locations, and rotate passwords for any account that looks suspicious.
What we still do not know
No victims, threat actors, indicators of compromise or proof-of-concept code have been made public. It is not confirmed whether the flaw was used before the patch was released, and the advisory does not name which alternate authentication methods trigger the bypass. We could not load SonicWall’s advisory page or CISA’s alert directly, so the advisory and KEV details above come from SecurityWeek and Ostorlab and should be checked against the vendor advisory.
Sources: SecurityWeek, Nov 7, 2026; Ostorlab, Nov 7, 2026.
Leave a Reply