How to tell if your SonicWall SSL-VPN MFA was bypassed
Quick answer: On Friday, Nov 6, 2026, SonicWall disclosed CVE-2026-19868, an authentication-enforcement flaw in SonicOS SSL-VPN. If SAML is enabled for SSL-VPN, someone who already has valid credentials for an alternate login method can skip SAML controls — including MFA that SAML was supposed to enforce. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a Nov 20 deadline for federal civilian agencies. Fixed builds are SonicOS 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8). There is no workaround. (CISA KEV; Help Net Security; SecurityWeek)
What was disclosed
- CVE-2026-19868 (advisory SNWLID-2026-0014) is one of seven SonicOS flaws SonicWall published on Nov 6. Outlets quoting the advisory give it a CVSS 7.1. Only this one is flagged as exploited. (IT Pro; SecurityWeek)
- SonicWall’s description, as quoted by SecurityWeek and IT Pro: a user with valid credentials for an alternate authentication method may bypass SAML authentication controls, and successful exploitation may also bypass SAML-enforced MFA.
- The SSL-VPN path is exposed only when SAML-based login is enabled. This is not an unauthenticated remote bypass: the attacker still needs working credentials for another method first. (Help Net Security; SecurityWeek)
- SonicWall PSIRT said it investigated a report indicating potential exploitation and urged customers to upgrade. Neither SonicWall nor CISA has published attack details, named victims, or indicators of compromise. (Help Net Security; CISA alert)
- Reporter: Ryan Harris of The Electronic Office / Electronic Office. (SecurityWeek; Help Net Security)
Am I affected?
You are in the high-priority group if all of these are true:
- You run a Gen7 or Gen8 SonicWall firewall (hardware TZ/NSa/NSsp or NSv virtual) on SonicOS 7.3.3-7015 or older (Gen7) or 8.2.2-8015 or older (Gen8). (SecurityWeek; IT Pro)
- SSL-VPN is enabled with SAML as the expected login path (for example Okta or Microsoft Entra ID plus MFA).
- An alternate authentication method is still accepted for the same users (SonicWall’s advisory wording; outlets do not name which methods).
Lower urgency, still patch: Gen7/Gen8 boxes on those older builds that do not use SAML for SSL-VPN. The same releases fix six other SonicOS flaws; none of those six are marked exploited in the coverage we checked. (Help Net Security)
Not listed as affected for this CVE: Gen6 firewalls. Help Net Security notes they are end-of-support, and SonicWall advises customers on that hardware to move to Gen8. (Help Net Security)
Home readers without a SonicWall firewall: this is an IT / remote-access story, not a consumer app breach. If your workplace VPN runs on SonicWall, ask your admin whether SAML SSL-VPN is in use and whether the box is on a fixed build.
What to do
- Upgrade firmware. Gen7 → 7.3.4-7013 or later. Gen8 → 8.2.3-8015 or later. SonicWall lists no workaround. Back up the config first. (SecurityWeek; IT Pro)
- Treat Nov 20 as a hard internal deadline even if you are not a federal agency. That is CISA’s due date for FCEB agencies under BOD 26-04 for this KEV entry. (CISA KEV)
- Hunt for bypassed MFA. Compare recent successful SSL-VPN logins on the firewall with sign-in (and MFA) events at your identity provider. Any SAML-intended account that got a VPN session without a matching IdP MFA event is worth treating as suspicious. (Help Net Security)
- Rotate credentials for any account that logged in that way — especially passwords / secrets used by the alternate authentication methods — end open sessions, and review what those sessions could reach. (Help Net Security)
- After the upgrade, confirm SSL-VPN still enforces SAML (and MFA) the way you intend, and disable alternate login paths that should not remain a back door.
What’s still unclear
- No public IoCs, no named victims, and no published analysis of what attackers did after a successful login. (Help Net Security)
- CISA lists ransomware use for this KEV entry as Unknown, and forensic triage is not required under BOD 26-04 for this CVE. (CISA KEV)
- SonicWall’s own advisory page (SNWLID-2026-0014) was not readable in this draft pass; the vendor wording above is taken from SecurityWeek, IT Pro and Help Net Security quoting that advisory.
Sources
- CISA, Known Exploited Vulnerabilities Catalog entry for CVE-2026-19868 (added Nov 6, 2026; due date Nov 20, 2026): https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19868
- CISA, “CISA Adds One Known Exploited Vulnerability to Catalog,” Nov 6, 2026: https://www.cisa.gov/news-events/alerts/2026/11/06/cisa-adds-one-known-exploited-vulnerability-catalog
- Help Net Security, “Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868),” Nov 9, 2026: https://www.helpnetsecurity.com/2026/11/09/exploited-sonicwall-ssl-vpn-flaw-lets-attackers-bypass-saml-enforced-mfa-cve-2026-19868/
- SecurityWeek, “SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins,” Nov 7, 2026: https://www.securityweek.com/sonicwall-patches-exploited-sonicos-bug-that-weakens-vpn-logins/
- IT Pro, “SonicWall issues fixes for seven vulnerabilities – including an SSL-VPN flaw that bypasses MFA,” Nov 9, 2026: https://www.itpro.com/security/sonicwall-issues-fixes-for-seven-vulnerabilities-including-an-ssl-vpn-flaw-that-bypasses-mfa
- BleepingComputer, “SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks” (secondary; page blocked to automated fetch this run — facts cross-checked against the outlets above): https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/
- SonicWall PSIRT advisory SNWLID-2026-0014 (cited via the outlets above; direct page returned empty content this run): https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014
— AltTab Dad