SonicWall SSL VPN: a flaw that bypasses SAML and MFA is being exploited, CISA warns
High CVE-2026-19868 SonicWall VPN Firewall MFA SAML

Top-Secured cyber watch: independent analysis based on the sources listed below. Top-Secured is not affiliated with the companies mentioned and will never ask you for your bank details or passwords.

CISA added CVE-2026-19868, a flaw in the SSL VPN service of SonicWall SonicOS firewalls, to its catalogue of actively exploited vulnerabilities on 6 November 2026. A user holding valid credentials for another login method can get around SAML authentication and the multi-factor authentication it enforces; fixed SonicOS releases are available.

What happened

SonicWall published security bulletin SNWLID-2026-0014 on 6 November 2026, covering several flaws in SonicOS, the system of its Gen7 and Gen8 firewalls. The same day, the US agency CISA added one of them, CVE-2026-19868, to its Known Exploited Vulnerabilities catalogue and gave federal agencies until 20 November to fix it. In its advisory of 9 November, the French CERT-FR states that SonicWall reports the flaw as actively exploited.

How the flaw works

According to the CVE record written by SonicWall, the SSL VPN service does not properly enforce the chosen authentication method. Someone who has valid credentials for an alternate method, for example a local account, can log in without going through SAML, and therefore without the multi-factor authentication that SAML was supposed to impose. CISA rates it 7.5 out of 10. In practice, a password stolen or reused elsewhere is enough to open a VPN session that the company believed was protected by MFA.

Affected versions are SonicOS 7.3.3-7015 and earlier, and 8.2.2-8015 and earlier. CERT-FR lists releases before 7.3.4-7013 and 8.2.3-8015 as vulnerable.

What to do now

  1. Update SonicOS to 7.3.4-7013 (Gen7) or 8.2.3-8015 (Gen8) or later, following bulletin SNWLID-2026-0014.
  2. List the login methods accepted by the SSL VPN: remove local or LDAP accounts that have no reason to connect if SAML is your standard.
  3. Reset the passwords of all accounts allowed on the VPN, starting with administrator and service accounts.
  4. Review the VPN logs since October: sessions opened without a SAML step, unusual source IP addresses, logins at odd hours.
  5. If the VPN portal does not need to be open to the whole Internet, restrict it by country or source address.

Our take

MFA only protects a VPN if every path to it goes through MFA. An old local account left as a fallback is enough to undo the whole setup: inventory the login methods of your exposed equipment as carefully as you patch it.

Sources

How we choose, verify and write our analyses →

Stolen logins often start with a phishing message. Received a suspicious message (SMS, WhatsApp, social networks) or email? Check it before you click:

Check a message Check an email

Worried your servers are exposed? Our team audits, patches and monitors Linux and cloud infrastructure 24/7.

Talk to an expert Our managed server services →
Back to all news