A user with credentials for an alternate auth method can bypass SAML and its MFA on SonicOS Gen7 and Gen8 SSL VPN. CISA added it to KEV on 6 November with a 20 November deadline.
SonicWall has patched an authentication flaw in the SonicOS SSLVPN service, tracked as CVE-2026-19868, that can let a user holding valid credentials for an alternate authentication method bypass SAML authentication controls, including SAML-enforced multi-factor authentication. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 6 November 2026, citing evidence of active exploitation. Organisations running SonicWall Gen7 or Gen8 firewalls with SSL VPN behind SAML should treat it as an urgent upgrade.
Who is affected
NVD lists SonicOS on Gen7 at 7.3.3-7015 and older, and Gen8 at 8.2.2-8015 and older. BleepingComputer reports that only SSL-VPN configured for SAML is affected, and that the fixed builds are 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8). SonicWall is reported to offer no workaround, so upgrading is the only remedy. We could not read the SonicWall PSIRT advisory (SNWLID-2026-0014), which renders in the browser only, so the fixed builds and the no-workaround statement rest on that press report. Check them against the advisory before you change anything.
What the flaw does
The record describes an authentication enforcement failure. If an appliance accepts more than one authentication method on the SSL VPN, an attacker who has credentials valid for the alternate method may be able to skip the SAML step, and with it the identity provider's MFA prompt. CISA names the weakness as use of single-factor authentication, and NVD maps it to CWE-308. The attacker still needs a working credential, so this turns a stolen or phished password into VPN access that MFA should have blocked.
The intended SSL VPN login runs through SAML and MFA; the flaw lets credentials for an alternate method skip both.
Severity scores differ. NVD shows a secondary CVSS 3.1 score of 7.5 (High, vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N), while BleepingComputer cites 7.1. NVD's analysis was still pending at last check. Ryan Harris of The Electronic Office is credited with the discovery. SonicWall said it investigated a report of possible exploitation. No attacker, campaign or indicators have been published in the sources we read.
KEV deadline
CISA's alert adds the flaw under BOD 26-04. The KEV fields in the NVD record give a due date of 20 November 2026 for federal civilian agencies; CISA urges all organisations to prioritise KEV entries.
What defenders should do
- Upgrade to the fixed build for your generation once confirmed on the PSIRT page.
- Find out whether SSL VPN uses SAML and whether other local or RADIUS/LDAP methods remain enabled for the same users. Disable alternate methods you do not need.
- Review SSL VPN logins since early November for sessions that never reached the identity provider, and for logins from unfamiliar addresses.
- Reset credentials of any account with suspicious VPN activity, and revoke active sessions after patching.
- The same advisory fixes six other flaws, among them two rated 8.8 in the management interface, so take the upgrade rather than a narrow fix.
Related: end-of-life GMS
Separately, SonicWall said on 3 November that SonicWall GMS 9.5.2 and earlier, which is end of life, has two flaws it will not patch: CVE-2026-109593, an unauthenticated internal file read (CVSS 9.1 on its NVD record), and CVE-2026-109594, a SQL injection needing high privileges. SonicWall advises moving to Network Security Manager (NSM). BleepingComputer reports no exploitation. Until migration, keep GMS off the internet.
SonicWall edge devices are a repeat target. See our earlier coverage: Akira Ransomware Exploits Critical SonicWall Flaw: Why Firmware Updates Alone Fail.