SonicWall SonicOS SSLVPN · Exploitation confirmed

SonicWall Patches Exploited SSL-VPN Flaw That Bypassed SAML MFA

Nov 06, 2026 · 1 min read

SonicWall has patched CVE-2026-19868 in SonicOS SSL-VPN: a user with valid credentials for an alternate authentication method could bypass SAML authentication controls, including SAML-enforced MFA. CISA added the flaw to its KEV catalog, indicating confirmed exploitation, with a federal deadline of November 20, 2026. Versions 7.3.4-7013 and 8.2.3-8015 resolve the issue and there are no workarounds; update affected firewalls.

By HIFY Radar newsroom Updated 11/07/2026 07:25 AM Get this every day →← Back to the feed 2 sources

CriticalVulnerabilityExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

SonicWall has released a patch for a flaw in the remote access VPN service of its firewalls. The flaw allowed attackers to bypass SAML authentication, including the second verification factor (MFA). CISA, the US cybersecurity agency, confirms it has been used in attacks.

Why it matters

With valid credentials for another login method, an attacker could enter the VPN without passing MFA and gain remote access to the internal network. The risk exists on firewalls with SAML login enabled on the SSL VPN. US federal agencies must fix it by November 20, 2026.

What to do

Update now to SonicOS 7.3.4-7013 (Gen7) or 8.2.3-8015 (Gen8); there is no workaround. Review SSL VPN accounts, sessions and logs for unusual access.

For the technical team

CVE: CVE-2026-19868
Affected: SonicWall SonicOS SSLVPN (VPN de acesso remoto em firewalls SonicWall) · Gen7 TZ, NSa, NSsp and NSv firewalls with SonicOS 7.3.3-7015 or older; Gen8 TZ, NSa and NSv firewalls with SonicOS 8.2.2-8015 or older.
Exploitation: CISA added the flaw to the KEV catalog on the same day as SonicWall's advisory (November 6, 2026), with a federal deadline of November 20; SonicWall investigated a report indicating potential exploitation. Ransomware use: unknown, per CISA. Neither SonicWall nor CISA shared details on the suspected attacks; it is unclear whether the flaw was exploited as a zero-day.
Fix: SonicOS 7.3.4-7013 and 8.2.3-8015 resolve the issue. There are no workarounds; SonicWall urges customers to upgrade to the latest release as soon as possible.
Vector: SonicOS SSL VPN component. Use of single-factor authentication vulnerability (CVE-2026-19868, CVSS 7.1): a user with valid credentials for an alternate authentication method bypasses SAML authentication controls and also SAML-enforced MFA. Condition: SAML-based login enabled on the SSL VPN.
More details: Flaw reported by Ryan Harris of The Electronic Office. Part of a November 6 advisory covering seven vulnerabilities; none of the other six is marked as exploited. Two, each with CVSS 8.8, affect the SonicOS management interface (a permissive cross-domain policy issue and a session validation bug) and, under certain circumstances, could be abused remotely without logging in. Three are pre-authentication buffer overflows in the SSL VPN service and the TACACS+ authentication client, usable for application-level DoS. The last is a weak password hashing issue in virtual appliances: an attacker with high-privileged local access could exploit it to obtain a platform credential.

Timeline

11/07/2026 07:25 AM
SonicWall releases a patch for the CVE-2026-19868 SonicOS SSL-VPN flaw.
11/06/2026 05:14 PM
CISA lists the flaw in KEV, indicating confirmed exploitation, with a federal deadline of November 20, 2026.