SonicWall SonicOS MFA bypass: patch before 20 November

Short read

This post covers CVE-2026-19868, a SonicWall SonicOS SSL VPN flaw that can let someone with valid credentials for a different login method get past SAML sign-in, including SAML-enforced MFA. CISA has added it to its Known Exploited Vulnerabilities catalogue.

You'll learn which firewalls are affected, why "we have MFA on the VPN" may not be the whole story, and the practical steps to take before CISA's 20 November deadline for US federal agencies.

A SonicWall SonicOS MFA bypass is the kind of bug that quietly undoes a control most organisations count on. Many teams put SAML single sign-on and multi-factor authentication in front of their SSL VPN precisely so that a stolen password is not enough. CVE-2026-19868 shows that, on affected SonicWall firewalls, a second way of logging in can leave a gap around that front door.

SonicWall patched the flaw on 6 November 2026 as one of seven SonicOS vulnerabilities in a single advisory, and said it had investigated a report of potential exploitation. CISA added it to its Known Exploited Vulnerabilities catalogue the same day, based on evidence of active exploitation.

What CVE-2026-19868 does

SonicWall describes it as an authentication enforcement vulnerability in the SonicOS SSL VPN service. In its words, it "may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA)."

Put plainly: if your VPN is meant to send everyone through SAML (and your identity provider's MFA), but another authentication method is also defined, someone holding valid credentials for that other method may be able to skip the SAML step entirely.

Key details, as reported by SecurityWeek and BleepingComputer:

• Severity: CVSS 7.1 from SonicWall; CISA's own scoring on NVD gives 7.5.
• Condition: the SSL VPN is only exposed if SAML-based login is enabled.
• Exploitation: SonicWall investigated a report of potential exploitation. Neither SonicWall nor CISA has shared details of the attacks, and it is not clear whether the flaw was used before the patch was available.
• Workarounds: none. Upgrading is the fix.

The flaw was reported by Ryan Harris of The Electronic Office.

Which firewalls are affected

According to SonicWall's advisory, as summarised by SecurityWeek:

• Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older. Fixed in 7.3.4-7013.
• Gen8 TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or older. Fixed in 8.2.3-8015.

Check SonicWall's own advisory, SNWLID-2026-0014, for the build you actually run.

The other six flaws in the same advisory

SonicWall has not marked the other six as exploited, but they are fixed by the same upgrade, so they are worth knowing about:

• CVE-2026-107155 and CVE-2026-107154 (both CVSS 8.8): a permissive cross-domain policy issue and a session validation bug in the SonicOS management interface. Under specific conditions, a remote attacker could abuse either without logging in to take unauthorised actions.
• Pre-authentication buffer overflows in the SSL VPN service (including CVE-2026-82308, CVSS 7.5) and the TACACS+ authentication client, which could be used for denial-of-service.
• A weak password hashing issue in virtual appliances, which an attacker who already has high-privileged local access could use to obtain a platform credential.

The two management interface flaws are another reason to make sure the firewall's admin interface is not reachable from the internet.

Why "we have MFA on the VPN" is not the whole answer

This bug does not break MFA itself. It goes around it, using credentials that already exist for another login method. That matters because stolen credentials are rarely in short supply. A report from Elastic Security Threat Command, covered today by Help Net Security, found that attackers used stolen credentials to log in an average of eight minutes after infection across 27 confirmed infostealer cases. The same report describes attackers submitting stolen usernames and passwords through an older authentication method that allowed access without a second factor.

The pattern is the same: MFA protects the routes it is applied to. Any other route that accepts a password on its own is the one attackers will look for. SonicWall's edge devices have also been a frequent target. SecurityWeek notes that CISA's KEV catalogue already lists 20 SonicWall flaws.

What to do this week

1. Upgrade SonicOS. Move Gen7 firewalls to 7.3.4-7013 and Gen8 firewalls to 8.2.3-8015 or later. There is no workaround, so this is the fix. CISA has given US federal agencies until 20 November 2026; there is no reason for anyone else to wait that long.
2. Review every SSL VPN authentication method. If SAML is meant to be the only way in, list what else is configured, such as local users, LDAP or RADIUS, and remove anything that should not be there.
3. Rotate credentials for the alternate methods. If local or directory accounts can authenticate to the VPN, treat their passwords as potentially exposed and change them, starting with privileged and shared accounts.
4. Look back at VPN logins. Check for SSL VPN sessions that did not pass through your identity provider, logins from unfamiliar locations or at odd hours, and accounts that are normally quiet suddenly connecting.
5. Keep the management interface off the internet. That reduces exposure to the two 8.8-rated management interface flaws as well.

If you can't patch every firewall today, prioritise the ones with SAML-based SSL VPN login enabled, since that is the configuration CVE-2026-19868 affects.

The wider lesson

Edge devices like VPNs and firewalls are where a stolen password turns into network access. Strong authentication only helps on the paths it actually covers, and vendor bugs or leftover configuration can open new ones. Patching quickly, keeping an accurate list of every way in, and watching the logins that come through the edge are what turn an advisory like this into a non-event.