Attackers are exploiting CVE-2026-19868, a SonicOS SSL-VPN flaw that lets someone with valid credentials for another login method get past SAML sign-in and SAML-enforced MFA. CISA added it to its exploited list on November 6 with a November 20 federal deadline. Fixed builds are SonicOS 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8. There is no workaround.
If your company’s remote access runs through a SonicWall Gen7 or Gen8 firewall with SSL-VPN and SAML single sign-on, update SonicOS today. Attackers are exploiting CVE-2026-19868, a flaw that lets a user with valid credentials for a different login method get past the SAML sign-in, and with it any MFA you enforce through SAML. The fix is SonicOS 7.3.4-7013 on Gen7 and 8.2.3-8015 on Gen8. SonicWall says there is no workaround.
What CISA and SonicWall confirmed
CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on November 6 and gave federal civilian agencies until November 20 to fix it. Its entry describes “use of single-factor authentication” in the SonicOS SSL-VPN: a user with valid credentials for an alternate authentication method can bypass SAML controls, and a successful attack “may also bypass SAML-enforced multi-factor authentication.” CISA lists ransomware use as unknown.
SonicWall’s advisory is SNWLID-2026-0014. The NVD entry carries a CISA score of 7.5 (High). SonicWall’s own score is 7.1, according to SecurityOnline.
Who is affected
According to SecurityOnline, which quotes the advisory, the flaw only affects the SSL-VPN service when SAML is turned on for it. Affected builds:
| Line | Affected | Fixed |
|---|---|---|
| Gen7 (TZ, NSa, NSsp and NSv) | SonicOS 7.3.3-7015 and earlier | 7.3.4-7013 or later |
| Gen8 | SonicOS 8.2.2-8015 and earlier | 8.2.3-8015 or later |
The same release fixes six other SonicOS bugs. Only CVE-2026-19868 is confirmed exploited. BleepingComputer also reported the attacks.
What to do today
- Check the build. In the SonicOS management console, confirm the firmware version against the table above.
- Update. Install 7.3.4-7013 or 8.2.3-8015 or later. SonicWall offers no workaround, so a config change will not close this.
- Review VPN logins. Look for SSL-VPN sessions since your last firmware update that did not go through your identity provider or skipped MFA, and for accounts signing in with a local or LDAP password when they normally use SAML.
- Retire alternate logins you don’t need. The attack needs valid credentials for another method. Remove or disable local VPN accounts and fallback authentication paths that SAML users should never use, and reset passwords on any that stay.
- If you use an MSP, ask them for the firmware version and the log review result in writing this week.
SAML only protects the login path it sits on
Putting a VPN behind SAML is meant to make one identity provider, with one MFA policy, control every sign-in. This flaw shows the weak point in that setup: a second login method left on the same gateway. If the firewall still accepts a local or directory password, the strongest MFA policy upstream does not apply to that path. SonicWall VPNs have been hit through an MFA gap before: in May, BleepingComputer reported attackers using CVE-2024-12802 on Gen6 devices that looked patched. For other VPN gateways under attack this month, see the Ivanti Connect Secure zero-days.