CVE-2026-19868SonicWall SonicOS SSLVPN SAML authentication and MFA bypass

Executive summary

CVE-2026-19868 is an authentication enforcement flaw (CWE-308, use of single-factor authentication) in the SonicOS SSLVPN service. When SAML is enabled for SSLVPN logins, a user with valid credentials for an alternate authentication method may bypass SAML authentication controls and, with them, SAML-enforced MFA. Only SSLVPN with SAML enabled is affected.

SonicWall published advisory SNWLID-2026-0014 on 2026-11-06 together with six other SonicOS fixes. CISA added CVE-2026-19868 to KEV the same day, confirming exploitation in the wild; SonicWall's PSIRT reportedly investigated a report of potential exploitation but shared no details. No workaround is available; affected are Gen7 7.3.3-7015 and older and Gen8 8.2.2-8015 and older, fixed in 7.3.4-7013 and 8.2.3-8015.

For SOC teams the practical impact is that SAML/IdP-based MFA can no longer be assumed to protect SSLVPN access on unpatched devices: stolen or brute-forced credentials may be enough. VPN logins without a matching IdP sign-in should be hunted for.

Threat assessment

Severity is HIGH rather than critical because valid credentials are required (CVSS 3.1 7.5 from CISA-ADP; SonicWall's own score is reported as 7.1). Where SAML MFA is the main control against stolen or guessed passwords, this bypass removes that protection, so the effective risk depends on credential hygiene for all non-SAML SSLVPN accounts.

Exploitation is confirmed by the KEV listing, but no named source has published technical details, IOCs, victim counts or threat-actor attribution for this CVE as of 2026-11-10. KEV lists known ransomware campaign use as "Unknown". Treat any SSLVPN session since before 2026-11-06 that has no corresponding IdP authentication as suspicious.

Timeline

1. 2026-11-20

   CISA KEV remediation due date for federal civilian agencies. Source

2. 2026-11-06

   CISA adds CVE-2026-19868 to the KEV catalog. Source

3. 2026-11-06

   SonicWall publishes SNWLID-2026-0014 with fixes in SonicOS 7.3.4-7013 and 8.2.3-8015; six further SonicOS CVEs fixed. Source

4. 2026-08-14

   CVE-2026-19868 reserved by SonicWall. Source

Affected & exposure

SonicOS Gen7 (TZ, NSa, NSsp, NSv): 7.3.3-7015 and older - fixed in 7.3.4-7013 or later.

SonicOS Gen8 (TZ, NSa, NSv): 8.2.2-8015 and older - fixed in 8.2.3-8015 or later.

Only relevant when SAML is enabled for SSLVPN logins (per SonicWall advisory as quoted by SecurityOnline and Oflight).

Gen6 and other platforms are not listed in the CVE record (defaultStatus unknown).

Exploitation in the wild

CISA added CVE-2026-19868 to KEV on 2026-11-06 (due date 2026-11-20, known ransomware use: Unknown); CISA-ADP SSVC: Exploitation active, Automatable no, Technical Impact partial.

SonicWall PSIRT investigated a report indicating potential exploitation but did not share details (BleepingComputer, Oflight).

Attack precondition: valid credentials for an alternate (non-SAML) authentication method for SSLVPN; the vendor has not described which alternate method or configuration triggers the bypass (Oflight).

No IOCs, exploitation telemetry or threat-actor attribution published by a named source as of 2026-11-10. Reported by Ryan Harris (The Electronic Office) per BleepingComputer.

Detection & hunting

No vendor IOCs exist. Hunt for successful SSLVPN logins on SAML-configured appliances that lack a matching IdP sign-in for the same user in a short window, for SSLVPN logins by non-SAML (local or directory) accounts, and for new VPN source IPs or geographies. Preserve SSLVPN logs before upgrading.

index=network sourcetype=sonicwall* (msg="*SSL VPN*" OR msg="*SSLVPN*") (msg="*login allowed*" OR msg="*logged in*" OR msg="*login succeeded*")
| eval user=lower(coalesce(user, usr, src_user))
| table _time user src_ip host msg
| join type=left user [
    search index=azure sourcetype="azure:aad:signin" earliest=-30d (appDisplayName="*SonicWall*" OR appDisplayName="*SSLVPN*")
    | eval user=lower(mvindex(split(userPrincipalName, "@"), 0))
    | stats latest(_time) as idp_last by user ]
| where isnull(idp_last) OR abs(_time - idp_last) > 600
| stats count min(_time) as first max(_time) as last values(src_ip) as src_ips by user host

let window = 10m;
let vpn = CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DeviceVendor == "SonicWall"
| where Activity has_any ("SSL VPN", "SSLVPN") and Activity has_any ("login allowed", "logged in", "login succeeded")
| extend User = tolower(tostring(split(SourceUserName, "@")[0]))
| project VpnTime = TimeGenerated, User, SourceIP, DeviceName, Activity;
let idp = SigninLogs
| where TimeGenerated > ago(30d)
| where AppDisplayName has_any ("SonicWall", "SSLVPN") and ResultType == 0
| extend User = tolower(tostring(split(UserPrincipalName, "@")[0]))
| project IdpTime = TimeGenerated, User;
vpn
| join kind=leftouter idp on User
| extend matched = iff(isnotempty(IdpTime) and abs(datetime_diff('second', VpnTime, IdpTime)) <= 600, 1, 0)
| summarize Matched = max(matched) by VpnTime, User, SourceIP, DeviceName, Activity
| where Matched == 0
| order by VpnTime desc

title: SonicWall SSLVPN Successful Login (baseline for CVE-2026-19868 hunting)
status: experimental
description: Collects successful SonicOS SSLVPN logins for correlation with IdP sign-in logs and new-source-IP baselining. Field names and message text must be adapted to the local SonicWall syslog parser.
references:
  - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014
logsource:
  product: sonicwall
  service: firewall
detection:
  selection_vpn:
    msg|contains:
      - 'SSL VPN'
      - 'SSLVPN'
  selection_success:
    msg|contains:
      - 'login allowed'
      - 'logged in'
  condition: selection_vpn and selection_success
fields:
  - usr
  - src
  - msg
falsepositives:
  - Legitimate VPN users; use as correlation input, not as a standalone alert
level: low

Mitigation

• Upgrade SonicOS to 7.3.4-7013 or later (Gen7) or 8.2.3-8015 or later (Gen8). SonicWall lists no workaround.
• Until patched, restrict SSLVPN exposure (source IP allow-lists, geo-restrictions) or temporarily disable SSLVPN if feasible; these are general measures, not vendor workarounds.
• Inventory and disable SSLVPN-capable accounts and authentication methods that are not needed alongside SAML (unused local or directory accounts).
• Save SSLVPN logs before upgrading and correlate VPN logins with IdP (Entra ID, Okta) sign-in logs; investigate VPN sessions without a matching IdP authentication.
• Reset passwords for accounts with suspicious VPN logins and review their subsequent internal activity; consider resetting credentials of all SSLVPN users if bypass logins are found.
• Ensure the SonicOS management interface is not exposed to the internet; the same advisory fixes two 8.8-rated management interface flaws (CVE-2026-107154, CVE-2026-107155).
• US federal agencies: KEV due date 2026-11-20.

Update log

Sources

1. SonicWall PSIRT advisory SNWLID-2026-0014
2. CVE record CVE-2026-19868 (CVE List V5)
3. CISA Known Exploited Vulnerabilities catalog (JSON)
4. BleepingComputer: SonicWall warns of new SSL VPN MFA bypass flaw exploited in attacks
5. SecurityOnline: SonicWall SonicOS SSLVPN CVE-2026-19868 exploited
6. Oflight: SonicWall CVE-2026-19868 (SSLVPN SAML and MFA Bypass): How to Check Exposure and Fix It