SonicWall SSL VPN: a second login method lets attackers skip SAML MFA. Upgrade SonicOS before November 20

SonicWall patched seven SonicOS flaws on November 6, and one of them is already on CISA’s exploited list. On firewalls that use SAML for SSL VPN logins, a user who also holds a password for another login method can get in without ever seeing the SAML prompt, and without the MFA your identity provider enforces.

CISA added the bug to its Known Exploited Vulnerabilities catalog the same day and gave federal agencies until November 20. SonicWall lists no workaround. The fix is the firmware upgrade.

If your SonicWall VPN sends users to SAML for MFA, an old local or LDAP password can walk around it. Upgrade SonicOS, then close the second login path.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

SonicWall VPN logins can skip SAML MFA

CVE-2026-19868 is an authentication enforcement flaw in the SonicOS SSLVPN service. SonicWall’s advisory SNWLID-2026-0014 says a user with valid credentials for an alternate authentication method may bypass SAML authentication controls, and that successful exploitation may also bypass SAML-enforced multi-factor authentication. SonicWall rates it CVSS 7.1; CISA’s score in NVD is 7.5.

SonicWall says its PSIRT “has investigated a report indicating potential exploitation of this vulnerability.” Neither SonicWall nor CISA has published indicators, and no public proof-of-concept was reported as of November 6.

• Affected: Gen7 TZ, NSa, NSsp and NSv firewalls on SonicOS 7.3.3-7015 or older; Gen8 TZ, NSa and NSv on 8.2.2-8015 or older.
• Fixed: SonicOS 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8) or later. No workaround is listed.
• Only SSL VPN services with SAML enabled for logins are exposed to CVE-2026-19868. The same advisory also fixes CVE-2026-107154 and CVE-2026-107155 (CVSS 8.8, SonicOS management interface) and CVE-2026-82308, a pre-authentication heap overflow in the SSL-VPN service that can crash it.

Firewalls that send VPN users to an identity provider

SAML is how most companies push VPN logins through Entra ID, Okta or another identity provider so MFA applies everywhere. This bug reopens the older door: any account that still has a local, LDAP or RADIUS password the firewall accepts becomes a single-factor login to the VPN. Stolen or guessed passwords for those accounts are exactly what VPN brute-forcing campaigns collect.

SonicWall SSL VPNs have been a favorite ransomware entry point for two years. A KEV listing with no workaround means internet-facing firewalls with SAML turned on are the ones to upgrade first, before the November 20 federal date.

Upgrade SonicOS to 7.3.4-7013 or 8.2.3-8015 this week

• Check the SonicOS version on every Gen7 and Gen8 firewall (Device, then Status), and whether SSL VPN logins use SAML.
• Upgrade Gen7 units to 7.3.4-7013 or later and Gen8 units to 8.2.3-8015 or later. Do it even where SAML is off, because the management-interface bugs in the same advisory still apply.
• Until the upgrade lands, remove or disable non-SAML login methods (local users, LDAP, RADIUS) for SSL VPN accounts that are meant to use SAML, and keep one separate admin path.
• Restrict the SSL VPN portal and the management interface to known source addresses where you can.
• Reset passwords for any account that can still log in by the alternate method. Our password strength checker shows how long a password holds up against guessing.

Details

• CVE-2026-19868 (SNWLID-2026-0014): SonicOS SSLVPN authentication enforcement flaw; alternate-method credentials bypass SAML and SAML-enforced MFA. CWE-308. CVSS 7.1 (SonicWall), 7.5 (CISA ADP).
• Fixed: SonicOS 7.3.4-7013 (Gen7 TZ, NSa, NSsp, NSv) and 8.2.3-8015 (Gen8 TZ, NSa, NSv). No workaround.
• KEV: added November 6, 2026; federal due date November 20, 2026. Ransomware use: unknown.
• Also in the advisory: CVE-2026-107154 and CVE-2026-107155 (management interface, CVSS 8.8), CVE-2026-82308 (pre-auth SSL-VPN heap overflow, denial of service).

Hunt / verify

• Export SSL VPN authentication logs since late October and list successful logins that did not go through SAML for users who are supposed to use SAML.
• Flag VPN sessions from hosting or VPS address ranges, and sessions that start internal scanning within minutes of connecting.
• Review local user accounts and LDAP/RADIUS groups on the firewall that still grant SSL VPN access.
• Confirm the running firmware after the upgrade; a box that rebooted into the old image is still exposed.

Source: SonicWall SNWLID-2026-0014; CISA KEV alert, November 6

Sources

• SonicWall PSIRT: SNWLID-2026-0014 (SonicOS, seven vulnerabilities)
• CISA: CISA Adds One Known Exploited Vulnerability to Catalog (November 6, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• SecurityWeek: SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
• Security Affairs: CISA adds SonicWall SonicOS SSLVPN flaw to KEV
• CVE.org: CVE-2026-19868
• NVD: CVE-2026-19868

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].