SonicWall: CVE-2026-19868 skips SAML MFA
SonicWall says CVE-2026-19868, now on CISA's exploited list, lets a holder of an alternate login skip SAML multi-factor checks on SonicOS SSL VPN. Federal agencies have until November 20. Move Gen7 to 7.3.4-7013 and Gen8 to 8.2.3-8015.
By ZeroDay Times Desk2 min read
![Editorial thumbnail for “SonicWall: CVE-2026-19868 skips SAML MFA”, servers graphic on a amber gold and slate split card, [ ZERO-DAY ] badge, and the ZeroDay Times mark.](/images/articles/sonicwall-cve-2026-19868-skips-saml-mfa.svg)
SonicWall told customers on Friday, November 6, 2026, to patch SonicOS. The release closes seven vulnerabilities. The one already used in attacks is CVE-2026-19868, an authentication bypass in the SSL VPN, scored 7.1. It applies where that VPN uses SAML. Someone who already holds valid credentials for a different login method can skip the SAML checks, including the multi-factor step SAML is there to enforce.
SonicWall’s product security team said it investigated a report of exploitation and told customers to install the latest release. The company has not described that incident. CISA has added CVE-2026-19868 to the Known Exploited Vulnerabilities catalog. Federal civilian agencies have until November 20, 2026 to secure the affected systems. Ryan Harris of The Electronic Office found and reported the flaw.
Which build is still in the bug
The bypass reaches SonicOS Gen7 through 7.3.3-7015 and Gen8 through 8.2.2-8015 when SSL VPN authentication is SAML. SonicWall puts the fixes in 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8. The advisory lists no workaround. A firewall that still reports an older build, with SAML on the SSL VPN, is the exposed set. Appliances that authenticate that VPN some other way sit outside this particular bug. The other six fixes in the same image still belong on those boxes.
Two of those six sit on the management interface and are scored 8.8. SonicWall says they can allow unauthenticated operations when the conditions in the advisory are met. The bundle also covers pre-authentication failures in the SSL VPN and in TACACS+ that can take the service down, and weak password hashing on virtual appliances. The conditions and the request shapes stay in the vendor advisory. One image closes the exploited bypass and the higher-scored management bugs together.
What to do before November 20
Inventory every SonicOS Gen7 and Gen8 firewall, including virtual appliances, and the ones that terminate employee VPN. Read the running release. Move Gen7 to 7.3.4-7013 or later, and Gen8 to 8.2.3-8015 or later. Read the version the appliance reports after it comes back up.
Where SAML is the second factor, an alternate credential that policy meant to block can open a tunnel until that build is installed. After the upgrade, review SSL VPN logs for the days before it. Look for successful sessions that skipped the second factor your policy requires, and for logins that used a method SAML was supposed to have replaced. If that pattern is in the log, treat the account as compromised. Reset it, revoke its sessions, and check what that VPN user could reach.
Confirm the box you are patching is SonicOS Gen7 or Gen8. SMA1000 remote-access appliances follow a separate set of advisories. November 20 is the federal date. The operational date is the day the concentrator is still on 7.3.3 or 8.2.2 with SAML turned on.
This briefing relies on public reporting by BleepingComputer, on SonicWall’s advisory, and on CISA’s Known Exploited Vulnerabilities catalog. It does not include exploit procedures or proof-of-concept detail.
Corrections and tips:[email protected]