SonicWall CVE-2026-19868: SSL-VPN Logins That Skip Your SAML MFA

Published 10 November 2026 · Rathish Kumar, Invitty

If your office VPN runs on a SonicWall firewall and your team signs in through Microsoft Entra ID, Google or another SAML identity provider, this one needs attention this week. On 6 November 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-19868, a SonicOS SSL-VPN authentication weakness, to its Known Exploited Vulnerabilities catalogue. That listing means CISA has evidence of real-world attacks, not just a lab finding.

The short version: on affected Gen7 and Gen8 firewalls, someone holding a valid password for another sign-in method can get onto the SSL-VPN without passing through your SAML login, which also means without the MFA prompt you assumed was protecting it. There is no workaround. The fix is a firmware upgrade.

Why a "credentials required" bug is still serious

It is tempting to rank this lower because the attacker first needs a working username and password. In practice that is a weak barrier. Passwords leak through phishing, reuse across personal sites and info-stealer malware on home laptops, and VPN passwords are often left unchanged for long periods. MFA is the control that is supposed to make a stolen password useless. This flaw removes that safety net for SSL-VPN logins, which is exactly why attackers are interested.

Help Net Security, reporting on the advisory, notes the wider pattern: Akira ransomware affiliates broke into SonicWall firewalls during 2025 even where OTP-based MFA was in place, and ReliaQuest saw a different SonicWall SSL-VPN MFA bypass (CVE-2024-12802) being used earlier this year. Remote-access appliances are a favoured first step for ransomware crews, so an exploited MFA bypass on one deserves priority over routine patching.

Are you exposed? Three questions

1. Which generation and firmware? SonicWall lists Gen7 firewalls (physical and virtual) on SonicOS 7.3.3-7015 or earlier, and Gen8 firewalls on 8.2.2-8015 or earlier, as affected. Check the version on the firewall's dashboard or in MySonicWall.
2. Is SAML switched on for SSL-VPN? The weakness only applies when SSL-VPN users authenticate through SAML. If your VPN uses only local users or LDAP with no SAML, this specific CVE does not apply, although you still want the update for the other fixes in the same release.
3. Does any other sign-in route still work for VPN users? The bypass relies on a user having valid credentials for an alternate authentication method. When a firewall is switched over to SAML, the older local or directory accounts are easy to forget. Any that still work for VPN users are the risk.

If the answers are "Gen7 or Gen8, older firmware, SAML enabled", treat the device as exposed until it is upgraded.

The fixed firmware

SonicWall's notice for advisory SNWLID-2026-0014 gives these targets:

The same SonicOS releases close six further vulnerabilities that have not been reported as exploited, so the upgrade is worthwhile even on firewalls where SAML is off. SonicWall has not published a configuration workaround, and it has not shared attack details or indicators of compromise. For reference, CISA has given US federal agencies until 20 November 2026 to remediate; private businesses are not bound by that date, but it is a sensible upper limit.

Before upgrading, take a configuration export, confirm you have console or out-of-band access in case the firewall does not come back cleanly, and schedule a short window outside business hours. A branch firewall that drops during the day costs more goodwill than one that is patched at 9 pm.

Patching is step one: check whether someone already got in

Because exploitation has been reported, upgrading alone does not answer whether an attacker used the gap before you closed it. A practical check for a small IT team:

• Export SSL-VPN login events for the past few weeks from the firewall or your syslog server.
• Pull sign-in logs for the same period from your identity provider (for Entra ID, the sign-in logs for the SonicWall enterprise application).
• Look for VPN sessions that have no matching identity-provider sign-in and MFA event at that time. Those are the sessions to investigate.
• For any account that shows that pattern, reset the password, revoke sessions, and review which internal servers and file shares the session reached.

If you find a suspicious session, treat it as a possible incident rather than a configuration curiosity. Indian organisations also have reporting duties to CERT-In for certain incident types under its 2022 directions, with a six-hour window, so involve whoever owns that process early.

Close the alternate door permanently

Once patched, remove the condition that made this bug useful. Disable or delete local VPN accounts that are no longer needed, and if LDAP or RADIUS authentication was left enabled alongside SAML "just in case", decide whether it still needs to exist. Restrict SSL-VPN access to the user groups that genuinely need it, and if your staff only connect from India, consider geo-restricting the portal. These are configuration changes, not purchases, and they reduce the impact of the next VPN bug as well as this one.

Still running a Gen6 SonicWall?

Gen6 devices are not named as affected by this CVE, but that is not good news. SonicWall states that Gen6 and older firewalls have reached end of support and receive no firmware updates, and it recommends moving to Gen8. An unpatched perimeter device that will never receive another fix is a larger problem than any single CVE. SonicWall runs a trade-in route called Secure Upgrade Plus for legacy hardware; whether it suits you depends on your user count, throughput and the security subscriptions you actually use, so compare it with a like-for-like quote rather than assuming it is the cheapest path. Our firewall selection guide walks through sizing if you are reconsidering the platform altogether.

What we would do this week

For a typical Indian SMB with one or two SonicWall units: confirm firmware and SAML status today, upgrade inside the next maintenance window, run the log comparison above, then clean up unused VPN accounts. If you hold a support contract through a partner, ask them to confirm in writing which devices were upgraded and when. That record is useful for ISO 27001 and customer security questionnaires later.

Questions we expect from SonicWall owners

Next step

If you are not sure which of your firewalls are affected, send us the model names and current SonicOS versions (or a MySonicWall device list) and we will tell you which units need the update and whether SAML-based VPN is in use. More on the platforms we support is on our SonicWall firewall page and SonicWall brand overview.