AllTech
On this page
Field notes from the engineering team
On November 6, 2026, CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog. It is a flaw in the SSLVPN service of SonicWall SonicOS, the operating system on SonicWall firewalls. A person who holds valid credentials for a different login method can get past the SAML login, and with it the multifactor authentication (MFA) that SAML enforces.
It matters most to organizations that send VPN logins through an identity provider so that MFA covers remote access. For them, the MFA prompt is the control this flaw skips. SonicWall’s advisory says its security team investigated a report of potential exploitation.
If you run a SonicWall firewall, or a provider manages one for you, check the firmware version and whether SAML is turned on for SSLVPN.
The short version
| Item | Detail |
|---|---|
| CVE | CVE-2026-19868 (SonicWall advisory SNWLID-2026-0014) |
| Severity | High, CVSS v3.1 7.1 (SonicWall’s rating). CISA’s weakness label is CWE-308, use of single-factor authentication. |
| What it is | An authentication enforcement flaw in the SonicOS SSLVPN service. A user with valid credentials for an alternate authentication method may bypass SAML authentication controls, including SAML-enforced MFA. |
| Who is affected | Only firewalls where SAML is enabled for SSLVPN logins. |
| Affected | Gen7 firewalls on 7.3.3-7015 and older, and Gen8 firewalls on 8.2.2-8015 and older. |
| Fix | SonicOS 7.3.4-7013 or higher (Gen7), 8.2.3-8015 or higher (Gen8). |
| Workaround | If you use SAML and cannot upgrade: disable or delete the active LDAP, RADIUS and TACACS+ authentication servers on the firewall. |
| Exploitation | SonicWall says it investigated a report of potential exploitation. CISA added it to the KEV catalog on November 6, 2026, with a due date of November 20, 2026. CISA lists use in ransomware campaigns as unknown. |
Which SonicWall models are affected
The advisory lists these platforms. The affected and fixed versions are the same for every model in a group:
| Platform | Models | Affected | Fixed |
|---|---|---|---|
| Gen7 hardware | TZ 270, 270W, 370, 370W, 470, 470W, 570, 570W, 570P, 670; NSa 2700, 3700, 4700, 5700, 6700; NSsp 10700, 11700, 13700, 15700 | 7.3.3-7015 and older | 7.3.4-7013 and higher |
| Gen7 virtual | NSv 270, 470, 870 (ESX, KVM, Hyper-V, AWS, Azure) | 7.3.3-7015 and older | 7.3.4-7013 and higher |
| Gen8 hardware | TZ 80, 280, 280W, 380, 380W, 480, 580, 680; NSa 2800, 3800, 4800, 5800 | 8.2.2-8015 and older | 8.2.3-8015 and higher |
| Gen8 virtual | NSv XS, S, M, L (ESX, KVM, Hyper-V, AWS, Azure) | 8.2.2-8015 and older | 8.2.3-8015 and higher |
What the flaw does
SAML lets the firewall hand the VPN login to an identity provider, which asks for the password and the MFA prompt. That setup means a stolen password alone is not enough to reach the network.
Per SonicWall, a user who has valid credentials for another authentication method can bypass those SAML controls. SonicWall’s workaround names the alternate methods: LDAP, RADIUS and TACACS+ servers configured on the firewall. The advisory gives no more technical detail than that. It does state the result: an attacker with a valid username and password for one of those other methods may reach SSLVPN without the SAML MFA step.
The attacker still needs a working credential. Stolen and reused passwords are common, and MFA exists so that a password alone does not get anyone in.
The same advisory fixes six more flaws
SNWLID-2026-0014 covers seven CVEs in total. CVE-2026-19868 is the only one that SonicWall flags for potential exploitation and that CISA lists as exploited. The others in the advisory, according to SonicWall:
- CVE-2026-107155 and CVE-2026-107154, rated 8.8, are in the SonicOS management interface and could in specific conditions let a remote attacker perform unauthorized operations. SonicWall’s vector shows that a user must take an action (UI:R).
- CVE-2026-82308, rated 7.5, is a heap buffer overflow in the SSL-VPN service that can be reached before login and could cause a denial of service.
- CVE-2026-77708 and CVE-2026-77709, rated 5.9, are buffer overflows in the TACACS+ client that could cause a denial of service.
- CVE-2026-19703, rated 5.2, is weak password hashing on SonicOS virtual appliances that could let someone with local access disclose a platform credential.
Updating to the fixed firmware is the way to deal with all seven at once.
What to do
1. Find out whether you run SonicWall. Ask your IT provider: “Do we have any SonicWall firewalls, which model and SonicOS version, and is SAML turned on for SSLVPN?” Compare the answers with the tables above.
2. Upgrade. Move Gen7 firewalls to 7.3.4-7013 or higher and Gen8 firewalls to 8.2.3-8015 or higher. Take a configuration export first, and schedule the change for a time when a short VPN outage will not hurt.
3. If you cannot upgrade yet, use the workaround. SonicWall’s workaround for SAML users is to disable or delete the active LDAP, RADIUS and TACACS+ servers on the firewall. Our advice: before you do, find out what else relies on those servers, such as firewall admin logins or other VPN profiles, so the change does not lock out people who need access.
4. Review SSLVPN logins. Our advice: look at the firewall’s login records for VPN sessions that did not go through your identity provider, and for logins at odd hours or from places your staff do not work. A clean review does not prove nothing happened, so treat any unexplained session as a possible compromise.
5. Change credentials if you see something odd. If a review turns up suspicious logins, reset the passwords of the affected accounts and the firewall’s own admin accounts, and treat the firewall as possibly compromised until you know more.
6. Keep the management interface off the internet. Two of the other flaws in this advisory sit in the management interface. Our advice: administer the firewall only from inside the network or through an approved access path.
7. Consider whether you still need a VPN login at all. A VPN that puts people on the whole network turns one skipped login check into broad access. Access to one application at a time limits the damage.
How we help
Keeping firewall firmware current and VPN settings reviewed is routine work in our firewall and routing service, and remote monitoring and patching tracks which version every device runs. If you want to stop relying on a firewall VPN, zero trust access ties access to identity and device and limits each person to the applications they need. Unusual VPN logins are the kind of signal our managed SOC reviews, and incident response covers the case where a firewall may have been compromised.
For law firms and municipalities, remote access to files and records is often the main route in from the internet, so a bypassed MFA check is a direct risk. If you are not sure what firewall you run or how remote logins are set up, ask us and we will help you find out.
We covered other firewall and VPN flaws recently in FortiOS CVE-2025-61624: Admin Bug Leads to Root.
