SonicWall SonicOS SSLVPN: SAML and MFA can be bypassed (CVE-2026-19868)

What happened

On 6 November 2026, CVE-2026-19868 was published for the SSLVPN component of SonicWall SonicOS. SonicWall tracks it as SNWLID-2026-0014. It has a CVSS base score of 7.5.

The flaw is a case of single-factor authentication. A user with valid credentials for an alternate authentication method can get around the SAML authentication controls on the SSLVPN. If SAML is used to enforce multi-factor authentication (MFA), that MFA can be bypassed as well. In practice, a stolen or guessed password for another login method may be enough to open a VPN session that should have required SAML and a second factor.

On the same day, CISA added CVE-2026-19868 to its catalogue of known exploited vulnerabilities. CISA gives no details about the attacks. CISA tells organisations to apply the mitigations in line with SonicWall's instructions and to discontinue use of the product if no mitigations are available.

Who is affected

• SonicWall firewalls running SonicOS with SSLVPN enabled, in setups that use SAML authentication (often with MFA enforced through SAML) for VPN access.
• The bypass needs valid credentials for an alternate authentication method. Setups where other login methods besides SAML can authenticate to the SSLVPN are the ones exposed.
• The vulnerability is in the SSLVPN component. Based on the description, devices that do not use SSLVPN are not exposed through this flaw.
• The data available to us does not list the affected and fixed SonicOS versions. Check SonicWall advisory SNWLID-2026-0014, linked below, for the exact versions and the vendor's instructions.

If you manage SonicWall firewalls for customers, check every device that offers SSLVPN access to internal networks, servers or admin interfaces.

What to do now

1. List all SonicWall firewalls you manage that have SSLVPN enabled and note their SonicOS version.
2. Export a configuration backup of each device before you change anything.
3. Open SonicWall advisory SNWLID-2026-0014 and check whether your SonicOS version is affected. Then apply the fixed firmware or the mitigations SonicWall describes there. Plan for a reboot of the firewall.
4. Until the device is fixed, limit SSLVPN access as much as you can, for example to known source IP addresses. If SSLVPN is not strictly needed, turn it off. Review which authentication methods other than SAML can still log in to the SSLVPN, and remove those that are not required.
5. Reset the passwords of accounts that can log in to the SSLVPN through methods other than SAML, especially local and service accounts. Remove accounts that are no longer needed.
6. After the update, make sure the SSLVPN works and that logins go through SAML and MFA again as expected.

How to check whether you are affected

• Compare the SonicOS version of each device with the affected versions in SonicWall advisory SNWLID-2026-0014.
• Check the SSLVPN configuration to see whether SAML is in use and whether other authentication methods are also accepted.
• Review the SSLVPN login logs, at least since 6 November 2026 and ideally further back. Look for sessions that did not go through SAML or MFA, logins from unfamiliar IP addresses or countries, and logins by accounts that normally do not use the VPN.
• If you find suspicious sessions, check what those sessions accessed on the internal network. Treat the credentials involved as compromised and reset them.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-19868
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog