SonicWall has released a batch advisory fixing seven vulnerabilities in SonicOS, the operating system that runs its firewalls. The most urgent one is CVE-2026-19868: under certain conditions, the flaw in the SSL-VPN service allows SAML authentication to be bypassed, and with it any multi-factor authentication (MFA) enforced through SAML. SonicWall says it has investigated a report of potential exploitation. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog the same day. Updates are available; according to the vendor, there are no workarounds.
Advisory SNWLID-2026-0014 (“SonicWall SonicOS Affected By Multiple Vulnerabilities”) is dated November 6, 2026. It covers Gen7 and Gen8 firewalls, both hardware and virtual appliances (NSv).
What CVE-2026-19868 is about
SonicWall describes CVE-2026-19868 as an authentication enforcement vulnerability in the SSLVPN service. A user with valid credentials for an alternate authentication method may be able to bypass SAML authentication controls. If that succeeds, SAML-enforced MFA can be bypassed as well. The weakness is classified as CWE-308, “Use of Single-factor Authentication.” In plain terms: where two factors should be required, one may be enough.
SonicWall stresses an important limitation: the flaw only affects the SSLVPN interface or service if SAML is enabled for SSLVPN logins. Organizations running SSL-VPN without SAML are not affected by this specific issue, though they may be affected by the other six.
SonicWall has not published technical details on exploitation, and we deliberately do not describe attack paths here. According to the advisory, the flaw was reported by Ryan Harris of The Electronic Office.
Severity: 7.1 or 7.5?
SonicWall rates CVE-2026-19868 at 7.1 (high) under CVSS 3.1. Its vector assumes high attack complexity and low privileges, meaning existing credentials. The National Vulnerability Database (NVD) additionally lists a CISA-ADP score of 7.5 that assumes no privileges. At the time of our check, NVD’s own analysis was still pending (“Undergoing Analysis”). CISA’s SSVC assessment reads: exploitation “active,” automatable “no,” technical impact “partial.”
CISA KEV: deadline November 20
CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities Catalog on November 6. US federal civilian agencies now have until November 20, 2026, to apply mitigations according to vendor instructions, under Binding Operational Directive BOD 26-04. Whether the flaw is used in ransomware campaigns is listed as “Unknown” in the KEV entry.
For organizations outside the US federal government, the deadline is not binding. But the KEV listing sends a clear signal: this flaw is no longer theoretical.
The six other flaws in the advisory
Alongside CVE-2026-19868, the update fixes six more vulnerabilities. SonicWall reports no exploitation for these:
- CVE-2026-107155 (CVSS 8.8): a permissive cross-domain policy in the management interface. Under specific conditions, a remote unauthenticated attacker could perform unauthorized operations; the vector requires user interaction.
- CVE-2026-107154 (CVSS 8.8): a session validation weakness in the management interface, classified as “Reliance on IP Address for Authentication” (CWE-291). Same impact and conditions as above.
- CVE-2026-82308 (CVSS 7.5): a pre-authentication heap buffer overflow in the SSL-VPN service that can cause a denial of service.
- CVE-2026-77708 and CVE-2026-77709 (CVSS 5.9 each): pre-authentication stack and heap buffer overflows in the TACACS+ authentication client, also with potential denial of service.
- CVE-2026-19703 (CVSS 5.2): weak password hashing on virtual appliances. An attacker with existing local access could disclose a platform credential that grants access to a limited subset of settings.
The two management interface flaws carry the highest score in the advisory, which is why the advisory as a whole is rated 8.8. According to SonicWall, most of the flaws were reported by Pentest-Tools.com, and CVE-2026-19703 by Italy’s National Cybersecurity Agency (ACN).
Affected versions and fix
According to SonicWall, the following are affected:
- Gen7 (TZ 270 to TZ 670, NSa 2700 to NSa 6700, NSsp 10700 to NSsp 15700, and NSv 270/470/870 on ESX, KVM, Hyper-V, AWS and Azure): SonicOS 7.3.3-7015 and older.
- Gen8 (TZ 80 to TZ 680, NSa 2800 to NSa 5800, and NSv XS/S/M/L): SonicOS 8.2.2-8015 and older.
The flaws are fixed in SonicOS 7.3.4-7013 (Gen7) and SonicOS 8.2.3-8015 (Gen8) and later. The advisory explicitly lists no workaround (“None”).
What admins should do now
The key step is clear: upgrade to the fixed SonicOS versions, with top priority wherever SSL-VPN uses SAML. Beyond that, a few general steps make sense. They do not come from the advisory but reflect common practice for VPN vulnerabilities:
- Check your inventory: which firewalls run which SonicOS version, and where is SAML enabled for SSL-VPN?
- Review authentication methods: the login methods allowed for SSL-VPN besides SAML should be documented and limited to what is actually needed.
- Review logins: look through VPN logins from recent weeks for unusual patterns, such as logins without the expected MFA step or from unfamiliar locations.
- Lock down the management interface: it should not be reachable from the internet, only from trusted networks.
What is still unclear
Much remains open for now. SonicWall refers to a report of “potential exploitation” but names neither its scale nor affected customers or sectors. The advisory contains no indicators of compromise (IoCs). CISA’s KEV entry simply points to the vendor’s instructions. How many devices with SAML login for SSL-VPN are actually exposed to the internet is not publicly known.
For operators, that means not waiting for more details. If you use SAML for SSL-VPN, install the update and then check whether there were suspicious logins in the period before the patch. If there are signs of unauthorized access, it makes sense to reset credentials for the affected accounts and treat the case as a breach.
Our take
VPN gateways and firewalls have been among attackers’ favorite targets for years, because they sit right at the network edge. We recently covered an actively exploited root flaw in Ivanti Connect Secure. With a score of 7.1, CVE-2026-19868 is rated less dramatically, but it hits exactly the mechanism many organizations rely on: MFA through a central identity provider. If that protection can be bypassed, stolen passwords are suddenly enough again.
As with the WordPress updater flaw in CISA’s KEV or the SSHole flaw in OpenSSH 10.6p2, the rule applies: once a vulnerability is in the KEV catalog, the update should not wait for the next maintenance window.
