SonicWall published an advisory on Friday 6 November 2026 for CVE-2026-19868, an authentication enforcement flaw in the SonicOS SSL-VPN service. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a remediation deadline of 20 November.
SonicWall's own wording is that the flaw may allow a user to "bypass SAML authentication controls", and that successful exploitation may also bypass MFA enforced through that SAML login.
Severity is reported as CVSS 7.1 or 7.5 depending on source, rated High. The underlying weakness is CWE-308, use of single-factor authentication. It was found and reported by Ryan Harris of Electronic Office.
This is not an unauthenticated bypass. An attacker needs valid credentials for an alternate authentication method before any of this works. That lowers the risk considerably and does not remove it, because stolen credentials are the most abundant commodity in cybercrime.
SonicWall says it investigated a report indicating potential exploitation and has published no details about the attacks. HKCERT's bulletin of 9 November reports active exploitation. No victim counts exist publicly.
Are you affected?
Three conditions, all required:
1. You run a SonicWall Gen7 or Gen8 firewall, physical or virtual.
2. The SSL-VPN service has SAML enabled for VPN logins. SonicWall is explicit that the flaw only applies "if SAML is enabled for SSLVPN logins". If your SSL-VPN does not use SAML, this particular flaw does not reach you.
3. You are on an affected firmware version:
Generation | Affected | Fixed |
|---|---|---|
Gen7 | 7.3.3-7015 and older | 7.3.4-7013 |
Gen8 | 8.2.2-8015 and older | 8.2.3-8015 |
If all three are true, treat the appliance as exposed until it is patched and its logs have been reviewed.
Fix it
Upgrade now. Gen7 to 7.3.4-7013, Gen8 to 8.2.3-8015. The same releases fix six other SonicOS flaws alongside this one, covering security-restriction bypass, denial of service and sensitive information disclosure.
There is no workaround. SonicWall lists none, and neither does any advisory. Patching is the only control.
If you genuinely cannot patch today, the only meaningful reduction is removing SSL-VPN exposure from untrusted networks until you can, which for most organisations means taking remote access offline.
The 20 November date binds US federal civilian agencies. For everyone else it is a reasonable deadline to borrow, given the flaw is confirmed exploited and sits on an internet-facing gateway.
Check whether it already happened
This is the step to do alongside patching rather than after it. The flaw has been exploited, and patching closes the door without telling you whether anyone came through.
The signature is simple. On a gateway where SAML is enforced, a successful SSL-VPN login that did not use SAML should not exist. Published detection guidance points at SonicOS SSL-VPN login events (event ID 1080) where the authentication method is anything other than SAML.
Cross-reference two log sources. Compare authentication and session records on the SonicOS appliance against sign-in logs at your SAML identity provider. A VPN session with no corresponding IdP authentication is the thing you are looking for.
Define your review window generously. SonicWall has not said when exploitation began, only that it investigated a report. Review back as far as your logs allow rather than to the advisory date.
If you find one, treat it as an account compromise rather than an appliance issue. The attacker held valid credentials for some alternate method, so that account is compromised independently of the firewall. Reset it, revoke sessions, and look at what it could reach inside the network.
Why this one is worth more than its CVSS score
A 7.1 does not look alarming next to the 9.8s we have covered recently. It should be read differently, for three reasons.
It targets the control people trust most. Multi-factor authentication is the single measure most organisations point to when asked how remote access is protected. Here MFA was configured, enforced through SAML, and bypassed anyway. The defence was present and did not apply.
VPN gateways are initial access. This is not a flaw that gets someone a foothold on one workstation. It gets them an authenticated VPN session, inside the network, as a legitimate account. Everything that account can reach is reachable.
Credential theft is the prerequisite, and credentials are everywhere. The requirement for valid alternate credentials sounds like a meaningful barrier. Set against the infostealer ecosystem, the credential marketplaces and the campaigns we have covered this autumn, it is a low one. An attacker who already holds credentials and was stopped by MFA now has a route around it.
The pattern is familiar from this year's edge-device incidents: SonicWall SonicOS appeared in the SafePay ransomware advisory in October, alongside Cisco and Veeam flaws, as a route onto victim networks. Internet-facing appliances remain the most reliable way in, and the authentication layer on them is where the value is.
