On November 6, 2026, SonicWall published advisory SNWLID-2026-0014 and CISA added one of its bugs, CVE-2026-19868, to the Known Exploited Vulnerabilities (KEV) catalog the same day. The flaw is in the SonicOS SSL VPN service. If SAML is turned on for SSL VPN logins, someone who already has valid credentials for a different login method can get past SAML, and past the MFA that SAML enforces. Federal agencies have until November 20, 2026. If your firm runs a SonicWall firewall and your attorneys, CPAs or engineers sign in to the VPN through Microsoft Entra, Okta or another SAML identity provider, put this firewall upgrade on this week's list.
What SonicWall and CISA say
CISA's Nov. 6 alert lists CVE-2026-19868 as "SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability." The KEV entry says the SSL VPN "may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA)." CWE-308. Date added: 2026-11-06. Due date: 2026-11-20. Known ransomware campaign use: Unknown. Forensic triage required: No.
SonicWall's description says the flaw affects the SonicOS SSL VPN interface or service only when SAML is enabled for SSL VPN logins. SonicWall told customers its product security team "has investigated a report indicating potential exploitation of this vulnerability," SecurityWeek reported. SonicWall scores it CVSS 7.1 High. The CISA-added score in NVD is 7.5 High, and CISA's SSVC entry there records exploitation as "active."
Affected: Gen7 firewalls (TZ, NSa, NSsp and NSv) on SonicOS 7.3.3-7015 and older, and Gen8 firewalls (TZ, NSa and NSv) on SonicOS 8.2.2-8015 and older. Fixed: SonicOS 7.3.4-7013 or later for Gen7 and 8.2.3-8015 or later for Gen8. SonicWall lists no workaround. You fix this by upgrading.
What we are not claiming: SonicWall and CISA have not said who is behind the exploitation, how many devices were hit, or what industries were targeted, and neither has published indicators of compromise. This is not an unauthenticated drive-by. The attacker needs a valid credential for another sign-in method on that firewall. We are not saying any particular firm has been breached. We are saying the MFA you rely on for remote access may not be the only way in until the firmware is upgraded.
Six other bugs in the same advisory
SNWLID-2026-0014 covers seven CVEs in total. Per SecurityWeek, none of the other six is marked exploited. Two are CVSS 8.8 management-interface flaws (a permissive cross-domain policy issue and a session validation bug). Three are pre-authentication buffer overflows in the SSL VPN service and the TACACS+ client that could cause denial of service. One is a weak password-hashing issue in virtual appliances. The upgrade fixes all of them. One more reason to stop exposing the firewall's management interface to the internet.
Why professional firms should care first
Law firms, accounting and bookkeeping practices, engineering and architecture shops, and nonprofits often have a SonicWall at the office edge and an SSL VPN for staff working from home, a client site or the courthouse. Many of them moved that VPN to SAML single sign-on specifically to get MFA in front of client files. This bug undercuts that. A leftover local account, an old LDAP or RADIUS login path, or a shared "vpnuser" that never got retired can turn a stolen password back into a working login. Cyber insurance applications and client security questionnaires ask whether remote access is behind MFA. The honest answer depends on your firmware version today.
What to do this week
- Find every SonicWall you own. Main office, satellite offices, home-office TZ units for partners, and any NSv virtual firewalls in Azure, AWS or on Hyper-V/ESX. Record model, generation (Gen7 or Gen8) and the running SonicOS build from the dashboard.
- Check whether SAML is on for SSL VPN logins. Look at the SSL VPN authentication settings specifically. Per SonicWall, if SAML is not used for SSL VPN logins, this CVE does not apply to that service, but the other six CVEs in the advisory still do. Upgrade anyway.
- Upgrade to the fixed build. Gen7 to 7.3.4-7013 or later. Gen8 to 8.2.3-8015 or later. Take a config export first, schedule a short after-hours window, and confirm the new build is actually running afterward. A downloaded firmware file that was never applied doesn't count.
- Close the side doors. List every account that can sign in to the SSL VPN by a method other than SAML: local firewall users, LDAP/AD groups, RADIUS, and old shared or vendor accounts. Disable what you don't need. Rotate passwords on anything you keep.
- Limit who can reach the VPN and the admin page. Keep SonicOS management off the WAN, or restrict it to known IPs. Use geo-IP or allow-lists on the SSL VPN where your staff's locations make that practical.
- Read the VPN logs back to late October. Look for SSL VPN logins that didn't come through your identity provider, logins at odd hours or from unusual countries, and new or changed local users. CISA doesn't require forensic triage for this entry. Anything that doesn't match a known person still gets handled as a real incident.
- Write it down. Firmware before and after, date upgraded, accounts removed. That is what you show your insurer, your malpractice carrier or a client security review.
The takeaway for IT decision-makers
MFA only protects you if it's the only way in. CVE-2026-19868 is a SonicWall SSL VPN bug that can let a valid password from a second login path skip SAML and its MFA. SonicWall has patched it, it's on CISA's exploited list with a November 20 federal deadline, and there's no workaround. Upgrade the firmware, retire the extra login paths, and keep the records. If you want a second set of eyes on your SonicWall build, VPN accounts and logs, Brotherly Technology can help.
Sources
- CISA: Adds One Known Exploited Vulnerability to Catalog (Nov 6, 2026)
- CISA Known Exploited Vulnerabilities Catalog: CVE-2026-19868 (date added 2026-11-06; due 2026-11-20; ransomware Unknown; forensic triage No)
- SonicWall PSIRT: SNWLID-2026-0014
- NVD: CVE-2026-19868
- GitHub Advisory Database: GHSA-mq8w-j7h6-7q9w (CVE-2026-19868)
- SecurityWeek: SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins (Nov 7, 2026)