SonicWall published advisory SNWLID-2026-0014 on 6 November 2026 with fixes for seven SonicOS vulnerabilities. One of them, CVE-2026-19868, lets someone who holds valid credentials for an alternate login method skip SAML on the SSL VPN, which can include SAML-enforced multi-factor authentication. SonicWall says it investigated a report of exploitation, and CISA put the flaw in its Known Exploited Vulnerabilities (KEV) catalog the same day. This guide says who is affected, which builds fix it, and what to do today. Facts come from the sources linked, read on 9 November 2026.
At a glance
| Item | Detail |
|---|---|
| CVE | CVE-2026-19868, SonicOS SSL VPN authentication enforcement |
| Severity | CVSS 7.1 from SonicWall; 7.5 in the NVD record from CISA's enrichment, which rates privileges required as none |
| Exposed only when | SAML is enabled for SSL VPN logins |
| Affected | Gen7 TZ, NSa, NSsp and NSv on SonicOS 7.3.3-7015 or older; Gen8 TZ, NSa and NSv on 8.2.2-8015 or older |
| Fixed in | 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8) |
| Workaround | None, per SonicWall |
| Exploited | SonicWall investigated a report of potential exploitation; CISA lists it as exploited in the wild |
| CISA KEV due date | 20 November 2026 for US federal agencies (BOD 26-04) |
Sources: BleepingComputer, SecurityWeek, CISA alert and the Canadian Centre for Cyber Security.
What the flaw does
SonicWall describes it as an authentication enforcement problem in the SSL VPN service: a user with valid credentials for an alternate authentication method may bypass SAML authentication controls, and successful exploitation may also bypass SAML-enforced MFA. In plain terms, a second factor you set up through your identity provider may not be the only way in. The flaw was reported by Ryan Harris of The Electronic Office. Neither SonicWall nor CISA has shared details of the attacks, and it is not stated whether the bug was exploited as a zero-day.
Note what it is not. It is not an unauthenticated drive-by: the attacker needs working credentials for some login method. It matters because many teams treat the SAML and MFA setup on the VPN as the control that stops stolen passwords.
The other six vulnerabilities in the advisory
SonicWall's advisory does not mark the other six as exploited. Two carry a CVSS score of 8.8 and affect the SonicOS management interface: a permissive cross-domain policy issue and a session validation bug, which under certain conditions a remote attacker could abuse without logging in. Three more are pre-authentication buffer overflows in the SSL VPN service and the TACACS+ authentication client that could cause application-level denial of service. The last is a weak password hashing issue in virtual appliances that needs high-privileged local access (SecurityWeek). The firmware that fixes the SAML bug fixes these too.
What to do today
- Find your firmware. Gen7 on 7.3.3-7015 or older, or Gen8 on 8.2.2-8015 or older, is affected.
- Check whether SAML is used for SSL VPN logins. If it is not, CVE-2026-19868 does not apply to you, but the other six advisory issues still do, so update anyway.
- Update to 7.3.4-7013 (Gen7) or 8.2.3-8015 (Gen8). There is no workaround, so the update is the fix.
- Do not turn SAML off to be safe. That removes the MFA you are trying to protect. If you cannot patch at once, limit who can reach the SSL VPN portal while you schedule the update; that reduces exposure but does not fix the bug.
- Review VPN logins. Look for logins that succeeded without the normal identity-provider step, and for accounts that have a second authentication method enabled that you do not use. Treat any unexplained session as a possible compromise and reset the credentials involved.
- Add it to your tracking. SonicWall's own devices have been attacked repeatedly: BleepingComputer notes July, September and October attacks on its separate SMA1000 appliances, including CVE-2026-102255 in October.
This follows a wider pattern of internet-facing appliances needing credential rotation after patching, covered in Citrix NetScaler zero-days: rotate secrets after patching. The same week, Ivanti's VPN chain forced a second patch: see the Ivanti Connect Secure re-patch guide.
Frequently asked questions
Is CVE-2026-19868 exploited? SonicWall says it investigated a report indicating potential exploitation, and CISA added it to the KEV catalog on 6 November 2026.
Which versions fix it? SonicOS 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8.
Am I safe if I do not use SAML? For this CVE, yes, because it only affects SSL VPN with SAML enabled. The other six vulnerabilities still apply, so patch.
Is there a workaround? No. SonicWall lists none.
