SonicWall SSL VPN Flaw CVE-2026-19868 Lands on CISA’s KEV List
Attackers found a side door around the MFA on SonicWall firewalls. The SonicWall SSL VPN MFA bypass, tracked as CVE-2026-19868, is being exploited right now, and CISA wants federal agencies patched by November 20.
What Happened?
On Friday, SonicWall pushed advisory SNWLID-2026-0014 with fixes for seven SonicOS flaws. The most critical one is in the SSL VPN service. When SAML is enabled for VPN logins, a user with valid credentials for an alternate login method can skip the SAML checks and, with them, any MFA your identity provider enforces. It scores 7.1 on CVSS.
SonicWall said its security team looked into a report of possible exploitation. CISA settled the question on November 6 by adding the flaw to its Known Exploited Vulnerabilities catalog.
Two doors into the VPN. Only one checks MFA.
When SAML is enabled for SonicOS SSL VPN logins, a valid password for an alternate login method can walk past the SAML check and any MFA your identity provider enforces.
CVSS 7.1 on paper. In practice, it turns MFA into single factor authentication for anyone with a stolen password.
The other six fixes:
- CVE-2026-107155 and CVE-2026-107154 (8.8): management interface bugs that let unauthenticated attackers perform unauthorized operations under specific conditions
- CVE-2026-82308 (7.5): preauth heap overflow in SSL VPN that can crash the service
- CVE-2026-77708 and CVE-2026-77709 (5.9): preauth overflows in the TACACS+ client, also denial of service
- CVE-2026-19703 (5.1): weak password hashing on NSv virtual appliances
Seven SonicOS flaws. One is already in use.
The highest score in the batch is not the most urgent fix. The 7.1 MFA bypass is the one attackers are exploiting right now.
Patch by exploitation, not by score. KEV listed flaws go first.
Who Is Exposed?
Gen7 firewalls and NSv on SonicOS 7.3.3-7015 or older, and Gen8 on 8.2.2-8015 or older. The fixes are in 7.3.4-7013 and 8.2.3-8015. SonicWall says there is no workaround. Upgrade or stay exposed.
Check your build. No workaround exists.
SonicWall says upgrading is the only fix. Find your generation, compare your SonicOS version and patch before the federal deadline.
Gen7
Gen8
Not a federal agency? The deadline still tells you how fast attackers are expected to move.
A Familiar Target
SonicWall edge gear keeps landing in attackers’ crosshairs. In October, exploitation attempts against CVE-2026-102255, a maximum-severity SSRF flaw in SMA1000 remote access appliances, began two days after the patch shipped. Back in 2024, ransomware affiliates abused another SonicOS SSL VPN bug to break into accounts without MFA.
What’s the Impact?
MFA is the control most teams lean on when passwords leak. This flaw quietly turns it into single-factor login for anyone holding a stolen or reused password. The result looks like a normal VPN session, which is exactly how many ransomware intrusions begin.
How to Avoid This
- Upgrade to SonicOS 7.3.4-7013 or 8.2.3-8015 now
- Audit SAML-enabled portals and remove unused local or LDAP login methods
- Reset VPN passwords and end active sessions after patching
- Compare VPN logins against IdP sign-in logs for sessions that skipped SAML
- Lock the management interface to trusted IP ranges
Indicators of Compromise
No IPs, hashes, or domains have been published for CVE-2026-19868. Related SMA1000 attack traffic in October came from 146.70.143[.]142.
Your MFA Said Yes. Did Anyone Check?
A patch note tells you a door is unlocked. It doesn’t tell you who already walked through it. Secure.com gives your team governed defense, powered by offense, so attackers’ exposures get fixed first.
- Spots every SonicWall appliance on an affected build the day a KEV listing lands
- Ranks fixes by real-world exploitation, so a 7.1 in KEV jumps ahead of a quiet 8.8
- Flags VPN sessions that never touched your identity provider
- Drafts the patch and credential reset plan, with a human approving every change
- Keeps the audit trail ready for deadlines like CISA’s November 20 cutoff
