SonicWall has patched a vulnerability that allows attackers to bypass MFA on SSL-VPN connections. CVE-2026-19868, disclosed November 6, 2026, lets a user with valid credentials for an alternate authentication method bypass SAML authentication controls, and may also bypass SAML-enforced multi-factor authentication. CISA added it to the Known Exploited Vulnerabilities catalog the same day, confirming evidence of active exploitation. Federal agencies must address it by November 20, 2026, under Binding Operational Directive 26-04. No workarounds are available.

If your business runs SonicWall Gen7 or Gen8 firewalls with SSL-VPN and SAML authentication, check your firmware version this week. The patch versions are 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8.

What does CVE-2026-19868 allow?

According to BleepingComputer, the vulnerability allows attackers with valid credentials for an alternate authentication method to bypass SAML authentication controls, "potentially including SAML-enforced multi-factor authentication (MFA)." SonicWall's advisory (SNWLID-2026-0014) describes the flaw as an "authentication enforcement vulnerability in SonicOS SSLVPN service."

The practical impact: an attacker who holds credentials for a different login path can sidestep the SAML identity provider and any MFA it enforces. The assumption that SAML-based login requires the second factor breaks down when an alternate path exists. SecurityWeek reports the flaw has a CVSS score of 7.1 (HIGH), and the SSL-VPN is exposed only if SAML-based login is enabled.

Which devices are affected?

The vulnerability affects SonicOS on Gen7 and Gen8 firewalls when SAML is enabled for SSL-VPN. According to SonicWall's advisory, as reported by both BleepingComputer and SecurityWeek:

  • Gen7 TZ, NSa, NSsp, and NSv firewalls: SonicOS 7.3.3-7015 and earlier
  • Gen8 TZ, NSa, and NSv firewalls: SonicOS 8.2.2-8015 and earlier

The fix is SonicOS 7.3.4-7013 or higher for Gen7 devices and 8.2.3-8015 or higher for Gen8 devices. SonicWall says there are no workarounds: "Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks."

This vulnerability is separate from the SonicWall SMA1000 flaws disclosed in recent months. The SMA1000 is a remote access gateway appliance, not a firewall. Our coverage of the SMA1000 CVE-2026-102255 flaw in October 2026 addresses that product line. If your organization runs both SonicWall firewalls and SMA appliances, both need separate attention.

Is this SonicWall MFA bypass being exploited?

Yes. SonicWall's advisory states: "SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability." CISA's addition to the Known Exploited Vulnerabilities catalog confirms evidence of active exploitation. Neither the vendor nor CISA has shared details about the suspected attacks, and SecurityWeek reports it is unclear whether the flaw was exploited before the patch became available.

The CISA KEV listing establishes that this is not a theoretical risk. CISA adds vulnerabilities to the catalog only when there is evidence of exploitation in the wild. Under BOD 26-04, federal agencies must remediate by November 20, 2026. Private businesses in the US and Canada are not bound by that directive, but the timeline reflects how urgently the government views the risk.

Why does bypassing SAML matter?

SAML (Security Assertion Markup Language) is how many organizations connect their SSL-VPN to an identity provider such as Microsoft Entra ID. The identity provider handles authentication and enforces MFA, so users prove who they are before gaining network access. When an attacker can bypass SAML entirely, the MFA enforcement that depended on it can be skipped.

The value of multi-factor authentication depends on the attacker having to go through it. A flaw that lets someone sidestep the authentication flow reduces a two-factor login back to a single-factor one. That is what CVE-2026-19868 can allow when alternate authentication methods remain available.

What should you check this week?

If your business uses SonicWall firewalls with SSL-VPN and SAML authentication, these are the questions to put to your IT lead or managed services provider:

  1. Do we run any Gen7 or Gen8 SonicWall firewalls with SSL-VPN and SAML enabled? If not, this specific CVE does not apply. If yes, continue.
  2. What SonicOS version is running on each device? Gen7 must be at 7.3.4-7013 or later. Gen8 must be at 8.2.3-8015 or later.
  3. If not patched, when can the update be scheduled? SonicWall says there are no workarounds, so the patch is the only remediation.
  4. Are any alternate authentication methods still enabled alongside SAML? The flaw requires "valid credentials for an alternate authentication method." Disabling unnecessary authentication paths limits the attack surface.
  5. Is SSL-VPN exposed to the internet? If it needs to be, patching is mandatory. If it does not need to be, restricting access to known IP ranges reduces exposure while you patch.

A managed firewall service handles firmware patching on your behalf. Our guide to managed firewalls for small offices explains what this coverage includes: firmware updates, rule reviews, VPN hardening, and configuration backup. If no one in your organization is actively tracking SonicWall advisories and applying patches, that is the gap a managed service closes.

Questions to ask your IT or security provider

If you rely on an external IT provider or managed security partner, ask these questions this week:

  • How quickly do you apply critical firewall patches after vendor release? Look for a defined SLA. CVE-2026-19868 was disclosed November 6; by the time you read this, the patch should already be scheduled or applied.
  • How do you track vendor advisories for the products in our environment? A provider confident in their process can explain how they monitor SonicWall, Fortinet, and other firewall vendors for security bulletins.
  • What is the post-patch verification process? Applying firmware is not the end. CISA's BOD 26-04 establishes that agencies must check whether threat actors compromised the system before the patch was applied. Ask whether your provider reviews logs for indicators of compromise after patching exploited vulnerabilities.

Monthly or quarterly reporting on patching status is standard practice, as our guide to evaluating a managed IT provider explains. If you cannot get a clear answer on when your firewalls were last patched, that uncertainty is itself a risk.

The pattern to recognize

SSL-VPN and remote access appliances sit at the network edge and authenticate users from the internet. That makes them high-value targets, and attackers actively scan for unpatched devices. The CISA KEV catalog tracks these exploited flaws so organizations can prioritize remediation.

CVE-2026-19868 follows the same pattern: a flaw in an internet-facing authentication service, exploited in the wild, with no workaround except patching. Whether you run SonicWall, Fortinet, or another vendor, the question to ask is the same: who is responsible for watching advisories and applying patches, and how fast do they act when a critical flaw lands?

If your organization needs help with ongoing firewall and network security management, Cyber Unit's cybersecurity services include 24/7 monitoring, vulnerability management, and incident response for businesses across Canada and the United States.

One step you can take today

If you are unsure where your business stands on firewall patching, remote access security, or MFA coverage, our free cybersecurity assessment takes about five minutes and covers 22 security areas including network security and multi-factor authentication. It runs entirely in your browser with no signup required.

This article is intended for general informational purposes only and does not constitute professional security, legal, or compliance advice. Details about CVE-2026-19868 are based on SonicWall's advisory (SNWLID-2026-0014), CISA's Known Exploited Vulnerabilities catalog, and reporting from BleepingComputer and SecurityWeek as of November 7, 2026. The investigation is ongoing, and details may evolve. Organizations should consult qualified cybersecurity professionals before acting on any specific indicator of compromise or making operational changes based on this article.