SonicWall CVE-2026-19868 (SSLVPN SAML and MFA Bypass): How to Check Exposure and Fix It

- What: SonicWall disclosed CVE-2026-19868 in SonicOS. When SAML is enabled for SSLVPN logins, a user holding valid credentials for an alternate authentication method may bypass SAML authentication controls, including SAML-enforced multi-factor authentication (MFA). SonicWall says it investigated a report indicating potential exploitation, and CISA added the CVE to its KEV catalog on November 6, 2026
- Who: SonicWall Gen7 and Gen8 devices (hardware and NSv virtual/cloud appliances) with SAML enabled for SSLVPN logins. SonicWall states that the issue affects the SSLVPN service only if SAML is enabled for SSLVPN logins
- Today: Check the firmware version and update to 7.3.4-7013 or higher (Gen7) or 8.2.3-8015 or higher (Gen8). SonicWall lists the workaround as "None," so updating is the only official fix. Preserve and review SSLVPN login history before updating

If your company uses SAML authentication on a SonicWall SSLVPN, you need to check the firmware version today and update to a fixed release. This article explains CVE-2026-19868, the affected models and versions, how to check whether you are affected, how to update, and general measures while you cannot update, in a form readable even without a dedicated IT staff. The severity is the CVSS 7.1 score published by SonicWall. What is bypassed is part of the authentication; attackers do not get in with nothing, as explained below.

This article is based on public information as of November 7, 2026: the SonicWall PSIRT advisory (SNWLID-2026-0014), the CISA KEV catalog and NVD. Console steps are given only where we could confirm them on official pages; elsewhere we describe things generically.

The SonicWall advisory lists Gen7 and Gen8 hardware and NSv (virtual/cloud) appliances. If you run a version at or below the "affected version" in the table, you need to update.

SonicWall lists the workaround as "None." There is no official configuration change that substitutes for updating.

SAML hands the login decision to your identity provider (IdP), such as Microsoft Entra ID or Okta. VPN users sign in on the IdP's page instead of typing a password into the SonicWall directly. Companies that require MFA (a second step such as a phone approval) at the IdP use SAML as the way to apply MFA to the VPN as well.

SonicWall describes CVE-2026-19868 as an authentication enforcement flaw in the SSLVPN service. A user with valid credentials for an alternate authentication method may bypass SAML authentication controls, and successful exploitation may also bypass SAML-enforced MFA. The weakness is classified as CWE-308 (Use of Single-factor Authentication), and the KEV entry is named "SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability."

It is natural to read "credentials for an alternate authentication method" as a way to log in other than SAML, such as a local user password on the device or a directory (for example LDAP) password. However, the SonicWall advisory does not describe in detail where that alternate method comes from or under which exact configuration the condition arises, so we do not state the reproduction conditions as fact. What is certain is that devices using SAML for SSLVPN logins are affected and that valid credentials are a prerequisite.

That prerequisite matters. An attacker does not get in with nothing; they must have obtained a password or similar somehow. Yet password leaks and phishing happen every day, and companies that believed a stolen password alone was not enough because MFA was in place are the most affected when that assumption breaks.

A score of 7.1 is not extreme. But although the attack complexity is rated high (AC:H), the CVE is listed in KEV as exploited. In practice, prioritize the fact of exploitation over the size of the score.

Check in three steps. If you have no dedicated IT staff, ask your integrator or maintenance vendor to report these three points.

SonicWall's official knowledge base says to log in to the management console and open Home, then the "Dashboard | System" page, where the firmware version is shown in the General section. The SonicOS 7 upgrade guide also describes opening Device in the top menu and then "Settings | Firmware and Settings" to see the loaded firmware. Gen8 screens may be organized differently, so it is enough to confirm the version on the dashboard or the firmware settings screen of the management console. Keep a screenshot for later reporting.

Read the version including the build number after the hyphen, such as "7.3.3-7015." 7.3.3-7015 or older falls in the Gen7 affected range; 8.2.2-8015 or older falls in the Gen8 range. For NSv, SonicWall's NSv guide mentions the CLI commands show system and show sonicos, but we could not confirm on official pages that they give the same result on hardware, so on hardware rely on the management console.

According to a SonicWall knowledge base article on configuring SAML for SSLVPN with Azure AD as the IdP, SAML is configured under "DEVICE | Users > Settings > SAML CONFIGURATION," where the SAML Service Provider, Identification Provider and SAML Profile are managed. On the SSLVPN side, open "NETWORK | SSL VPN > Server Settings" and see whether Authentication Type is set to SAML. If it is SAML and the SAML Profile is enabled for SSLVPN, that matches SonicWall's condition "SAML is enabled for SSLVPN logins."

These menu names come from official SonicOS 7 pages. If names or locations differ on your Gen8 screens, search the console for "SAML," "SSL VPN" or "authentication," or ask your integrator. If you do not use SAML (SSLVPN authentication is not SAML), then per SonicWall's statement you are outside this CVE. The other vulnerabilities in the same advisory can affect you regardless of SAML, so update if your version is old.

Updating prevents future intrusions but cannot undo what already happened. Before and after updating, review SSLVPN usage for anything you do not recognize. SonicWall devices let you view logs in the console, and some companies also send them to Syslog or an external log store. Exact screen locations vary by version and configuration, so here are general points.

- Successful SSLVPN logins by accounts of former employees, people on leave or people with no reason to connect
- Logins from sources very different from usual in time of day or country/region
- Logins that should have gone through SAML but have no matching sign-in record on the IdP (Entra ID, Okta). Cross-checking IdP records against device records is the most effective approach given the nature of this flaw
- Runs of failures followed by successes across several users in a short time
- Save the device logs before updating, since an update or reboot may clear them

If you find anything suspicious, change the password of the account concerned and work with your vendor or a specialist to determine what that account could reach. Note that SonicWall did not publish specific indicators of compromise in the advisory as of this article's check.

First, what applies to every generation. Back up the configuration before updating. Use the export function in the console just before the work and keep the file outside the device. The update requires a reboot, so the VPN will be briefly unavailable; do it in a quiet period and notify staff in advance. Afterwards, test a real SSLVPN connection from outside the office.

If two devices are paired for redundancy (HA), the vendor provides a procedure for updating one at a time. A wrong order can stop both, so follow your integrator's runbook or SonicWall's upgrade guide. We keep this general here.

Update devices running 7.3.3-7015 or older to 7.3.4-7013 or higher. SonicWall's procedure is to get new firmware from Firmware and Settings under Device > Settings in the console and apply it. Firmware is downloaded from a MySonicWall account; without an active support contract it may not be available, so check your contract status early.

Update devices running 8.2.2-8015 or older to 8.2.3-8015 or higher. The basic flow matches Gen7. Gen8 console screens may be organized differently, so check the official Gen8 guide.

NSv runs on ESX, KVM, Hyper-V, AWS and Azure. The fixed versions are 7.3.4-7013 or higher for Gen7 NSv and 8.2.3-8015 or higher for Gen8 NSv. If your virtualization platform supports snapshots, take one before updating for an easy rollback. For cloud-hosted devices, it is also a good moment to review how widely the device is exposed. NSv is also affected by CVE-2026-19703 (weak password hashing on virtual appliances) in the same advisory, so prioritize the version-based update.

SonicWall states the workaround is "None." There is no official configuration-only way to reliably close CVE-2026-19868. The following are not official workarounds but general measures to reduce harm. Use them to buy time until you update, not instead of updating.

- Narrow SSLVPN exposure (general measure): if you can restrict source countries or IP addresses, limit them to what is needed, such as Japan or fixed office/home addresses. Check the effect on travelling users first
- Keep the management interface off the internet (general measure): the same advisory includes management-interface flaws (CVE-2026-107154, CVE-2026-107155). Allow management access only from the internal network or over the VPN
- Take stock of accounts with non-SAML authentication (general measure): list local users on the device and accounts that use password authentication alongside SAML, disable those not needed, and strengthen the passwords of those you keep
- Strengthen log monitoring (general measure): review successful SSLVPN logins daily and cross-check them against IdP records
- Consider temporarily stopping SSLVPN (general measure): if few people use it or an alternative exists, stopping it until the update is done is an option. Decide based on business impact

SNWLID-2026-0014 covers seven SonicOS vulnerabilities, not just one. The advisory-level CVSS 3.1 score is 8.8. The other six are resolved at the same time by the fixed versions in the table above. Only CVE-2026-19868 is reported as potentially exploited.

1. Identify the model and generation (Gen7/Gen8) of your SonicWall. Asset lists and maintenance contracts help
2. Check the current firmware version in the console and record it
3. Check whether SSLVPN authentication is SAML
4. Save SSLVPN logs and a configuration backup before updating
5. Schedule the update to 7.3.4-7013 or higher (Gen7) or 8.2.3-8015 or higher (Gen8) and notify staff
6. Cross-check IdP records against device SSLVPN logs for suspicious logins
7. Inventory accounts with non-SAML authentication and disable those not needed
8. Confirm the management interface is not visible from the internet
9. If you outsource operations, ask your vendor for status on the above today
10. After updating, connect to SSLVPN from outside to test and re-check the version

Today's roundup is in Vulnerability Digest for November 7. For another VPN appliance exploitation, see the Ivanti Connect Secure response guide. For perimeter thinking, see Zero Trust Security Guide and UTM and Firewall Cost Guide. For a system to keep updates from slipping, see Getting Started with Patch Management.

- SonicWall PSIRT SNWLID-2026-0014: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014
- NVD CVE-2026-19868: https://nvd.nist.gov/vuln/detail/CVE-2026-19868
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- SonicWall knowledge base, "How to check the current SonicWall firewall firmware version?": https://www.sonicwall.com/support/knowledge-base/how-to-check-the-current-sonicwall-firewall-firmware-version/kA1VN0000000GHj0AM
- SonicWall knowledge base, "How to configure SAML SSO on firewall for SSLVPN login using Azure AD as IdP?": https://www.sonicwall.com/support/knowledge-base/how-to-configure-saml-sso-on-firewall-for-sslvpn-login-using-azure-ad-as-idp/kA1VN0000000NSr0AM
- SonicOS 7 Upgrade Guide for NSsp, NSa, and TZ Series: https://www.sonicwall.com/support/technical-documentation/docs/sonicos-7-0-0-0-upgrade_guide/Content/Preparation/prep-firmware-obtaining-latest.htm
- SonicOS 7.1 Upgrade Guide for the NSv Series: https://www.sonicwall.com/support/technical-documentation/docs/sonicos-7-1-upgrade_guide_nsv/Content/Upgrading/upgrade-via-soniccorex.htm