SonicWall SSL VPN flaw exploited to bypass SAML and MFA logins

A flaw in the SSL VPN service of SonicWall's SonicOS firewalls lets someone holding valid credentials for another login method skip SAML sign-in, and with it any multi-factor authentication that SAML enforces. SonicWall disclosed the flaw on Friday as CVE-2026-19868 and said its security team "has investigated a report indicating potential exploitation". On the same day the US Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalogue, which lists only flaws with evidence of exploitation, and gave federal agencies until November 20 to fix it.

The flaw only matters on firewalls where SAML is turned on for SSL VPN logins, SonicWall says. On those, valid credentials for a different authentication method are enough to get past the SAML controls and the MFA they enforce. The advisory does not say which other methods qualify. SonicWall rates it 7.1 on CVSS and lists no workaround: the fix is SonicOS 7.3.4-7013 or later on Gen7 firewalls and 8.2.3-8015 or later on Gen8.

Neither SonicWall nor CISA has said who is exploiting the flaw, against whom, or since when. CISA lists its use in ransomware campaigns as unknown.

What the advisory covers

The same advisory, SNWLID-2026-0014, fixes seven SonicOS flaws on Gen7 and Gen8 TZ, NSa and NSsp hardware and NSv virtual firewalls. Two of them are rated higher than the exploited one, at 8.8: CVE-2026-107155, a permissive cross-domain policy in the management interface, and CVE-2026-107154, a session check that relies on the client's IP address. SonicWall says either could, in specific conditions, let a remote unauthenticated attacker perform unauthorised operations, and the scoring assumes a user has to interact, for example by opening a page. SonicWall has not said those two are exploited.

The other four are a pre-authentication heap overflow in the SSL VPN service and two in the TACACS+ client, all of which SonicWall says can crash the service, and weak password hashing on virtual appliances that could expose a platform credential to someone who already has local access.

SonicWall credits the exploited flaw to Ryan Harris of The Electronic Office. Pentest-Tools.com researchers reported the management interface and overflow flaws, and Italy's national cyber security agency, ACN, the password hashing issue.

What to check

Anyone running SonicOS SSL VPN with SAML login can check two things from the advisory: whether the firewall runs 7.3.3-7015 or older, or 8.2.2-8015 or older, which are the affected builds, and which accounts can still authenticate to the SSL VPN by a method other than SAML, since those are the credentials the flaw relies on. Firewalls without SAML on the SSL VPN are not exposed to this flaw but still need the update for the other six.

CISA's deadline for federal agencies is November 20. SonicWall has not published indicators of compromise or said how many customers use SAML for SSL VPN.