Skip to content
Hacker Posts

SonicWall patches exploited SSL-VPN SAML bypass CVE-2026-19868

CVE-2026-19868 lets a user with alternate-method credentials bypass SAML auth, including SAML-enforced MFA, on SonicOS SSL-VPN. In CISA KEV; patch to the fixed builds now.

Published 2 min read
cvesonicwallssl-vpnadvisory

SonicWall patched an authentication-enforcement flaw in the SonicOS SSL-VPN service that lets a user holding valid credentials for one authentication method bypass SAML controls — including SAML-enforced MFA — on another. The bug is tracked as CVE-2026-19868, rated 7.1, and CISA has already added it to the Known Exploited Vulnerabilities catalog. Federal civilian agencies have until November 20, 2026 to remediate. If you run SonicOS SSL-VPN with SAML, patch today.

The primary source is SonicWall's PSIRT advisory SNWLID-2026-0014, published November 6. The flaw was reported by Ryan Harris of The Electronic Office.

What's affected

Per SonicWall, the SAML bypass hits SSL-VPN services configured for SAML authentication on:

  • SonicOS Gen7: 7.3.3-7015 and earlier.
  • SonicOS Gen8: 8.2.2-8015 and earlier.

The NVD entry describes the same enforcement gap: a user with valid credentials for an alternate authentication method can bypass SAML. The fixes are in Gen7 7.3.4-7013 and Gen8 8.2.3-8015. SonicWall says no workarounds are available.

SNWLID-2026-0014 bundles six other SonicOS fixes, including two management-interface flaws rated 8.8 that allow unauthorized operations under specific conditions, pre-authentication buffer overflows in SSL-VPN and TACACS+ that can crash the service, and weak password hashing in virtual appliances.

Exploitation status

SonicWall's PSIRT says it "investigated a report indicating potential exploitation" but did not share detail. The firmer signal is the CISA KEV listing, which is added on evidence of active exploitation. No public proof-of-concept or IOC set has been published alongside the advisory.

Action checklist

  1. Upgrade to Gen7 7.3.4-7013 or Gen8 8.2.3-8015 now. There is no workaround.
  2. Rotate credentials for accounts that use the non-SAML authentication methods the bypass abuses, and review SSL-VPN session and auth logs for logins that skipped the expected SAML step.
  3. Restrict management-interface exposure while you patch — the same advisory fixes two 8.8 management flaws.
  4. Confirm MFA enforcement post-upgrade by testing the SAML path with a non-privileged account.

Context

SonicWall edge appliances are a standing target: the SMA 1000 line drew a KEV listing in July over CVE-2026-15409 and CVE-2026-15410, and SSL-VPN remains one of the most-probed internet-facing surfaces on the catalog. The pattern holds here — the detail that stings is the MFA bypass: operators who treat SAML-enforced MFA as a hard gate were, for valid-credential holders on an alternate method, running without it.

Related stories