SonicWall Warns Hackers Are Exploiting a SonicOS VPN Flaw That Skips SAML Login and MFA

SonicWall has confirmed that attackers are actively exploiting a flaw in its SonicOS firewall software, and the US government has now put the bug on its must-patch list. The vulnerability, tracked as CVE-2026-19868, affects the SSLVPN service that lets remote workers connect to a company network. When the service is set up with SAML single sign-on, the flaw lets someone with valid credentials for a different login method slip past SAML entirely, along with the multi-factor authentication that SAML normally enforces. SonicWall published its advisory on November 6, 2026, and the US Cybersecurity and Infrastructure Security Agency, known as CISA, added the flaw to its Known Exploited Vulnerabilities catalog the same day. Federal agencies have until November 20, 2026 to fix it.

What the flaw actually does

The bug is an authentication enforcement problem, listed in the CVE record as CWE-308, use of single-factor authentication. In plain terms, the VPN is supposed to insist that everyone logging in goes through SAML, the system that hands authentication over to an identity provider such as Microsoft Entra ID or Okta. That provider is usually where multi-factor authentication is checked.

CVE-2026-19868 breaks that chain. If a user account also has credentials for another login method on the firewall, such as a local username and password, an attacker holding those credentials can authenticate through that alternate method and reach the VPN without ever touching SAML. The SAML check and its multi-factor step are simply skipped. SonicWall rates the issue as high severity, and the CVE record carries a CVSS score of 7.5.

It is worth being clear about what this flaw does not do. It does not hand an attacker a shell on the firewall, and it does not let someone in with no credentials at all. The attacker still needs a valid username and password for some login method on the device. Stolen credentials are common, so a bypass that turns a stolen password into VPN access without a second factor is a serious problem.

Which versions are affected

According to the CVE record, the flaw affects SonicOS 7.3.3-7015 and earlier releases, and SonicOS 8.2.2-8015 and earlier releases. Canada's Cyber Centre, which issued its own advisory on the same day, describes the affected range as versions earlier than 7.3.4-7013 on the 7.x branch. Administrators should treat SonicWall's advisory, SNWLID-2026-0014, as the final word on the exact build they need.

The exposure condition matters too. The flaw only matters when SSLVPN is configured with SAML authentication. A firewall that does not use SAML for its VPN, or one that has SSLVPN switched off, is not exposed through this particular bug. VPN appliances are prime targets, and SonicWall has had other exploited flaws in different product lines, so admins should check patch levels whatever login method they use.

Why CISA put it on the exploited list

CISA's Known Exploited Vulnerabilities catalog is a short list of flaws that are known to be actively exploited in the wild. Once a flaw lands there, US federal civilian agencies are required to patch it by the deadline CISA sets, which in this case is November 20, 2026. Private companies are not bound by that deadline, but security teams treat the catalog as a priority list, because a flaw on it is one attackers are already using.

SonicWall confirmed the active exploitation itself in its advisory, and the Canadian Centre for Cyber Security flagged the flaw in the same 24-hour window. No threat actor has been publicly named, and no victim list or start date for the exploitation has been published.

What administrators should do now

The first step is to update SonicOS to a fixed release. SonicWall's advisory lists the patched builds, and the general rule is to move to the latest release in your branch. Back up the firewall configuration first, so you can roll back if the update causes trouble.

Next, check whether the bypass could already have been used. Review SSLVPN login logs for successful logins that did not go through SAML, especially logins at odd hours or from unusual locations. Look for accounts that have both SAML and a local login method enabled, and consider whether those local credentials are still needed. If an account only ever logs in through SAML, removing its local login method closes the bypass path for that account.

If anything in the logs looks wrong, treat the credentials involved as compromised. Change the passwords, force a fresh sign-in for active VPN sessions, and check for any new accounts or configuration changes on the firewall that nobody on your team recognizes. Longer term, make SAML the only VPN login method where possible and set up alerts for logins that skip the expected path.

A familiar pattern for VPN appliances

There is nothing unusual about the shape of this story, and that is part of the point. VPN gateways sit at the edge of a network, they are reachable from anywhere, and they hold the keys to the inside, so they are a favorite target. The gap between a patch release and mass exploitation has shrunk to days in recent years. For organizations running SonicWall gear, the message is simple. The flaw is real, exploitation is confirmed, and the fix is available. Update the firewall, check the logs, and tighten the login methods before the November 20 deadline arrives.

Frequently Asked Questions

What is CVE-2026-19868?

CVE-2026-19868 is an authentication enforcement flaw in SonicWall's SonicOS SSLVPN service. It lets someone with valid credentials for an alternate login method bypass SAML single sign-on and the multi-factor authentication tied to it.

Am I affected if my VPN does not use SAML?

No, not by this specific flaw. The bypass only matters when SSLVPN is configured with SAML authentication. If your firewall does not use SAML for VPN logins, or if SSLVPN is disabled, CVE-2026-19868 does not expose you. You should still keep SonicOS updated, since VPN appliances are frequent targets for other flaws.

What should I do right now if I run a SonicWall firewall?

Update SonicOS to a fixed release listed in advisory SNWLID-2026-0014, then review your SSLVPN login logs for sign-ins that bypassed SAML. Remove local login methods from accounts that only need SAML, rotate any credentials that look compromised, and aim to finish before CISA's November 20, 2026 deadline for federal agencies.