Skip to content
Cyber Security

SonicWall SSL VPN MFA bypass: CVE-2026-19868 explained

A SonicWall bug lets a valid password skip SAML sign-in and its MFA on the SSL VPN. It's on CISA's exploited list. Who's affected, the fix and the workaround.

Geidi Security Operations Team5 min read

A woman opening a laptop at her kitchen table at night, a security key lying beside it and the front door open behind her

In brief

What it is
CVE-2026-19868 lets someone with a valid password for another sign-in method skip a SonicWall SSL VPN's SAML login, and the MFA that comes with it.
Who it affects
Organisations with a Gen 7 or Gen 8 SonicWall firewall whose SSL VPN logins go through SAML, such as Microsoft Entra ID.
What to do
Install the latest SonicOS release for your model (at least 7.3.4 for Gen 7, 8.2.3 for Gen 8); if you can't yet, disable the firewall's LDAP, RADIUS and TACACS+ servers, then check recent VPN logins.
On this page
  1. What the flaw does
  2. Are you affected?
  3. How to fix it
  4. If you think it already happened
  5. Where Geidi fits
  6. Sources

Plenty of organisations moved their SonicWall VPN logins to Microsoft Entra ID or another identity provider for one reason: so every remote connection has to pass MFA. A flaw SonicWall disclosed on 6 November 2026 undoes that. On an affected firewall, someone with the right password can reach the VPN without ever seeing the MFA prompt.

The vulnerability is CVE-2026-19868. SonicWall says it has investigated a report of potential exploitation, and CISA added it to its Known Exploited Vulnerabilities catalogue the same day, giving US federal agencies until 20 November to deal with it.

If your staff connect through a SonicWall SSL VPN and sign in through Microsoft, treat this as this week's job, not next month's.

What the flaw does

SonicWall's advisory, SNWLID-2026-0014, covers seven SonicOS vulnerabilities. CVE-2026-19868 is the one being exploited. SonicWall describes it as an authentication enforcement flaw in the SSL VPN service: a user with valid credentials for an alternate authentication method can bypass the SAML authentication controls, and with them any MFA that SAML enforces. SonicWall scores it 7.1.

In plain terms: your firewall may know more than one way to check a password. SAML hands the sign-in to your identity provider, which applies MFA. If the firewall is also connected to an LDAP directory (often your on-premises Active Directory), a RADIUS server or a TACACS+ server, a password that works against one of those can get a VPN session without going through SAML at all. No second factor is asked for.

That makes stolen passwords far more valuable. Passwords leak through phishing, reuse and infostealer malware, and MFA is usually the thing that makes a leaked password useless. Here it isn't.

The flaw only matters when SAML is turned on for SSL VPN logins. A SonicWall with SAML off isn't exposed to this particular bug, though the same advisory has other fixes it needs (below).

Are you affected?

You're exposed if all three are true:

  • The firewall is Gen 7 or Gen 8. The advisory lists Gen 7 TZ, NSa and NSsp models and NSv virtual firewalls on SonicOS 7.3.3-7015 or older, and Gen 8 TZ, NSa and NSv models on 8.2.2-8015 or older.
  • SAML is enabled for SSL VPN logins. This is the setup where staff are sent to a Microsoft (or other) sign-in page when they connect.
  • The firewall has another authentication server configured. An active LDAP, RADIUS or TACACS+ server is the alternate method the attack relies on. SonicWall's workaround removes exactly these.

Your IT person can see the firmware version on the firewall's dashboard, and the authentication servers under Device, Users, Settings, Authentication.

How to fix it

  1. Update the firmware. SonicWall's advisory names SonicOS 7.3.4-7013 for Gen 7 and 8.2.3-8015 for Gen 8 as the first fixed releases. Install the latest release MySonicWall offers for your model, not an older build you have saved. This also fixes the advisory's other six bugs, which include two management interface flaws scored 8.8 that could let an unauthenticated attacker carry out unauthorised actions in some conditions, and an SSL VPN bug that can be used to knock the service over.
  2. If you can't update today, use the workaround. SonicWall added it to the advisory on 9 November: with SAML in use, disable or delete every active LDAP, RADIUS and TACACS+ server configured on the firewall. They're under Device, Users, Settings, Authentication, in the Configure LDAP, Configure RADIUS and Configure TACACS+ settings. Check first whether anything else on the firewall relies on them, such as administrator logins or user-based firewall rules, because those will stop working.
  3. Keep the management interface off the internet. The 8.8 flaws are in the management interface. It should only be reachable from your internal network or a trusted management address, never from anywhere.
  4. Limit who can reach the VPN portal. If your staff only ever connect from Australia, a geo-IP restriction on the SSL VPN cuts a lot of the noise. It isn't a fix, but it shrinks the crowd that can try.

Updating firmware on a firewall restarts it, so plan an outage after hours. Read SonicWall's release notes for your model and current version before you start, in case your upgrade path needs extra steps, and take a configuration backup.

We covered the same pattern for Fortinet in our FortiGate patching guide: the firewall is the front door, and a front-door bug on the exploited list is a days problem, not a weeks one.

If you think it already happened

SonicWall hasn't published signs of compromise for this flaw, so the check is a comparison you do yourself:

  • Match VPN logins to identity provider sign-ins. Every legitimate SAML VPN login should have a matching sign-in in Microsoft Entra ID (or your provider) at the same time. A VPN session on the firewall with no matching sign-in is the pattern to look for.
  • Look for odd sessions. Logins at strange hours, from overseas addresses, or for accounts that don't normally use the VPN.
  • Reset passwords for any account that turns up. Then review what that session reached on your network.

If you find something, isolate what you can and get incident response help before wiping anything. Report it to ASD's ACSC at cyber.gov.au (opens in a new tab) ("Cybercrime" for most businesses, "Cyber security incident" for organisations with 250 or more staff or $250 million or more in annual turnover, government and critical infrastructure) or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371). If personal information may have been accessed, the Notifiable Data Breaches scheme may apply. Our guide for WA organisations hit by a cyber attack covers who to call and what to do first.

Where Geidi fits

Our cyber security service is a 24/7 security operations centre with monitoring, detection and response, and patching is part of our managed IT support. If you'd like your SonicWall checked against this advisory, talk to us.

Sources

More on Cyber Security

One partner for the whole environment.

Tell us about your existing IT. We would be pleased to review your current system and give you an overview as to how Geidi may be able to deliver and enhance your IT operations.

Book a consultationCall 1300 855 049