SonicWall SSL-VPN MFA Bypass Under Attack

SonicWall has pushed emergency SonicOS updates after confirming an SSL-VPN authentication flaw that can skip SAML controls — and the multi-factor step many teams thought was mandatory. The bug is already in CISA’s Known Exploited Vulnerabilities catalog, so patching is not optional for internet-facing firewalls.

Update (Nov 11): Five days on, neither SonicWall nor CISA has shared details of the attacks, and SecurityWeek notes it's still unclear whether the flaw was exploited before the patch was out. Canada's Cyber Centre has issued its own advisory (AV26-1133). No details means no indicators to search for, so the log review in the list below is your best check. Look for SSL-VPN logins with no matching sign-in at your identity provider.

What happened

On November 6, 2026, coverage of SonicWall advisory SNWLID-2026-0014 detailed CVE-2026-19868: an authentication-enforcement gap in the SonicOS SSL-VPN service. A user who holds valid credentials for an alternate auth method can bypass SAML authentication controls. When MFA is enforced only through that SAML path, the same bypass can skip MFA as well.

The issue carries a CVSS score of 7.1 and applies only when SSL-VPN is configured for SAML. Affected builds are SonicOS Gen7 7.3.3-7015 and earlier, and Gen8 8.2.2-8015 and earlier. Fixed releases are 7.3.4-7013 and 8.2.3-8015. SonicWall says there are no workarounds — upgrade is the path.

SonicWall PSIRT said it investigated a report of potential exploitation and urged customers to move to the latest release. CISA added CVE-2026-19868 to KEV on November 6, with a federal remediation due date of November 20, 2026. BleepingComputer reported the same day; Ryan Harris of The Electronic Office is credited as the finder. Their note on X is how many admins first saw the story.

The same advisory also closes six other SonicOS flaws, including two management-interface issues rated about 8.8 that can allow unauthorized operations under specific conditions, plus pre-auth buffer overflows that can knock SSL-VPN or TACACS+ offline and a weak password-hashing issue on virtual appliances. Treat the full advisory as a single upgrade event, not just the SAML CVE.

Why it matters

SSL-VPN is still how a lot of offices, MSPs, and remote staff reach file shares and jump boxes. SAML plus MFA is the control boardrooms point to when auditors ask about remote access. This bug punches through that story if an alternate login method still works on the same portal — exactly the kind of “we thought MFA covered it” failure that shows up after ransomware or account takeovers.

SonicWall gear has already been a hotspot through 2026, including SMA1000 campaigns earlier in the year. A KEV listing means scanners and commodity exploit kits will keep probing long after the news cycle moves on. If your SonicWall SSL-VPN is on the public internet and still on the old builds, assume it is a priority patch window, not a “next maintenance Sunday” item.

What to do

• Confirm SAML on SSL-VPN. If you do not use SAML on the SSL-VPN service, CVE-2026-19868 does not apply — but still take the Gen7/Gen8 fixes for the other six issues in the same advisory.
• Upgrade now. Move Gen7 to 7.3.4-7013 or later and Gen8 to 8.2.3-8015 or later. There is no vendor workaround.
• Audit alternate auth methods. Review local, LDAP, RADIUS, or other portal logins that still exist alongside SAML. Disable anything you no longer need.
• Hunt while you patch. Check VPN auth logs for odd successful logins around the advisory window, especially sessions that never completed the usual MFA step. Snapshot configs before the upgrade.
• Shrink exposure. If you can put the portal behind a tighter allow-list or migrate critical remotes to a modern mesh VPN, do it. Our guides on Tailscale vs WireGuard and the recent Cisco ASA/FTD VPN zero-day / Palo Alto PHP2Shell posts cover the same “internet-facing VPN is a magnet” lesson.

My take

MFA theater is worse than no MFA: people trust the green check and stop watching the secondary doors. SonicWall’s own note that alternate credentials can walk past SAML is the detail every firewall admin should screenshot for the change ticket. Indian SMBs and MSPs that still park a Gen7 box on a static IP for “temporary” remote access are in the same blast radius as anyone else — KEV does not care which country the appliance sits in.

Patch first, then decide whether that SSL-VPN still needs a public listener. If the only reason it is online is habit, fold remotes onto something that is not a decade of VPN CVEs deep. Keep the PSIRT page and NVD entry bookmarked until you have verified the build string on every unit, including DR and lab firewalls that people forget.

For the endpoint side of the same clean-up, my PC malware check walks through what to look for on a machine you're unsure about, and my Linux TCP CVE-2026-98432 check covers the servers sitting behind the firewall.