SonicWall’s SonicOS SSLVPN SAML bypass, CVE-2026-19868, lets a person with valid credentials for one authentication method skip SAML sign-in on the SSLVPN service. It can also skip SAML-enforced multi-factor authentication (MFA), per SonicWall’s own advisory. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 6 November 2026 and set a fix-by date of 20 November 2026.
SonicWall’s own advisory, SNWLID-2026-0014, says its PSIRT team investigated a report indicating potential exploitation and urges customers to upgrade immediately. CISA’s decision record for the KEV entry lists the exploitation status as active. Canada’s Cyber Centre, in advisory AV26-1133 of 6 November 2026, repeats SonicWall’s statement that the flaw is being exploited.
What Does the SonicWall SSLVPN SAML Bypass Allow?
The CVE record says a user who holds valid credentials for an alternate authentication method can bypass SAML authentication controls on the SonicOS SSLVPN service. SonicWall’s advisory adds that exploitation can also bypass SAML-enforced MFA. The flaw applies only when SAML is enabled for SSLVPN logins.
NVD’s secondary score, sourced from SonicWall, lists CVSS 3.1 as 7.5 High, with scope changed, under CWE-308, use of single-factor authentication. SonicWall’s own advisory text gives 7.1 for the same vulnerability. No CVSS 4.0 score appears in the record or NVD.
- CISA KEV listingYesAdded 6 Nov 2026, due 20 Nov 2026CISA KEV catalogue, 6 Nov
- SonicWall PSIRT reportYesInvestigated a report indicating potential exploitationSonicWall SNWLID-2026-0014, 6 Nov
- CISA SSVC decisionYesLists exploitation as activeCISA SSVC record, 6 Nov
- Ransomware useUnknownKEV entry lists campaign use as UnknownCISA KEV, 6 Nov
Three Companion Flaws in the Same SonicWall Advisory
SonicWall’s bundle advisory also lists three other SonicOS flaws fixed in the same release. CVE-2026-107154 and CVE-2026-107155 each score CVSS 3.1 8.8 High. The first is a session validation flaw under CWE-291, reliance on IP address for authentication, and the second is a permissive cross-domain policy flaw under CWE-942.
CVE-2026-82308 scores CVSS 3.1 7.5 High under CWE-122, heap-based buffer overflow. SonicWall’s advisory says it is a pre-authentication flaw in the SSL-VPN service that can cause a denial of service. SonicWall’s advisory does not say either flaw is exploited.
Which SonicOS Versions Fix the SSLVPN SAML Bypass?
SonicWall’s advisory lists fixed builds by platform generation. Older point releases on each generation remain affected.
| Platform | Affected | Fixed |
|---|---|---|
| Gen7 hardware firewalls (TZ270 to TZ670, NSa 2700 to 6700, NSsp 10700 to 15700) and Gen7 NSv (270, 470, 870) | 7.3.3-7015 and older | 7.3.4-7013 and newer |
| Gen8 hardware firewalls (TZ80 to TZ680, NSa 2800 to 5800) and Gen8 NSv (XS, S, M, L) | 8.2.2-8015 and older | 8.2.3-8015 and newer |
What Should You Do Now?
There is no interim workaround for CVE-2026-19868. SonicWall’s advisory says upgrading to a fixed build is the only fix.
- Upgrade SonicOSMove Gen7 firewalls to 7.3.4-7013 or newer and Gen8 firewalls to 8.2.3-8015 or newer, per SonicWall’s advisory.
- Check SAML useConfirm whether SAML is enabled for SSLVPN logins. SonicWall says the flaw only reaches SSLVPN when SAML sign-in is on.
- Review SSLVPN logsLook for SSLVPN sign-ins that used an alternate authentication method where SAML was expected, then compare against the KEV due date.
- Track the other threeApply the same SonicOS build to close CVE-2026-107154, CVE-2026-107155 and CVE-2026-82308, fixed in the same release.
SonicWall’s SSLVPN service has carried earlier bypass flaws. See our page on the 2024 SonicWall SSLVPN bypass, CVE-2024-53704. For the control this flaw defeats, see our multi-factor authentication glossary entry and the valid accounts technique.