SonicWall has patched a high-severity vulnerability in SonicOS that can allow a VPN user to bypass SAML authentication, and with it the multi-factor authentication that SAML is supposed to enforce. The flaw, tracked as CVE-2026-19868, was added to the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog on November 6, the same day SonicWall published its advisory, and federal agencies must remediate it by November 20.
The vulnerability affects the SSL VPN service in SonicOS, the operating system that runs on SonicWall firewalls, but only when SAML is enabled for SSL VPN logins. According to SonicWall, a user who holds valid credentials for an alternate authentication method may bypass the SAML authentication controls. Because the bypass can also defeat SAML-enforced multi-factor authentication, an attacker who obtains one set of working credentials could reach a network without completing the second-factor challenge that administrators believed was in place.
SonicWall rated the flaw 7.1 on the CVSS scale and classified it as a use of single-factor authentication weakness. The flaw was reported by Ryan Harris of The Electronic Office. SonicWall said its product security team has investigated a report indicating potential exploitation of the vulnerability, and it strongly urged customers to upgrade as soon as possible. Neither SonicWall nor CISA has shared details about the suspected attacks, and it remains unclear whether the flaw was exploited as a zero-day before a patch became available. CISA lists use of the flaw in ransomware campaigns as unknown, and SonicWall lists no workaround.
The affected systems cover two generations of SonicWall hardware and virtual firewalls. Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older are affected, as are Gen8 TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or older. SonicOS 7.3.4-7013 resolves the issue for Gen7 systems, and SonicOS 8.2.3-8015 resolves it for Gen8 systems. Because there is no workaround, upgrading to a fixed release is the only complete mitigation that SonicWall offers.
CVE-2026-19868 is one of seven vulnerabilities described in SonicWall's November 6 advisory, SNWLID-2026-0014. SonicWall does not mark any of the other six flaws as exploited, but two of them carry CVSS scores of 8.8 and affect the SonicOS management interface. One is a permissive cross-domain policy issue and the other is a session validation bug, and under certain circumstances a remote attacker could abuse either one without logging in to take unauthorized actions. Three of the remaining flaws are pre-authentication buffer overflows in the SSL VPN service and the TACACS+ authentication client that could be used for application-level denial-of-service attacks. The last flaw is a weak password hashing issue in virtual appliances that an attacker with high-privileged local access could exploit to obtain a platform credential.
For enterprise network teams, the practical priority is straightforward. Administrators should inventory every SonicWall firewall that uses SAML for SSL VPN logins, confirm its SonicOS build, and schedule the upgrade to the fixed release well before the November 20 federal deadline. They should also review VPN authentication logs for logins that succeeded through an alternate method without a corresponding SAML and multi-factor challenge, since patching alone does not establish whether the bypass was already used. Threat actors have repeatedly targeted SonicWall products, and CISA's catalog already includes 20 SonicWall security holes, which makes prompt patching of an actively exploited authentication bypass especially urgent.