CVE-2026-19868: SonicWall SonicOS SSLVPN SAML Authentication and MFA Bypass

Background

SonicOS is the operating system of SonicWall firewalls; its SSLVPN service provides remote access, often protected by SAML single sign-on and MFA. CVE-2026-19868 is one of seven CVEs in SonicWall advisory SNWLID-2026-0014, first published 6 November 2026 and updated 9 November. CISA added it to KEV on 6 November 2026.

A scoring caveat: the advisory headline shows CVSS 8.8, but that is the highest score among the seven CVEs. SonicWall’s own per-CVE score for CVE-2026-19868 is 7.1 (per the SonicWall advisory). NVD currently lists 7.5 for this CVE, supplied by CISA-ADP (NVD’s source identifier is 134c704f-9b21-4f2e-91b3-4a467353bcc0); the SonicWall CNA container in the CVE record carries no score. The vendor score of 7.1 alone clears the 7.0 threshold. The page header score follows the NVD record (7.5) so it matches a published NVD value; the vendor figure is 7.1.

Technical Mechanism

SonicWall describes an authentication enforcement vulnerability in the SSLVPN service: “a user with valid credentials for an alternate authentication method” can bypass SAML authentication controls, and successful exploitation “may also bypass SAML-enforced multi-factor authentication (MFA)”. The weakness is classed CWE-308 (Use of Single-factor Authentication). The vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N.

The advisory notes the issue only affects the SSLVPN interface or service if SAML is enabled for SSLVPN logins. Its workaround text implies the alternate methods are LDAP, RADIUS and TACACS+ servers configured on the firewall. The precise request flow is not published.

Real-World Exploitation Evidence

• SonicWall states its PSIRT “has investigated a report indicating potential exploitation of this vulnerability” and urges customers to upgrade as soon as possible. The wording is “potential”; the advisory gives no actor or technical indicators.
• CISA added the CVE to KEV on 6 November 2026, due 20 November 2026. The ransomware field reads “Unknown” as of 10 November 2026.
• As of 10 November 2026 we found no named threat actor or public exploit code.

Impact Assessment

The attacker must already hold valid credentials for an alternate authentication method, which limits the bug to credential-compromise scenarios. Within that, the bypass removes the SAML and MFA layer, so stolen or reused directory credentials could be enough for VPN access. The vector’s scope-changed rating and high confidentiality impact reflect network access gained beyond the firewall itself. Organizations that rely on SAML MFA for SSLVPN and also keep LDAP, RADIUS or TACACS+ servers configured on the same firewall are the exposed population.

Affected Versions

The advisory directs customers to upgrade to the latest release; fixed build numbers should be taken from advisory SNWLID-2026-0014. We did not extract them.

Remediation Steps

1. Upgrade SonicOS to the fixed release listed in SNWLID-2026-0014.
2. If SAML is in use and upgrading is not possible, disable or delete any active LDAP, RADIUS and TACACS+ authentication server on the firewall, via Device → Users → Settings → Authentication.
3. Review SSLVPN sessions for the period before patching, and rotate credentials for directory accounts that may be exposed.
4. Address the other six CVEs in the same advisory, including the 8.8-rated CVE-2026-107154 and CVE-2026-107155 and the 7.5-rated SSL-VPN CVE-2026-82308.

Detection Guidance

SonicWall publishes no indicators. Suggestions, not vendor guidance:

• Look for SSLVPN logins that succeed without a corresponding identity-provider SAML sign-in event for the same user and time.
• Flag SSLVPN sessions authenticated via LDAP, RADIUS or TACACS+ on a firewall where SAML is the intended method.
• Check for new VPN sessions from unusual source IPs or hours for accounts with MFA.

Timeline

References

• SonicWall PSIRT — SNWLID-2026-0014
• CVE record
• NVD — CVE-2026-19868
• CISA Known Exploited Vulnerabilities Catalog