WASHINGTON, November 9, 2026 — The US Cybersecurity and Infrastructure Security Agency has added a SonicWall SSLVPN authentication bypass to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies until November 20 to patch. The flaw, CVE-2026-19868, lets holders of valid alternate credentials sidestep SAML controls and, crucially, any MFA enforced through that SAML login.
The technical reality
The vulnerability sits in the SonicOS SSLVPN service when SAML authentication is enabled. An attacker with legitimate credentials for a different authentication method — local database, RADIUS, LDAP — can bypass the SAML flow entirely. Since many organisations use SAML specifically to enforce multi-factor authentication, the bypass effectively neuters that MFA requirement. The CVSS score is 7.1, high but not critical; the detail that matters is the authentication logic error, coded as CWE-308, use of single-factor authentication where multiple factors are expected.
SonicWall’s PSIRT investigated a report of potential exploitation in the wild. CISA’s KEV entry confirms exploitation, though neither agency has disclosed the threat actors, victim organisations, or whether ransomware was involved. The catalog entry lists ransomware use as unknown and does not trigger mandatory forensic triage under Binding Operational Directive 26-04.
Under the hood
The flaw affects two generations of hardware. Gen7 platforms — TZ, NSa, NSsp, and NSv firewalls — running SonicOS 7.3.3-7015 or earlier are vulnerable; the fix is 7.3.4-7013. Gen8 TZ, NSa, and NSv models on 8.2.2-8015 or earlier need 8.2.3-8015. No workarounds exist. SonicWall’s advisory is blunt: upgrade immediately.
The same advisory patches six other flaws. Two management interface bugs, CVE-2026-107155 and CVE-2026-107154, both carry CVSS 8.8 and allow unauthenticated attackers to perform unauthorised operations under specific conditions. Three pre-authentication buffer overflows in SSLVPN and TACACS+ services can cause application-level denial of service. A weak password hashing issue in virtual appliances rounds out the set, exploitable only with high-privileged local access.
Ryan Harris of The Electronic Office discovered and reported the primary vulnerability.
Context, as ever
This is not the first time SonicWall VPNs have appeared in the KEV. CVE-2024-53704, a session hijacking flaw requiring no credentials, was added earlier. The technical reality this time is different: valid credentials are a prerequisite, which narrows the attack surface but makes detection harder. An MFA setting alone, as ever, is not proof that every authentication route enforces the same checks.
Federal agencies have until November 20. Private sector organisations would do well to treat that deadline as their own.
Sources
- CISA Warns of SonicWall SonicOS SSLVPN Vulnerability Exploited in Attacks
- SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
- CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation
- U.S. CISA adds SonicWall SonicOS SSLVPN flaw to its Known Exploited Vulnerabilities catalog
- SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
Photo: Jonathan / Unsplash (Unsplash License)
