74 openlast updated

HomeOctober 2026 patch cycleCVE-2026-19868 SonicOS SSL VPN SAML/MFA bypass exploited

Patch nowEnterprisefrom 2026-10

CVE-2026-19868 SonicOS SSL VPN SAML/MFA bypass exploited

Part of October 2026 patch cycle

Vendor
SonicWall
Products
SonicOS Gen7 7.3.3-7015 and earlier, SonicOS Gen8 8.2.2-8015 and earlier, SonicOS 7.3.4-7013, SonicOS 8.2.3-8015, TZ, NSa, NSsp, and NSv
Published
Status
Open

Call: Patch now. SonicWall’s Nov 6 advisory fixes seven SonicOS bugs, and one of them, CVE-2026-19868, lets someone get into the SSL VPN without going through SAML, and so without the MFA that SAML was enforcing. SonicWall says it “investigated a report indicating potential exploitation.” CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a federal deadline of Nov 20. There’s no workaround. The fix is firmware.

What breaks: Your MFA, quietly. If the SSL VPN accepts more than one way to log in and SAML is one of them, an attacker with valid credentials for one of the other methods can skip the SAML check. That’s the whole trick: the password you thought was only half the login turns out to be enough. It isn’t an unauthenticated attack, so the attacker needs a working credential first. Stolen VPN passwords are not exactly in short supply.

Who’s hit: SonicWall firewalls with the SSL VPN on and SAML authentication configured:

  • Gen7 (TZ, NSa, NSsp, NSv) on SonicOS 7.3.3-7015 or earlier
  • Gen8 (TZ, NSa, NSv) on SonicOS 8.2.2-8015 or earlier

If SAML isn’t enabled for the SSL VPN, this CVE doesn’t apply. The other six bugs in the advisory still might. CVSS is 7.1 per SonicWall (NVD says 7.5). Neither SonicWall nor CISA has described the attacks, and it’s not clear whether it was used before the patch existed.

What to do:

  • Upgrade Gen7 to SonicOS 7.3.4-7013 and Gen8 to 8.2.3-8015, or later.
  • Until you can, consider turning off the non-SAML login methods on the SSL VPN, so SAML is the only way in. SonicWall doesn’t list that as a workaround, so treat it as your own risk call.
  • Look back: check SSL VPN logins for users who authenticated without a matching SAML/IdP sign-in, and reset passwords for any account that did.

Sources: CISA KEV alert, BleepingComputer, SecurityWeek, SonicWall SNWLID-2026-0014, GitHub advisory.

Sources

More from October 2026 patch cycle