SonicWall SonicOS SSLVPN flaw bypasses SAML login and MFA; exploited in the wild

What happened

SonicWall has disclosed CVE-2026-19868, an authentication enforcement weakness in the SSLVPN service of SonicOS. A user who has working credentials for a different, alternate authentication method may be able to sidestep the SAML controls that are supposed to govern VPN logins. Because those controls are skipped, any multi-factor authentication enforced through SAML can be bypassed as well, effectively reducing the login to a single factor.

The issue is classified as CWE-308, use of single-factor authentication. It was published on 2026-11-06. CISA added it to its Known Exploited Vulnerabilities catalog the same day, meaning the flaw is being actively exploited.

Who is affected

The flaw affects SonicWall SonicOS with the SSLVPN service. According to the data available to us, the affected ranges are SonicOS versions earlier than 7.3.4-7015 and SonicOS versions earlier than 8.2.2-8015. Organizations that rely on SAML, and on MFA enforced through SAML, to protect SSLVPN access are the ones whose controls can be circumvented.

How serious is it

The flaw carries a CVSS 3.1 base score of 7.5, rated high. The score reflects a network-reachable attack that requires no prior privileges or user interaction, though attack complexity is rated high. The main impact is on confidentiality.

What raises the urgency is that the flaw is being actively exploited and is listed in the CISA KEV catalog, with a remediation due date of 2026-11-20 for US federal agencies. The EPSS score, an estimate of exploitation likelihood, is 0.00621. Bypassing MFA on a VPN gateway can undermine a key layer of perimeter protection.

What you should do

1. 1Update SonicOS to 7.3.4-7015 or 8.2.2-8015, whichever matches your release line, or a later version.
2. 2Follow the SonicWall advisory SNWLID-2026-0014 and apply any mitigations it describes.
3. 3Review SSLVPN login activity for sessions that did not pass through SAML or MFA.
4. 4Assess which SonicOS devices expose SSLVPN to the internet and prioritize them.
5. 5Federal agencies should complete remediation by the CISA due date of 2026-11-20 or stop using the product if mitigations are not available.

Quick facts