What happened
SonicWall, a maker of firewalls and VPN gateways widely used by smaller businesses, published security advisory SNWLID-2026-0014 on Friday, November 6, 2026. It describes CVE-2026-19868, a flaw in the SSL VPN service of SonicOS, the operating system running on its firewalls. The flaw makes it possible to bypass SAML login and, with it, any multi-factor authentication (MFA) you enforce through SAML.
According to the vendor, the flaw can be used by someone who holds valid credentials for a different, alternate authentication method. Help Net Security puts it in practical terms: a VPN login that should have gone through your identity provider (such as Okta or Microsoft Entra ID) and its MFA check can succeed with a password alone.
SonicWall said its PSIRT team investigated a report indicating potential exploitation of the flaw. It has not shared any details about the attacks or who is behind them. The US agency CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on November 6, 2026, and the European EUVD database (entry EUVD-2026-118429) lists it as exploited since the same day. The flaw was discovered and reported by Ryan Harris of Electronic Office.
Why it is dangerous
This is a “use of single-factor authentication” weakness (CWE-308). Picture a building where the main entrance asks for an ID badge and a PIN. Under certain conditions, though, a side door opens with just a key. Anyone holding that key, such as a stolen password, walks in without the second check.
The attack comes over the internet straight at the VPN gateway. It is not a login without a password, though: according to Help Net Security, attackers need working credentials first. Stolen VPN credentials are not hard to come by, and SAML-enforced MFA is exactly what is supposed to make them useless. Whoever logs in this way lands inside your network as a regular VPN user and can reach data and try to move further from there.
The CVSS severity score (on a scale of 0 to 10) is 7.5, rated high. This CVSS 3.1 value is listed in the NVD database, but it was assigned by another organization, not by NVD itself. The Hacker News lists two values, 7.1 and 7.5.
CISA’s KEV catalog lists flaws for which the US agency has evidence of exploitation. US federal civilian agencies must fix this one by November 20, 2026. EPSS, a statistical estimate of the chance of exploitation in the next 30 days, stood at about 0.6% on November 9, 2026, higher than roughly half of all flaws. Confirmed exploitation outweighs this estimate, though.
SonicWall SSL VPN devices have long been a favorite target of ransomware-linked attackers. Help Net Security notes that in 2025, affiliates of the Akira ransomware group compromised SonicWall firewalls even though OTP-based MFA was enabled. CISA does not yet say whether this specific flaw is used by ransomware.
Who is affected
The flaw affects SonicWall Gen7 and Gen8 firewalls, both physical and virtual, running these firmware versions:
- SonicOS 7.3.3-7015 and older
- SonicOS 8.2.2-8015 and older
According to Help Net Security, it can only be exploited when SAML is enabled for SSL VPN logins, meaning people sign in to the VPN through an external identity provider such as Microsoft Entra ID or Okta. Typically these are businesses where a SonicWall box is the main internet gateway and staff use SSL VPN to work from home or on the road.
Gen6 firewalls are not listed as affected. They have, however, reached end of support, and SonicWall advises replacing them and any older hardware with a Gen8 firewall. If you do not use SAML for SSL VPN, this flaw does not appear to affect you, but the update fixes other flaws as well.
How to check if you are affected
You can find the firmware version without changing anything in the SonicOS web management interface. It is shown on the main Dashboard and in the firmware section, which in SonicOS 7 and 8 is under Device > Settings > Firmware and Settings.
If SSH management is enabled, this command in the firewall’s command line interface also prints the version. It only reads and changes nothing:
show versionNext, check whether SAML login is enabled for SSL VPN. Look at the user authentication and SSL VPN settings in the admin interface, or check your identity provider for a SonicWall VPN application. You are affected if you run Gen7 or Gen8 at the listed version or older and also use SAML for SSL VPN.
How to fix it
SonicWall fixed the flaw in version 7.3.4-7013 and higher on the 7.x branch and in version 8.2.3-8015 on the 8.x branch. According to Help Net Security, the same releases fix six other flaws, none of which have been flagged as exploited. The Hacker News mentions among them two management interface flaws scored 8.8 and an SSL VPN flaw that can cause a denial of service.
According to Help Net Security, the vendor lists no workaround, so updating is the only protection. Work in this order:
- First update firewalls that expose SSL VPN to the internet and use SAML.
- Export a configuration backup and plan a short maintenance window, as the firewall reboots during the update.
- Download the fixed firmware from the MySonicWall portal and upload it through the management interface.
- After the reboot, confirm the version using the steps in the previous section.
- Then update your other Gen7 and Gen8 firewalls, including those without SAML, because of the other fixed flaws.
If you cannot update right away, as a general measure consider temporarily limiting SSL VPN access to essential users only and closely monitoring logins. Owners of Gen6 and older firewalls should, as SonicWall advises, plan a move to Gen8.
What if you may already be compromised
According to Help Net Security, neither SonicWall nor CISA has published indicators of compromise (IoCs) yet, and no security company has released an analysis of the attacks. It therefore advises organizations using SAML for SSL VPN to:
- Review recent successful SSL VPN logins and compare them with your identity provider’s logs. Any VPN login without a matching sign-in and MFA check in Entra ID, Okta or another system is suspicious.
- Reset the passwords and other credentials of any account that logged in that way, and check what was accessed during those sessions.
As a general check, we also recommend looking for unknown user accounts on the firewall, unexpected configuration changes and logins from unusual countries or at unusual times. If you find a login with no record at the identity provider, or your logs do not go back far enough, bring in an incident response specialist. In VPN-based attacks, the next steps are often lateral movement and ransomware.