AI and security briefsSecurity

Is my SonicWall firewall open to the SAML MFA bypass CVE-2026-19868?

By Brandon Da Costa, founder of Digiton Dynamics

Published 9 November 2026Updated 9 November 2026Editorial policy

CVE-2026-19868 lets someone with valid credentials for another login method skip SAML authentication on a SonicOS SSLVPN, including the MFA that SAML enforces. SonicWall says it investigated a report of possible exploitation. CISA listed the bug as exploited on 6 November 2026, with a federal deadline of 20 November.

Who should act: Anyone running Gen7 or Gen8 SonicWall firewalls with SSLVPN logins set to SAML, above all where LDAP, RADIUS or TACACS+ servers are also configured on the firewall.

What happened

SonicWall's advisory SNWLID-2026-0014 covers seven SonicOS flaws. Its page shows 6 November as first published, while the revision history dates the initial release 5 November (SonicWall PSIRT, 9 November). One of the seven is CVE-2026-19868, an authentication enforcement flaw in the SSLVPN service. A user with valid credentials for an alternate authentication method can bypass SAML controls, and possibly the MFA that SAML enforces.

SonicWall says its PSIRT investigated a report indicating potential exploitation and urges customers to upgrade as soon as possible. It adds that the flaw only matters when SAML is enabled for SSLVPN logins. CISA added the CVE to its exploited list on 6 November with a due date of 20 November (CISA KEV).

Scores differ. SonicWall rates the bug 7.1 (PSIRT), while the NVD entry carries a 7.5 secondary score (NVD, 9 November). The advisory headline score of 8.8 belongs to two management-interface flaws in the same bundle. Version 1.1 of the advisory, dated 9 November, rewrote the workaround for this CVE, so re-read it if you saved an earlier copy.

Who is affected

• Gen7 firewalls on SonicOS 7.3.3-7015 or older: TZ 270 to 670, NSa 2700 to 6700, NSsp 10700 to 15700, and NSv 270, 470 and 870.
• Gen8 firewalls on SonicOS 8.2.2-8015 or older: TZ 80 to 680, NSa 2800 to 5800, and NSv XS, S, M and L.
• Exposure needs SAML enabled for SSLVPN logins. The attacker also needs valid credentials for an alternate method, and the workaround names LDAP, RADIUS and TACACS+ servers.
• The advisory lists no Gen6 or SMA appliances (SonicWall PSIRT).

What we checked

Run on 9 November 2026 on the Mac that builds this site. Each command and its output are copied as they ran.

$ curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | jq -r '.vulnerabilities[] | select(.cveID=="CVE-2026-19868") | "\(.cveID) added \(.dateAdded) due \(.dueDate)"'
CVE-2026-19868 added 2026-11-06 due 2026-11-20

CISA's own feed shows the listing date and the due date as of today.

Check your exposure

Read the SonicOS version in the management interface and compare it with the limits above. Then check two settings, using the advisory's own menu paths.

1. Open your SSLVPN login settings and see whether SAML is on.
2. Open Device, Users, Settings, Authentication and look under Configure LDAP, Configure RADIUS and Configure TACACS+ for active servers.

SAML on plus an active alternate server on an affected build is the exposed setup.

What to do now

1. Upgrade to SonicOS 7.3.4-7013 or later on Gen7 and 8.2.3-8015 or later on Gen8. Start with firewalls whose SSLVPN faces the internet. The same release fixes the other six CVEs in the advisory.
2. If you cannot upgrade, follow SonicWall's workaround. With SAML in use, disable or delete every active LDAP, RADIUS and TACACS+ server under the firewall's authentication server settings. Check first what else depends on those servers, such as admin logins.
3. Compare SSLVPN logins in the firewall log with sign-ins at your identity provider. A session with no matching SAML sign-in is the thing to chase. SonicWall gives no exploitation dates, so go back as far as your logs reach.
4. If you find one, or cannot rule it out, rotate what the firewall holds: LDAP bind account passwords, RADIUS shared secrets, TACACS+ keys, local admin passwords and the passwords of the affected users. SonicWall does not say this flaw exposes those secrets, so this is a precaution.
5. Keep the management interface off the internet, since two of the other fixed flaws sit there.

What should have been in place

• One login path for SSLVPN. When SAML is the rule, alternate authentication servers should be off.
• A firmware inventory and a short patch window for any VPN or firewall that faces the internet.
• An alert when a VPN session has no matching sign-in at the identity provider.
• Unique passwords per system, so a valid password for one method is not enough for another.
• A watch on CISA's catalog for the vendors you run.

Questions people ask

Digiton's production review maps every internet-facing login path and the secrets behind it, and the checks it runs are on the vibe coded app audit page.

How this brief was made: researched from the sources below, drafted with AI assistance and checked against each source on the dates shown. See the editorial policy.

Sources

1. SonicWall PSIRT advisory SNWLID-2026-0014, 6 November 2026, read 9 November 2026. https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014
2. NVD record for CVE-2026-19868, 6 November 2026, read 9 November 2026. https://nvd.nist.gov/vuln/detail/CVE-2026-19868
3. CISA Known Exploited Vulnerabilities catalog, read 9 November 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog

More briefs

How these briefs are sourced and corrected. All AI and security briefs