www.it-connect.fr
SonicWall SSL VPN Flaw Lets Attackers Bypass MFA — And It’s Being Exploited
Have you linked your SonicWall firewall’s SSL VPN to a SAML identity provider to enforce MFA on every login? An exploited security flaw in real-world attacks could let attackers bypass that protection. Here’s what you need to know about this vulnerability.
On November 6, 2026, SonicWall published a new security advisory for SonicOS firewalls. It fixes seven vulnerabilities, but one deserves your immediate attention: CVE-2026-19868, which affects the SSL VPN service. According to the vendor, a user with valid credentials for another authentication method could bypass SAML authentication checks. And potentially the MFA enforced by SAML.
On paper, it has a CVSS score of 7.1 out of 10, so it is not considered critical. And yet it should be taken seriously: "SonicWall PSIRT investigated a report indicating potential exploitation of this vulnerability. Customers are strongly advised to upgrade to the latest version as soon as possible to reduce the associated risk.", the advisory states. This zero-day security flaw therefore appears to already be under active exploitation...
This is serious indeed, because the CISA agency added CVE-2026-19868 to its KEV catalog the same day, confirming active exploitation.
Can MFA be bypassed with just a password?
SonicWall says this vulnerability affects only SSL VPN when SAML is enabled for VPN connections. For example, if an organization has connected its firewall to Microsoft Entra ID, Okta, or another identity provider to enforce MFA, it may fall within scope (SonicWall does not name any identity provider specifically).
The advisory does not explain how the flaw is exploited. However, the same security bulletin says the attack is carried out remotely and requires an account with low privileges (CISA, for its part, states that no privileges are required).
We can therefore assume that an attacker who has a valid password for another authentication method accepted by the firewall (local database, LDAP, or RADIUS, for example) could establish a VPN session without going through the identity provider. And therefore without a second factor.
Which versions are affected and what should you do?
Gen7 and Gen8 firewalls are affected, whether physical appliances or NSv virtual appliances:
- SonicOS Gen7: TZ, NSa, NSsp, and NSv models running version 7.3.3-7015 and earlier. The fix is available starting with version 7.3.4-7013.
- SonicOS Gen8: TZ, NSa, and NSv models running version 8.2.2-8015 and earlier. The fix is available starting with version 8.2.3-8015.
According to SonicWall, there is no workaround.
As mentioned earlier, this update also fixes other vulnerabilities. Here are the six other vulnerabilities patched in this release:
- Administration interface: CVE-2026-107154 and CVE-2026-107155 (score of 8.8) could allow an unauthenticated attacker to perform unauthorized operations under certain conditions.
- Denial of service: CVE-2026-82308 (score of 7.5) is a pre-authentication buffer overflow in SSL VPN. CVE-2026-77708 and CVE-2026-77709 (score of 5.9) affect the TACACS+ authentication client.
- Virtual appliances: CVE-2026-19703 (score of 5.2) involves a password hash that is too weak, exploitable by an attacker who already has local access.
This is not the first time SonicWall’s SSL VPN has been affected by a security flaw exploited by cybercriminals. In 2024, CVE-2024-40766 became a favorite target for attackers, especially those from the Fog and Akira ransomware gangs. Just last week, I also wrote about two flaws in SonicWall GMS, including a critical one, that will never be patched.
