SonicWall VPN flaw lets credentials for another login method skip SAML and MFA

A flaw in the SSLVPN service of SonicOS, the software on SonicWall’s firewalls, may let a user with valid credentials for another sign-in method get past SAML authentication. It may also get past MFA that SAML enforces. CISA added CVE-2026-19868 to KEV on Nov 6, the day SonicWall published its fix and said it had investigated a report indicating possible exploitation. Only firewalls that use SAML for SSLVPN logins are affected.

SonicWall’s advisory classes the flaw as use of single-factor authentication, reached through alternate authentication methods. The attacker needs working credentials for that other method, so a VPN that relies on SAML to enforce MFA may accept a login without it. SonicWall rates it 7.1 under CVSS 3.1, with low privileges and high attack complexity, and hasn’t said which alternate methods work.

The flaw affects Gen7 TZ, NSa, NSsp and NSv firewalls on SonicOS 7.3.3-7015 and earlier, and Gen8 TZ, NSa and NSv firewalls on 8.2.2-8015 and earlier. That includes NSv appliances on ESX, KVM, Hyper-V, AWS and Azure. SonicWall says it affects the SSLVPN interface or service only when SAML is enabled for SSLVPN logins, and it lists no workaround.

The same release fixes six other flaws. Two in the management interface, rated 8.8, could let a remote unauthenticated attacker perform unauthorized operations under specific conditions, SonicWall says, and both need a user to take an action. Three let an unauthenticated attacker cause a denial of service in the SSL-VPN service or the TACACS+ client. One on virtual appliances lets an attacker with local access disclose a platform credential.

Neither SonicWall nor CISA has described the exploitation, how many firewalls were hit or whether it began before the fix. SonicWall credits Ryan Harris of The Electronic Office with reporting the flaw.