Tech News · Cybersecurity
SonicWall SSL VPN vulnerability — what businesses should do
“Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks.”
— SonicWall, via SecurityWeek
What happened
A SonicWall SSL VPN vulnerability, tracked as CVE-2026-19868, can let someone get past the SAML login and multi-factor authentication (MFA) protecting remote access on SonicWall firewalls. SonicWall disclosed the flaw on November 6, 2026 in advisory SNWLID-2026-0014, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog the same day.
According to SonicWall’s description, the bug is an authentication enforcement problem in the SonicOS SSL VPN service: a user holding valid credentials for a different, alternate login method may be able to bypass the SAML authentication controls, including SAML-enforced MFA. SonicWall said its product security team investigated a report indicating potential exploitation, and Canada’s Centre for Cyber Security notes that SonicWall indicates the flaw is being exploited. Neither SonicWall nor CISA has shared details about the attacks.
The affected devices are Gen 7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older, and Gen 8 TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or older. Fixed releases are SonicOS 7.3.4-7013 and 8.2.3-8015. SecurityWeek reports there are no workarounds, and the exposure applies when SAML-based login is enabled on the SSL VPN. The same advisory also fixes six other SonicOS flaws, including two management-interface issues and several denial-of-service bugs that SonicWall has not marked as exploited. Federal civilian agencies have until November 20, 2026 to patch; private businesses have no federal deadline, but the risk is the same.
FuzeForth’s take
SonicWall’s TZ series is one of the most common firewalls in small and mid-size offices, and the SSL VPN is often the front door for remote staff. Many businesses added SAML single sign-on and MFA precisely so a stolen password would not be enough to get in. This SonicWall firewall flaw undermines that promise: if an attacker already holds credentials for another login method on the device, the MFA layer you are counting on may not stop them. That is why this one deserves attention this week, not at the next maintenance window.
The businesses most exposed are those with remote or hybrid teams that log in through SonicWall’s VPN using a SAML identity provider. That includes a lot of accounting practices, law firms and medical offices, where a VPN break-in can lead straight to client files. If an outside IT provider manages your firewall, don’t assume it’s handled; ask for confirmation of the firmware version.
Here is what to do now. First, find every SonicWall device you own and note its generation and SonicOS version. Second, upgrade to 7.3.4-7013 (Gen 7) or 8.2.3-8015 (Gen 8) or later, ideally the latest supported release. Third, review recent SSL VPN logins for unfamiliar locations, odd login methods or configuration changes, and reset credentials for any account that looks suspicious, because patching closes the hole but doesn’t tell you whether someone already used it. Gen 6 and older units are end-of-support, so plan a replacement. If you don’t have the time or in-house staff to handle patching and security monitoring, that is the kind of ongoing work our managed security and website care service covers.
Key points
- CVE-2026-19868 lets a user with valid credentials for an alternate login method bypass SAML authentication and SAML-enforced MFA on the SonicOS SSL VPN.
- Affected: Gen 7 firewalls on SonicOS 7.3.3-7015 or older and Gen 8 firewalls on 8.2.2-8015 or older. Fixed in 7.3.4-7013 and 8.2.3-8015.
- SonicWall reported potential exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 6, 2026.
- There is no workaround. Patch, then review VPN login logs and rotate any exposed credentials.
- Gen 6 and older SonicWall devices no longer receive updates and should be replaced.
Frequently asked questions
Is my SonicWall firewall affected by the SSL VPN vulnerability?
You are affected if you run a Gen 7 TZ, NSa, NSsp or NSv firewall on SonicOS 7.3.3-7015 or older, or a Gen 8 TZ, NSa or NSv firewall on 8.2.2-8015 or older, with SAML-based login enabled on the SSL VPN. Check the firmware version in the device’s management console.
How do I fix the SonicWall MFA bypass?
Upgrade to SonicOS 7.3.4-7013 or later on Gen 7, or 8.2.3-8015 or later on Gen 8. SonicWall has not offered a workaround, so updating the firmware is the fix.
Can attackers use this flaw without a password?
No. According to SonicWall’s description, the attacker needs valid credentials for an alternate authentication method. The danger is that MFA, which is supposed to stop attackers who have stolen passwords, may not block them.
