SonicWall VPN flaw skips SAML MFA: fixed builds, CISA date Nov. 20

SonicWall published fixes on November 6 for seven flaws in SonicOS, the software on its TZ, NSa, NSsp and NSv firewalls, and warned that one of them may already have been used in an attack. CVE-2026-19868 sits in the SSL-VPN service. Someone who holds working credentials for a different login method can get past the SAML step, and with it any multi-factor prompt that SAML was there to enforce. CISA put the flaw in its Known Exploited Vulnerabilities catalog the same day, which gives federal civilian agencies until November 20 to fix it.

Why it matters to IT teams

A company that routes VPN logins through SAML does it so the identity provider, and its MFA, decides who gets in. This bug lets a user skip that decision. SonicWall rates it 7.1, lower than three other flaws in the same advisory, but it is the only one of the seven the advisory marks as exploited. SonicWall says it looked into "a report indicating potential exploitation" and gives no detail. SecurityWeek notes that neither SonicWall nor CISA has described the attacks, and that it is unclear whether the flaw was used before the fix shipped. There is no workaround. Ryan Harris of The Electronic Office reported it.

SonicWall gear has been a steady target this year. BleepingComputer counts three rounds against the separate SMA1000 remote access line alone: two zero-days in July, two chained zero-days in September, and attempts on CVE-2026-102255 in October. SecurityWeek counts 20 SonicWall entries in CISA's catalog, not yet including CVE-2026-102255.

Step 1: does the firewall use SAML for SSL-VPN?

SonicWall says the bug matters only where SAML is turned on for SSL-VPN logins. In the SonicOS 7.2 SAML guide, that choice is made under SSL VPN > Server Settings, where the authentication type is set to SAML. Menu names may differ slightly on 7.3 and 8.x. NetExtender clients on such a firewall pick SAML from the Domain list when they connect. A firewall that authenticates VPN users some other way is not exposed to this CVE, though it still needs the update for the other six flaws.

Step 2: find the model and the build

The list is from SonicWall's advisory SNWLID-2026-0014. It covers SonicOS firewalls only. SMA appliances are not in it.

Step 3: patch in this order

1. Firewalls with SAML set for SSL-VPN. This is the exploited flaw.
2. Firewalls whose management interface can be reached from outside. Two flaws there, CVE-2026-107155 and CVE-2026-107154, score 8.8 and could let a remote attacker who has not logged in take unauthorized actions under specific conditions.
3. Every other firewall running SSL-VPN or a TACACS+ client. A pre-login heap overflow in SSL-VPN (7.5) and two pre-login buffer overflows in the TACACS+ client (5.9 each) can knock the service over.
4. NSv virtual firewalls also get a fix for weak password hashing (5.2), which needs an attacker who already has high-privilege local access.

What IT teams should do

• List every SonicOS firewall and its build. Anything at or below 7.3.3-7015 or 8.2.2-8015 needs the update.
• Open SSL VPN > Server Settings on each one and note which use SAML. Those go first, today if you can.
• Upgrade to 7.3.4-7013 or 8.2.3-8015. SonicWall has "strongly urged" customers to do it as soon as possible.
• After patching, check whether anyone got in before the fix. CISA's BOD 26-04 sets out when federal agencies must check whether attackers got in before a patch went on. Since the bypass skips the SAML step, compare SSL-VPN sessions from the past weeks with sign-ins at your identity provider and look for VPN logins with no matching sign-in.
• Review which accounts still hold working credentials for any other login method on the firewall, and disable the ones nobody needs. The flaw depends on them.
• Keep the management interface off the internet. That limits the two 8.8 flaws on any box you cannot patch this week.

Sources: SonicWall advisory SNWLID-2026-0014, CISA KEV alert, BleepingComputer, SecurityWeek, SonicOS 7.2 SAML guide.