--- title: "SonicWall SSLVPN SAML MFA Bypass Exploited, Added to KEV" description: "SonicWall fixed an SSLVPN flaw that lets a valid login skip SAML and multi-factor checks. CISA added it to KEV on November 6, 2026." url: https://policycortex.com/blog/sonicwall-sslvpn-saml-mfa-bypass-kev sealed: 2026-11-07 register: blog/sonicwall-sslvpn-saml-mfa-bypass-kev records: 3 digest: sha3:2c05b9ca0eaebefc49f20c2d43989095c3eb5edd7526de0d8f409806988e5818 --- # SonicWall SSLVPN Flaw Lets Valid Logins Skip SAML and MFA Resources / Blog SonicWall fixed an SSLVPN flaw scored 7.1 that lets a valid alternate login skip SAML and its multi-factor check. CISA added it to the Known Exploited Vulnerabilities catalog on November 6, 2026. Leonard Esere · Sealed 2026-11-07 · Reading time 5 min Filed under: [SonicWall](https://policycortex.com/blog/tags/sonicwall), [CVE-2026-19868](https://policycortex.com/blog/tags/cve-2026-19868), [SSLVPN](https://policycortex.com/blog/tags/sslvpn), [SAML](https://policycortex.com/blog/tags/saml), [MFA bypass](https://policycortex.com/blog/tags/mfa-bypass), [KEV](https://policycortex.com/blog/tags/kev), [evidence](https://policycortex.com/blog/tags/evidence) **Summary** - A valid alternate login could skip SAML controls on the SSLVPN service. - The skip could also bypass SAML enforced multi-factor authentication. - CISA added the flaw to KEV on November 6, 2026, with a November 20 deadline. - Update Gen7 to 7.3.4-7013 or Gen8 to 8.2.3-8015, then test the login path. SonicWall fixed a login flaw in its firewall software on November 6, 2026. The flaw sits in the Secure Sockets Layer virtual private network (SSLVPN) service. It lets a user with valid credentials for another login method skip Security Assertion Markup Language (SAML) controls. That skip can also bypass SAML enforced multi-factor authentication (MFA). The Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog the same day. ## The flaw The record is [CVE-2026-19868](https://www.cve.org/CVERecord?id=CVE-2026-19868). Common Vulnerabilities and Exposures (CVE) is the public record system for flaws. SonicWall scores the flaw 7.1 on the Common Vulnerability Scoring System (CVSS) version 3.1. The vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N. The weakness is CWE-308, use of single-factor authentication. CWE means Common Weakness Enumeration. The Cybersecurity and Infrastructure Security Agency (CISA) runs the Known Exploited Vulnerabilities (KEV) catalog. Only firewalls with SAML enabled for SSLVPN logins are affected. The flaw affects Gen7 firewalls on SonicOS 7.3.3-7015 and earlier. It also affects Gen8 firewalls on SonicOS 8.2.2-8015 and earlier. The fix is SonicOS 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8. SonicWall lists no workaround. The firmware update is the only fix. ## What attackers could do A user who holds valid credentials for an alternate login method could reach the SSLVPN service. The SAML step would not run. The multi-factor check tied to SAML would not run either. The attacker would land inside the network with a session the team believed was protected. SonicWall investigated a report that pointed to potential exploitation. The company urged customers to upgrade at once. It published no technical detail on the reported attacks. ## The KEV deadline CISA added the flaw to KEV on November 6, 2026. The entry sets a fix date of November 20, 2026. That date binds federal civilian agencies under Binding Operational Directive (BOD) 26-04. The entry lists ransomware use as Unknown. The deadline is short because exploitation was reported. Private teams should treat November 20 as their own target date too. ## Six more flaws in the same release The same advisory fixes six more flaws. Two flaws in the management interface score 8.8. They let unauthenticated attackers perform unauthorized operations in specific conditions. The release also covers pre-authentication buffer overflows in SSLVPN. Teams should install the full release, not only the SAML fix. ## What to do now First, list every SonicWall firewall. Record its generation, its SonicOS version, and whether SAML is enabled for SSLVPN logins. Second, update each affected firewall to 7.3.4-7013 or 8.2.3-8015. Third, test the login path after the update. Try an alternate login method against the SSLVPN service. Confirm the SAML step now runs. Confirm the multi-factor check now runs. Fourth, review SSLVPN login logs for alternate method logins that skipped SAML. Fifth, rotate credentials tied to any session that skipped the check. ## The governance lesson The flaw came from a fallback path. An alternate login method could reach the service without the SAML step. The team believed SAML protected every login. The firewall did not enforce that belief. That is the lesson for every team. A login control must cover every path into the system, not only the main one. Evidence must show the check ran on each path. A policy that names SAML is not proof. A test that shows the SAML step running is proof. ## Sources - SonicWall security advisory SNWLID-2026-0014, November 6, 2026. https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014 - [CVE-2026-19868](https://www.cve.org/CVERecord?id=CVE-2026-19868) record, CVE Program. - CISA Known Exploited Vulnerabilities catalog entry for [CVE-2026-19868](https://www.cve.org/CVERecord?id=CVE-2026-19868), added November 6, 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog - BleepingComputer coverage, November 6, 2026. https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/ - Original diagram by PolicyCortex ## Next step Update every affected firewall to the fixed SonicOS build. Then test that the SAML step and the multi-factor check run on every login path. **Questions on this record** **Q: Which firewalls are affected?** A: Gen7 firewalls on SonicOS 7.3.3-7015 and earlier, and Gen8 firewalls on 8.2.2-8015 and earlier, with SAML enabled for SSLVPN logins. **Q: Was the flaw exploited?** A: SonicWall investigated a report of potential exploitation. CISA added the flaw to the Known Exploited Vulnerabilities catalog on November 6, 2026. **Q: Is there a workaround?** A: No. SonicWall lists no workaround. The firmware update is the fix. ## Related records Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page. - **proof.state**: [Proof of State](https://policycortex.com/proof/state). What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained. - **proof.change**: [Proof of Change](https://policycortex.com/proof/change). Who or what altered the environment, under what authority, with before and after state hashes. - **proof.agency**: [Proof of Agency](https://policycortex.com/proof/agency). What a machine was permitted to do before it acted, what it did, and what would have stopped it. - **architecture**: [Architecture](https://policycortex.com/architecture). How the chain is built and where it lives: inside your tenant, with no egress of evidence. ### Further reading in this register | Published | Entry | Reading | |---|---|---| | 2026-11-07 | [SolarWinds Dameware Command Injection Scores 9.9](https://policycortex.com/blog/solarwinds-dameware-command-injection-99): SolarWinds fixed a Dameware command injection flaw scored 9.9. An authenticated user could run commands on the remotely controlled host. Update to 2026.3.1. | 5 min | | 2026-11-06 | [FBI and CISA Warn That Attackers Are Targeting Refrigeration Controllers](https://policycortex.com/blog/cold-chain-refrigeration-advisory): A joint advisory dated November 5, 2026 warns that attackers target refrigeration controllers in grocery and cold storage sites. The fix starts with removing internet exposure and changing default passwords. | 5 min | | 2026-11-06 | [GPUStack Auth Bypass Gave Attackers Admin Access With No Login](https://policycortex.com/blog/gpustack-auth-bypass-exploited): GPUStack fixed an auth bypass scored 9.8. Attackers had already used it in the wild. Update to 2.2.2 or later. | 5 min | Verify the record this entry describes. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book) Dates of record - **Published**: 2026-11-07 - **Last updated**: Unchanged since sealing - **Author**: Leonard Esere - **Record**: https://policycortex.com/blog/sonicwall-sslvpn-saml-mfa-bypass-kev ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | HEAD | 7e6fbe59957e | beb483e7c9ff | | REC 0001 | BODY | a42c77f16dfe | 7e6fbe59957e | | REC 0002 | RELATED RECORDS | 2c05b9ca0eae | a42c77f16dfe | Head sha3:2c05b9ca0eaebefc49f20c2d43989095c3eb5edd7526de0d8f409806988e5818. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.