# SonicOS SSLVPN: exploited bypass of SAML authentication and MFA Canonical: https://www.oktsec.com/radar/sonicos-sslvpn-saml-cve-2026-19868 Publisher: Oktsec Language: en Published: 2026-11-13T01:26:23Z Updated: 2026-11-13T01:26:23Z Record reviewed: 2026-11-13T01:26:23Z Latest evidence check: 2026-11-13T01:26:23Z Disclosed: 2026-11-05 CISA lists CVE-2026-19868 as exploited. It affects SonicOS SSLVPN with SAML enabled when an attacker has valid credentials for an alternate authentication method, potentially bypassing SAML MFA. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: CISA confirms exploitation of the exact CVE. SAML must be enabled for SSLVPN and the attacker needs valid credentials for an alternate method; the other CVEs in the vendor bundle have different conditions. - Evidence: Attacks confirmed - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Account access required - Vendor: SonicWall - Products: SonicOS SSLVPN - CVEs: CVE-2026-19868 ## Technical overview This authentication enforcement flaw is limited to the SonicOS SSLVPN service when SAML is enabled. Valid credentials for another authentication method can allow a user to bypass SAML controls, including its MFA requirement. It is not a universal passwordless login vulnerability. CISA added the exact CVE to KEV on November 6. SonicWall’s November 9 advisory revision provides the workaround and lists affected and fixed firmware for specific Gen7 and Gen8 hardware and NSv platforms. This record covers CVE-2026-19868, not every vulnerability in that advisory. Use the platform table to select the update. If an immediate upgrade is impossible, the vendor’s workaround removes active alternate authentication servers and can affect legitimate access. Oktsec recommends checking earlier sessions after remediation; an update does not establish that all previous logins were authorized. ## Recommended response Update listed Gen7 devices to 7.3.4-7013 or later, and Gen8 devices to 8.2.3-8015 or later. Verify SSLVPN authentication and review earlier sessions, including use of alternate login methods. Relevant to: Teams operating the SonicOS Gen7 and Gen8 hardware or NSv platforms listed in SNWLID-2026-0014. ## CVE attribution - CVE-2026-19868: SonicWall — SonicOS SSLVPN. [Source](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014) ## Affected systems and fixes ### Listed Gen7 hardware and NSv platforms Affected: 7.3.3-7015 and older; SAML enabled for SSLVPN Fixed release / action: 7.3.4-7013 or later ### Listed Gen8 hardware and NSv platforms Affected: 8.2.2-8015 and older; SAML enabled for SSLVPN Fixed release / action: 8.2.3-8015 or later Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.10 Checked: 2026-11-13T02:21:36.147Z ### [CVE-2026-19868](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19868) - Added: 2026-11-06 - Ransomware use: Not confirmed by CISA - Federal due date: 2026-11-20 - Federal forensic triage: No Action specified by CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-13T02:21:36.567Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-19868](https://api.first.org/data/v1/epss?cve=CVE-2026-19868): 0.53% probability of observed exploitation in the next 30 days; percentile 45.46%; score date 2026-11-12. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-13T02:21:36.567Z. ### Official regional advisories - [Vulnerabilidades en productos de SonicWall](https://www.cert.gov.py/vulnerabilidades-en-sonicwall-sonicos/) — CERT-PY, Paraguay; publication 2026-11-09T11:37:56.000Z; observed 2026-11-13T02:21:36.567Z; matched by exact CVE identifier. Publisher country does not establish victim location. Original notices may repeat the same underlying advisory. ## Response checklist 1. **Check SSLVPN, SAML and the platform list** — Confirm that SSLVPN logins use SAML and identify alternate authentication methods. Match the exact hardware or NSv model to the vendor table; this CVE does not affect every SonicOS configuration. 2. **Install and verify the branch correction** — Update listed Gen7 hardware and NSv instances to 7.3.4-7013 or later, and listed Gen8 hardware and NSv instances to 8.2.3-8015 or later. Verify the active firmware and test the intended SAML and MFA behavior. 3. **Apply the documented workaround if an upgrade is delayed** — When SAML is in use and firmware cannot be upgraded, SonicWall instructs administrators to disable or delete active LDAP, RADIUS and TACACS+ authentication servers configured on the firewall. Assess effects on legitimate access before making this change. 4. **Review earlier VPN sessions** — Oktsec recommends examining SSLVPN and identity provider logs for alternate authentication, unusual access and sessions lacking expected MFA evidence. Investigate suspicious sessions and recover affected credentials if compromise is established. ## Relevance to AI environments Oktsec recommends including VPN credentials used by unattended jobs and integrations in the authentication review, rather than assuming SAML protects every login method. ## Sources - [SNWLID-2026-0014: CVE-2026-19868 scope, fixes and workaround](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014) — SonicWall; Vendor notice; checked 2026-11-13T01:26:23Z - [CISA KEV: exact CVE record](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — CISA; Government advisory; checked 2026-11-13T01:26:23Z ## Editorial record - 2026-11-13T01:26:23Z: Added verified product scope, exploitation evidence and the vendor’s correction guidance. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/sonicos-sslvpn-saml-cve-2026-19868) · [Build a response plan](https://www.oktsec.com/radar/sonicos-sslvpn-saml-cve-2026-19868#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=sonicos-sslvpn-saml-cve-2026-19868&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=sonicos-sslvpn-saml-cve-2026-19868&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.