If you run a SonicWall firewall with SAML turned on for SSLVPN logins, check your SonicOS version today. SonicWall says CVE-2026-19868 may let a user with valid credentials for a different login method get around SAML, including SAML-enforced multi-factor authentication (MFA).
SonicWall's advisory, SNWLID-2026-0014, says its PSIRT "has investigated a report indicating potential exploitation of this vulnerability." It strongly urges customers to upgrade as soon as possible.
What to do
- Check whether SAML is enabled for SSLVPN logins. SonicWall says the flaw only affects SSLVPN when it is.
- Find your SonicOS version.
- Compare it with the table below. Gen7 up to 7.3.3-7015 and Gen8 up to 8.2.2-8015 are affected.
- Upgrade to Gen7 7.3.4-7013 or higher, or Gen8 8.2.3-8015 or higher.
- If you cannot upgrade and you use SAML, use the workaround below.
Who is affected
The flaw is in the SonicOS SSLVPN service. SonicWall says it only matters if SAML is enabled for SSLVPN logins. The attacker needs valid credentials for an alternate method. The workaround names LDAP, RADIUS and TACACS+.
| Platform | Affected | Fixed |
|---|---|---|
| Gen7 firewalls and NSv | 7.3.3-7015 and older | 7.3.4-7013 and higher |
| Gen8 firewalls and NSv | 8.2.2-8015 and older | 8.2.3-8015 and higher |
The advisory lists the affected models, including Gen7 TZ, NSa and NSsp firewalls, Gen8 TZ and NSa firewalls, and NSv virtual firewalls on ESX, KVM, Hyper-V, AWS and Azure. Check the advisory for your exact model.
The workaround
SonicWall updated this section on Nov. 9 (advisory version 1.1). If SAML is in use and upgrading is not possible, disable or delete any active LDAP, RADIUS and TACACS+ authentication server on the firewall. The menu path is Device > Users > Settings > Authentication.
The advisory lists no side effects. That is our caution, not SonicWall's: before you remove those servers, check what else depends on them.
The CISA listing
CISA's Known Exploited Vulnerabilities catalog added CVE-2026-19868 on Nov. 6. Federal civilian agencies are directed to fix it by Nov. 20. Known ransomware use is listed as "Unknown".
The scores and the other six
CVE-2026-19868 has a CVSS score of 7.1. The advisory covers seven CVEs, and its headline score of 8.8 belongs to other items. This is the one flagged for potential exploitation.
The other six are a permissive cross-domain policy, a session validation flaw, a pre-authentication heap overflow in SSL-VPN, two pre-authentication TACACS+ overflows, and weak password hashing on virtual appliances. SonicWall credits Ryan Harris of The Electronic Office for CVE-2026-19868.
What we checked
- The text of SonicWall advisory SNWLID-2026-0014, read Nov. 9.
- The CISA Known Exploited Vulnerabilities entry for CVE-2026-19868.
What SonicWall did not say
The advisory names no exploiter and gives no victim count. It does not confirm attacks and lists no indicators of compromise. So we cannot tell you how to spot a break-in. Patch first.
For other fixes worth checking this month, see the Android November security bulletin. For another exploited-flaw story with a clear patch path, see Plex Media Server flaws exploited: update now. More coverage is under computing.
