If your office firewall is a SonicWall and staff sign in to the VPN with SAML, update it this week.

What happened

A lot of small offices sit behind a SonicWall, and a lot of them let staff reach the network through its SSL VPN. The careful ones put that login behind SAML, so it goes through the company’s identity provider and gets the second factor. The NVD description of CVE-2026-19868 says a user “with valid credentials for an alternate authentication method” can bypass the SAML controls, and that “successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).”

That is the whole problem in one sentence: the second factor you thought stood in front of the VPN can be walked around by someone who holds an ordinary username and password for the box. Stolen or reused passwords are the most common thing attackers have, which is the reason MFA exists.

SonicWall’s advisory, published November 6, says the company investigated a report indicating potential exploitation. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 6 with a November 20 deadline for federal agencies. The affected and fixed firmware builds below are as reported by security press summarizing SonicWall’s advisory; confirm your exact model against SNWLID-2026-0014 before you update.

Who is exposed

• Gen 7 firewalls on SonicOS 7.3.3-7015 or earlier, and Gen 8 firewalls on 8.2.2-8015 or earlier, when SAML is enabled for SSL VPN logins.
• If the SSL VPN uses only local users or LDAP without SAML, this particular flaw does not apply, though the same advisory carries six other fixes and you should take the update anyway.
• If the SSL VPN is not enabled at all, you are not exposed to this. Many offices turned it on in 2020 and never turned it off; this is a good day to check.

What to do

1. Find the firmwareWhoever manages the firewall reads it from the device’s System page. Compare it against the two fixed builds above for your generation.
2. UpdateSonicWall says there is no workaround for CVE-2026-19868; the firmware update is the fix. Schedule it for a quiet hour, since the box reboots.
3. Review who has a VPN loginThe flaw needs a valid set of credentials for another login method. Fewer accounts, no shared ones, and nothing left over from a former employee shrinks the problem whether or not the update is on yet.
4. Look at the VPN logsSign-ins from countries or hours that make no sense for your staff, especially between early November and the update, deserve a closer look and a password change for that account.

SonicWall joins Ivanti, Cisco and others on CISA’s list of office network gear exploited this fall; our firewall and router roundup has the rest. If you are not sure who manages your firewall, that is itself a finding, and our security assessment starts there.

Sources

• SonicWall PSIRT: SNWLID-2026-0014
• NVD: CVE-2026-19868
• CISA Known Exploited Vulnerabilities catalog
• eSecurity Planet: CISA adds exploited SonicWall SSLVPN authentication bypass to KEV
• OpenVPN blog: CVE-2026-19868 SonicWall SSL VPN SAML MFA bypass hits KEV