A SonicWall Firewall Bug Walks Right Past SAML MFA — and CISA Gave 14 Days to Patch It

The device your whole office assumes is the security control just turned out to be the thing that needed one. On 6 November 2026, SonicWall published a single advisory covering seven SonicOS vulnerabilities — and CISA added one of them to its Known Exploited Vulnerabilities catalogue the same day, with a remediation deadline of 20 November.[1][2]

That vulnerability is CVE-2026-19868. Vendor CVSS: 7.1. Not the highest score in the batch. It is the one that matters, because of what it bypasses.

What actually happened

SonicWall PSIRT published advisory SNWLID-2026-0014 on 6 November. It covers Gen 7 and Gen 8 firewalls and lists seven CVEs, with the advisory's overall score at 8.8.[1]

The wording for CVE-2026-19868 is precise and worth reading literally:

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).[1]

Two things in that text decide your exposure. First, it only applies if SAML is enabled for SSLVPN logins — the advisory says so in a separate note.[1] Second, it is an enforcement bug, not a cryptography bug: the attacker needs to be a valid principal somewhere, but once they are, they can arrive through a path that is not the SAML path.

SonicWall also states that its PSIRT "has investigated a report indicating potential exploitation of this vulnerability" and urges customers to upgrade.[1] CISA's action converts that from a vendor worry into a public fact: the flaw is in the KEV catalogue, based on evidence of active exploitation.[2]

Affected and fixed builds, from the vendor:[1][7]

• Gen 7 (TZ 270–670, NSa 2700–6700, NSsp 10700–15700, NSv 270/470/870): affected at 7.3.3-7015 and older, fixed at 7.3.4-7013 and higher.
• Gen 8 (TZ 80–680, NSa 2800–5800, NSv XS/S/M/L): affected at 8.2.2-8015 and older, fixed at 8.2.3-8015 and higher.
• Workaround: none.[1]
• Gen 6 and older are end-of-support — SonicWall publishes no fix for them.[7]

The same advisory carries the rest of the batch, and the scores are a reminder that severity rankings are not priorities: two flaws in the management interface score 8.8 (a permissive cross-domain policy, CVE-2026-107155, and a session validation bug, CVE-2026-107154), a pre-authentication heap overflow in the SSL-VPN service scores 7.5 (CVE-2026-82308), two TACACS+ overflows score 5.9 each, and weak password hashing on the virtual appliances scores 5.2.[1]

Why MFA did not save you here

Most mid-market VPN setups look like this: the firewall terminates the SSL VPN, SAML points at an identity provider, and the identity provider is where the second factor actually happens. The MFA is not on the firewall. It is in the flow the firewall is supposed to force.

An alternate-method bypass breaks exactly that chain. If a principal can authenticate by another enabled method — a local account, a directory entry, a RADIUS user, whichever path is still switched on — then the SAML gate, and the MFA step inside it, never executes. That is why the weakness is classified as CWE-308, use of single-factor authentication, and why the CVSS vector carries a changed scope: the vulnerable component is being judged by a policy that lives in another system.[1][4]

NVD had not assigned its own score at the time of writing; the CISA-ADP vector works out to 7.5, slightly above the vendor's 7.1.[4] Neither number is the reason to act this week. The KEV entry is.

The filter that makes this actionable

CISA's catalogue is a machine-readable list, and reading it directly beats reading headlines about it. The feed published with catalog version 2026.11.06 holds 1,769 entries, and 20 of them are SonicWall. The newest addition in that version is this CVE, dated 6 November, due 20 November — a 14-day clock.[3]

One detail in the entry deserves attention: its forensicTriage field is No.[3] CISA does not require the compromise-hunting step here that it demands for some other entries. Treat that as an instruction to patch first, not as an assurance that nobody tried. The field also records ransomware campaign use as Unknown.[3]

And note the scope: BOD 26-04 binds US federal civilian agencies only. CISA's own alert says it "encourages all organizations" to adopt the same risk-based approach.[2][5] For an Indian business, the deadline is a benchmark, not a legal obligation — which is exactly why it is easy to ignore and expensive to ignore.

Where Guruji Corporation fits in

We do not sell firewalls and we are not a SonicWall partner. What we build is the boring layer underneath a decision like this: an asset register that actually carries firmware version, patch owner and last successful update for each device, a change window that accounts for the fact that a firewall upgrade takes the office's internet down for twenty minutes, and a mapping from vulnerability IDs to the specific assets they touch, so a KEV alert becomes a work order instead of a forwarded email.

Three questions we would ask any team on Monday morning, before the technical ones:

1. Which of our firewalls have SAML enabled for SSL VPN logins? If nobody can answer from a document, the answer is being discovered during an incident.
2. Which alternate authentication methods are still enabled on those devices, and who holds credentials for them? Every one of those principals is a candidate path around the SAML gate.
3. Who owns this patch, and what is the rollback if the upgrade drops the config? "The vendor will handle it" is not an owner.

If a device turns out to be Gen 6, the decision is not a patch decision at all — it is a hardware replacement with a date attached.[7]

Send a short project brief if you want the register, the owner matrix and the patch trail built against the equipment you already run.

Sources

• SonicWall PSIRT — SonicWall SonicOS Affected By Multiple Vulnerabilities (SNWLID-2026-0014, 6 November 2026)
• CISA — CISA Adds One Known Exploited Vulnerability to Catalog (6 November 2026)
• CISA — Known Exploited Vulnerabilities catalog feed, version 2026.11.06
• NVD — CVE-2026-19868
• CISA — Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk
• SonicWall — SonicOS 7.3.4 and 8.2.3 Security Advisory, Gen 7 and Gen 8 Firewalls