SockAnalyst
← All playbooks
HighExploited vuln · 2026-11-07

SonicWall SonicOS SSL-VPN flaw (CVE-2026-19868) lets attackers bypass SAML and MFA; exploited, on CISA KEV

SockAnalyst · Security+ certified analyst.

What happened

On November 6, 2026 SonicWall published advisory SNWLID-2026-0014 fixing seven SonicOS vulnerabilities. The headline bug, CVE-2026-19868 (CVSS 7.1), is an authentication-enforcement flaw in the SonicOS SSL-VPN service: a user with valid credentials for an alternate authentication method can bypass SAML authentication controls, including SAML-enforced multi-factor authentication. SonicWall PSIRT says it investigated a report indicating potential exploitation, and CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog the same day. Neither has published attack details, and it is unclear whether it was exploited before the patch. The same advisory also fixes six other SonicOS issues, including two management-interface flaws rated 8.8. There are no workarounds.

Who's affected

Organizations running SonicWall Gen7 TZ, NSa, NSsp and NSv firewalls on SonicOS 7.3.3-7015 or older, or Gen8 TZ, NSa and NSv on SonicOS 8.2.2-8015 or older, with SAML-based SSL-VPN login enabled. Anyone relying on SAML/IdP MFA as the hard gate for VPN access.

✅ Fix / patch

  • Upgrade to SonicOS 7.3.4-7013 (Gen7) or 8.2.3-8015 (Gen8) or later now; SonicWall says there is no workaround.
  • Patch even if you don't use SAML SSL-VPN, since the same advisory fixes two 8.8-rated management-interface flaws; keep the management interface off the internet.
  • Review recent SSL-VPN logins for successes through local, LDAP or RADIUS auth on accounts that should be SAML-only, and disable alternate auth methods you don't need.
  • Rotate credentials for accounts able to reach the SSL-VPN and investigate any suspicious sessions before closing out.

🔎 Quick hunt check

No IOCs published. Hunt for SSL-VPN logins on SAML-enforced accounts that succeeded without an IdP (SAML) assertion or matching MFA event, new source IPs/ASNs for VPN users, and VPN sessions followed by internal scanning or RDP/SMB from the VPN pool.

MITRE ATT&CK: T1133, T1078, T1556, T1190

IOCs

No IOCs (IPs, domains or hashes) published by the sources yet.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

index=firewall sourcetype="sonicwall*" (msg="*SSL VPN*" OR msg="*SSLVPN*") (msg="*login*" OR msg="*logged in*")
| eval auth_method=coalesce(auth_method, auth, method)
| search NOT auth_method="*SAML*"
| lookup saml_only_vpn_users user OUTPUT saml_only
| where saml_only="true" OR isnull(auth_method)
| stats count min(_time) as first max(_time) as last values(src) as src_ip values(auth_method) as auth_method by user, dvc
// SSL-VPN successes for SAML-only users that did NOT go through SAML = possible CVE-2026-19868 bypass
let vpn = CommonSecurityLog
| where TimeGenerated > ago(30d) and DeviceVendor has "SonicWall"
| where Activity has_any ("SSL VPN","SSLVPN") and Activity has_any ("login","logged in")
| extend User = tolower(coalesce(SourceUserName, DestinationUserName))
| project VpnTime=TimeGenerated, User, SourceIP, DeviceName, Activity;
let idp = SigninLogs
| where TimeGenerated > ago(30d) and ResultType == 0
| extend User = tolower(UserPrincipalName)
| project IdpTime=TimeGenerated, User;
vpn
| join kind=leftouter idp on User
| where isnull(IdpTime) or abs(datetime_diff('minute', VpnTime, IdpTime)) > 10
| summarize Logins=count(), FirstSeen=min(VpnTime), LastSeen=max(VpnTime), IPs=make_set(SourceIP) by User, DeviceName
// VPN logins with no matching IdP/SAML sign-in near the same time

See all hunt queries →

⏱ CISA deadline

CVE-2026-19868CVSS 7.5 High (v3.1, CNA)
--
Federal due 2026-11-20 · CISA KEV catalog

Sources

Related playbooks

Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.

Weekly email; daily brief on the website.

Subscribe free

Read the free weekly pack →