SonicWall SonicOS MFA Bypass: Patch and Review
A SonicWall SonicOS MFA bypass is now on CISA’s list of exploited vulnerabilities. CVE-2026-19868 lets someone who holds valid credentials for an alternate sign-in method skip SAML on the SSL-VPN, and with it the multi-factor step. SonicWall published fixed firmware on November 6. As of November 9, its advisory also lists a workaround for anyone who cannot update yet: if SAML is in use, disable or delete any active LDAP, RADIUS and TACACS+ authentication servers on the firewall.
What Happened With the SonicWall SonicOS MFA Bypass
SonicWall’s advisory of November 6 covers seven SonicOS flaws. The one under attack is CVE-2026-19868 (CVSS 7.1; The Hacker News also quotes 7.5). Per SonicWall, a user with valid credentials for an alternate authentication method can bypass SAML authentication controls on the SSL-VPN service, potentially including SAML-enforced MFA. The SonicWall SonicOS MFA bypass only affects SSL-VPN configurations that use SAML. Ryan Harris of The Electronic Office reported it.
SonicWall says its PSIRT investigated a report indicating potential exploitation. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 6, which confirms exploitation in the wild, and set November 20 as the deadline for US federal agencies (per BleepingComputer). As of November 9, neither SonicWall nor CISA has described the attacks or named an actor.
Affected are SonicOS Gen7 up to 7.3.3-7015 and Gen8 up to 8.2.2-8015. The fixes are 7.3.4-7013 and 8.2.3-8015. The same release closes six more flaws, including two management-interface issues rated CVSS 8.8 (CVE-2026-107155 and CVE-2026-107154) that SonicWall says could let an unauthenticated attacker perform unauthorized operations under specific conditions.
Why It Matters
A VPN is only as strong as its weakest login path. The MFA you configured and audited lives at the identity provider, but the firewall decides whether to ask for it. If a second login method skips that step, the control exists on paper only. SonicWall does not say which alternate methods are meant. Assumption: many SME firewalls keep a local or RADIUS login enabled next to SAML, for admins or as a fallback.
The attacker still needs a valid credential for that other method, so a password from an infostealer or an old phishing campaign can be enough. For NIS2-covered companies, MFA on remote access is a baseline expectation, and a gap at the enforcement point is something you must be able to show you checked. This is the third SonicWall advisory in about a month: the maximum-severity SMA1000 flaw we covered on October 14, end-of-life GMS flaws that will not get patches, and now SonicOS. We made a similar point about network devices in our Zyxel GS1900 post.
What You Should Do Now
- List your SonicOS firewalls and read the firmware version. Update Gen7 to 7.3.4-7013 or newer and Gen8 to 8.2.3-8015 or newer; the same upgrade closes the other six flaws. Check your model against SonicWall’s advisory.
- Find out whether SAML is enabled for SSL-VPN logins. If it is, list every other authentication method still active for VPN users and switch off those you do not need.
- Compare SSL-VPN logins with your identity provider’s sign-in log. A VPN session without a matching sign-in event at the identity provider is the one to investigate. We have not found published indicators for this flaw as of November 9; check SonicWall’s advisory for updates.
- If a firewall ran an affected build with SAML on the SSL-VPN, reset the passwords and revoke the sessions of any account with unusual VPN activity.
DIESEC Perspective
We would not read the CVSS 7.1 as low priority. The score reflects the conditions (valid credentials, SAML enabled), but CISA’s listing puts this flaw in the same queue as the critical ones. The more useful exercise is to find every place where a second login path undermines the MFA you report to auditors.
Not sure whether your VPN enforces MFA on every login path? Contact DIESEC for a VPN and MFA configuration review.
Sources: CISA | BleepingComputer | The Hacker News | heise
Published: 2026-11-10 | Category: Vulnerabilities & Patches | ~4 min read
