SonicWall SAML MFA Bypass Changes Remote Access Risk

An actively exploited SonicWall SAML MFA bypass, CVE-2026-19868, can let someone who already holds credentials for another login method skip SAML checks on SonicOS SSL VPN, including SAML-enforced multi-factor authentication. CISA’s Known Exploited Vulnerabilities catalog added the flaw on November 6, 2026, with a November 20 due date for federal agencies under Binding Operational Directive 26-04. The practical reading for hybrid identity is that a firewall still willing to accept an alternate method can undo the MFA policy the identity provider was meant to enforce.

Updated November 7, 2026

What does the SonicWall SAML MFA bypass actually change?

CISA lists the issue as use of single-factor authentication, CWE-308. SecurityWeek and BleepingComputer each report a CVSS score of 7.1. As SecurityWeek reported from the vendor advisory, a user with valid credentials for an alternate authentication method may bypass SAML controls, and exploitation may also bypass SAML-enforced MFA. The vendor says an SSL VPN is exposed only if SAML-based login is enabled.

Ryan Harris of The Electronic Office reported the bug, one of seven SonicOS flaws in a November 6 advisory. BleepingComputer quoted the company: “SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability.” Ransomware use is listed as unknown, and forensic triage is not required.

Neither SonicWall nor CISA has published attack details, so this analysis treats the upgrade as the immediate control. There are no workarounds. Fixed builds are SonicOS 7.3.4-7013 and 8.2.3-8015.

Which builds share the November 6 advisory?

Affected devices include Gen7 TZ, NSa, NSsp, and NSv firewalls on SonicOS 7.3.3-7015 or older, and Gen8 TZ, NSa, and NSv firewalls on 8.2.2-8015 or older. SonicWall does not mark the other six as exploited. Two management-interface bugs, each scored 8.8, a permissive cross-domain policy issue and a session validation bug, can allow unauthorized actions without a login under certain conditions. Three pre-authentication buffer overflows can cause application-level denial of service, and a weak hashing flaw on virtual appliances can expose a platform credential to an attacker who already has high-privileged local access.

How does this compare with earlier SonicWall VPN attacks?

That same reporting noted the warning follows attacks on SMA1000 secure remote access appliances. In October, researchers detected attempts against CVE-2026-102255, a maximum-severity flaw that could allow unauthenticated attackers to access internal functionality and perform unauthorized operations. Those attempts followed September attacks that chained two SMA1000 zero-days for remote code execution, and July attacks that used two other zero-days to deploy malware.

SecurityWeek reported that CISA’s catalog currently includes 20 SonicWall security holes, and that the agency has yet to add CVE-2026-102255, which hackers started targeting last month, days after disclosure. Of those SMA1000 cases, only the October CVE-2026-102255 attempts are described as unauthenticated. CVE-2026-19868 requires valid credentials for an alternate authentication method. The vendor result is a bypass of SAML controls, including SAML-enforced MFA.

What should remote-access design change before November 20?

Federal civilian executive branch agencies must secure affected systems by November 20, 2026. CISA’s KEV action also tells stakeholders to apply vendor mitigations, evaluate each asset’s internet exposure, and follow applicable BOD 26-04 guidance for cloud services or discontinue use if mitigations are unavailable. Beyond the build number, this analysis points to four design checks:

• Confirm which Gen7 and Gen8 firewalls expose SSL VPN with SAML login; that is the condition SonicWall tied to exposure.
• Upgrade to 7.3.4-7013 or 8.2.3-8015, and do not plan on a workaround.
• Treat every alternate authentication method as in scope, because the bypass needs valid credentials for that method.
• Include the other six advisory flaws in the same window, especially the two unauthenticated management-interface issues scored 8.8.

This analysis suggests a design test: if the appliance can still finish a login that never reaches the identity provider, SAML-enforced MFA is optional on that path. Apply that test to other edge devices added to the KEV catalog, and treat CISA deadlines on firewall flaws as patch clocks rather than the start of exposure.