Irish-owned since 2006 ISO 27001:2022 certified
Careers Client support
01 223 9000
High: actively exploitedPatch available

SonicWall SonicOS: SSL VPN flaw lets attackers get past SAML sign-in and MFA

Published 7 November 2026 · Nostra

At a glance

Affects
SonicWall Gen7 and Gen8 firewalls (TZ, NSa, NSsp, NSv) using SSL VPN with SAML sign-in
Risk
Someone with a valid username and password for another sign-in method may bypass SAML checks, including SAML-enforced MFA
Exploited?
Yes. Listed by CISA as known exploited on 6 Nov 2026
Vulnerable
Gen7: SonicOS 7.3.3-7015 and older. Gen8: 8.2.2-8015 and older
Fix
Gen7: SonicOS 7.3.4-7013 or later. Gen8: 8.2.3-8015 or later
Workaround
None. SonicWall says to upgrade
Reference
SNWLID-2026-0014 · CVE-2026-19868 (CVSS 7.1)

What's happened

On 6 November 2026 SonicWall published an advisory covering seven flaws in SonicOS, the software that runs its firewalls. One of them, CVE-2026-19868, affects SSL VPN when sign-in uses SAML (for example Microsoft Entra ID single sign-on). A person who already holds valid credentials for another sign-in method may be able to get past the SAML step, including any MFA enforced through it.

SonicWall says it has investigated a report of possible exploitation, and the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of known exploited vulnerabilities the same day. That's why we're treating it as urgent.

The same update fixes six other issues, including two in the management interface rated 8.8 and pre-authentication crashes in the SSL VPN service and the TACACS+ client. None of these is reported as exploited.

Am I affected?

  • You have a SonicWall Gen7 or Gen8 firewall, and
  • Staff connect remotely with SSL VPN (NetExtender or Mobile Connect), and
  • VPN sign-in goes through SAML / single sign-on.

If all three are true, you are exposed to the exploited flaw. Even if you don't use SAML, update anyway to close the other six issues.

What to do now

  1. Check your SonicOS version on the firewall's dashboard (Device › Settings › Firmware and Settings).
  2. Upgrade to 7.3.4-7013 or later (Gen7) or 8.2.3-8015 or later (Gen8). Plan a short outage: the firewall restarts.
  3. Review VPN sign-ins for unusual times, locations or accounts.
  4. Limit management access to trusted internal addresses, never the open internet. Good practice regardless.

If Nostra manages your firewall

Our team is reviewing managed SonicWall firewalls and will contact you if yours needs an update. Questions? Call 01 223 9000.

Not a Nostra customer?

As SonicWall Partner of the Year 2022–2025, we can check and update your firewall for you. Ask for a SonicWall check or call 01 223 9000.

Also this week: SonicWall GMS will not be fixed

SonicWall has disclosed two flaws in its Global Management System (GMS), which reached end of life in October 2025. They will not be patched. If you still run GMS, take it off the internet and plan a move to a supported platform.

Sources

Update log

  • First published.