SonicWall says valid logins for another method can skip SAML MFA on SonicOS SSL-VPN; CISA lists it exploited

Seven flaws, and the one under attack is not the top score

SonicWall's advisory SNWLID-2026-0014, first published on 6 November 2026 and titled "SONICWALL SONICOS AFFECTED BY MULTIPLE VULNERABILITIES", lists seven CVEs in the operating system of its firewalls. Its headline score is 8.8. The one flaw it says may have been exploited, CVE-2026-19868, is fourth of the seven on SonicWall's own scores, at 7.1 (derived). On the same day CISA added it, and only it, to its Known Exploited Vulnerabilities catalogue, with a due date of 20 November: 14 days (derived).

The catalogue release that carries the entry, version 2026.11.06, was released at 19:44 UTC, 41 minutes after the CVE record was published at 19:03 UTC (derived). CISA's enrichment on the record already said Exploitation: active. SonicWall's advisory says something softer: its product security team "has investigated a report indicating potential exploitation of this vulnerability."

The flaw itself is about a second way in. In SonicWall's words: "An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA)." A note adds that it "ONLY impacts" the SSL-VPN "if SAML is enabled for SSLVPN logins."

What none of this establishes: who exploited it, against how many firewalls, which alternate method was used, whether the credentials were stolen first, or when it started. SonicWall sells the firewalls and wrote the advisory; CISA runs the catalogue. This site read the advisory as saved from a browser at 10:36 UTC on 7 November 2026, and the seven CVE.org records, CISA's catalogue file and the NVD record between 10:39 and 10:42 UTC on Saturday 7 November 2026.

Two ways to sign in, one of them checked

The exposure is limited to organisations that put SAML in front of their SSL-VPN logins. The advisory's own phrase for that second factor is "SAML-enforced multi-factor authentication". The weakness is that, on affected versions, a user who holds valid credentials for some other authentication method may not be sent through those SAML controls at all. The record's weakness class says the same thing in two words of CWE: CWE-308, Use of Single-factor Authentication.

Zoom

Read the precondition carefully, because the headlines drop it. This is not a way past MFA with no password. The person on path two already has working credentials for the other method. What the flaw removes is the extra check the organisation thought every SSL-VPN login would meet. The advisory does not name the alternate methods, and this site does not guess which ones SonicOS offers or which was used in the reported case.

That makes the practical question one of inventory rather than of exploit mechanics: which authentication methods are switched on for your SSL-VPN users besides SAML, and which accounts hold credentials for them? An account that was meant to be reachable only through the identity provider, with its MFA, may also be reachable through that other door until the firewall is updated (this site's reading of the description).

"Potential exploitation" and a KEV listing: who says what

The words differ by source, and the difference matters when you brief a board or a client. SonicWall reports an investigated report of potential exploitation. CISA's catalogue listing is CISA's own determination that the flaw is exploited, and its enrichment marks it active. Neither publishes evidence. Of the two news reports this site read, BleepingComputer goes further in its verbs than SonicWall does; SecurityWeek stays closer to the advisory and is careful about the zero day question.

BleepingComputer and SecurityWeek are used here only for how the story is being told; every fact in this briefing comes from the advisory, the records or the catalogue. No primary calls CVE-2026-19868 a zero day, and SecurityWeek says it is unclear whether it was exploited before a patch existed. This site does not use the term.

One flaw, two scores

SonicWall's own entry in each CVE.org record, as the numbering authority, carries no CVSS score. The scores in the records sit in CISA's enrichment block. For five of the seven CVEs, CISA's score and vector match the advisory's exactly. For two they do not.

For CVE-2026-19868, SonicWall prints 7.1 with privileges required set to low. CISA's enrichment prints 7.5 with privileges required set to none. Every other metric is the same, so the whole difference is in that one field (derived). It is not a rounding question: it is the precondition itself. SonicWall scores the valid credentials as a privilege the attacker must already hold; CISA's vector does not. The advisory and the record do not explain either choice. NVD, which lists the record as Undergoing Analysis, carries only CISA's 7.5, so a scanner fed from NVD will show 7.5 while SonicWall's page shows 7.1.

For CVE-2026-19703, the virtual appliance hashing flaw, SonicWall prints 5.2 beside a vector that computes to 5.1 on CVSS 3.1 arithmetic (derived), and CISA's enrichment prints 5.1 for the same vector. The advisory also lists two weaknesses for it, CWE-916 and CWE-798, while the record lists only CWE-798. Neither difference changes what to do. Cite the source you mean.

All seven, as printed

The full list, in the advisory's order. SonicWall marks none of the other six as exploited, and CISA's enrichment says Exploitation none for each. The two 8.8 flaws are in the management interface, not the SSL-VPN, and both printed vectors mark user interaction as required; the advisory does not say whose. The advisory credits outside reporters for all seven, and every record marks discovery as external.

Why the deadline is 14 days and not 3

The due date follows from CISA's Binding Operational Directive 26-04, dated 10 June 2026, which binds US Federal Civilian Executive Branch agencies. Its Table 1 sets a remediation timeline from four answers: is the asset publicly exposed, is the flaw in the KEV, is it automatable by an adversary, and does exploitation give partial or total control. The last two answers are the SSVC values CISA publishes in each CVE record.

Zoom

CVE-2026-19868 is in the KEV, not automatable, with partial technical impact. That is row 4 if the firewall is publicly exposed and row 12 if it is not: 14 days either way, with no forensic triage (derived). The catalogue entry agrees: due 20 November, forensicTriage No. The directive says the words "& forensic triage" mean a three day timeline plus a check of whether the system is compromised; this entry does not carry them.

The same table applies to flaws that are not in the KEV, and that produces a result worth knowing. Under it, an exposed firewall with the two 8.8 management interface flaws gets the same 14 days as the exploited flaw (row 7), because CISA rates their technical impact total (derived). This mapping is this site's reading of CISA's table against CISA's published values; it binds only US federal civilian agencies.

Affected and fixed builds

Both generations are affected, hardware and virtual. The advisory gives one affected line and one fixed line per generation, and the CVE records repeat the affected lines for all seven CVEs. It names no earlier generation.

Stated, and not stated

The friendly name check

The label that does the most damage here is "MFA". An organisation that switched on SAML with MFA for its SSL-VPN could reasonably write "MFA enforced" in its control register. The advisory shows that the control was a property of one sign in path, not of the SSL-VPN as a whole. A control is what every path enforces, not what the preferred path enforces.

SonicOS in the catalogue before this

Counted from CISA's file (derived), CVE-2026-19868 is the 20th SonicWall entry in the catalogue and the fourth for SonicOS. The other three SonicOS entries, CVE-2020-5135, CVE-2024-40766 and CVE-2024-53704, all carry knownRansomwareCampaignUse Known. CVE-2024-53704 is described in its entry as an improper authentication flaw in the SSLVPN authentication mechanism. The new entry says Unknown, which records the absence of a stated link, not proof that there is none.

This site has covered two other SonicWall advisories this autumn, on different products: the end of life GMS console, whose two flaws will never be fixed, and the SMA1000 remote access appliances. CVE-2026-102255, the SMA1000 flaw in the second, was still not in the catalogue in release 2026.11.06.

What to do, in order

Items one, six and seven follow the advisory and CISA's records. Items marked as this site's suggestion do not come from SonicWall or CISA. No step here describes an attack.

Technical details

The advisory prints no configuration, no detection rules, no log lines and no indicators. What it and the public records do print is below, copied exactly. None of it is exploit detail. The first block is the advisory's overview, which is what a vulnerability manager matches against. Note that its headline vector is that of the 8.8 management interface flaws, not of the exploited one.

Advisory ID  SNWLID-2026-0014
First Published  2026-11-06
Last Updated  2026-11-06
Workaround  false
Status  Applicable
CVE  CVE-2026-77708, CVE-2026-77709, CVE-2026-82308, CVE-2026-107154, CVE-2026-107155, CVE-2026-19703, CVE-2026-19868
CWE  CWE-121, CWE-122, CWE-942, CWE-798, CWE-916, CWE-308, CWE-291
CVSS v3  8.8
CVSS Vector  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The advisory's entry for the exploited flaw, word for word. The NOTE line is the scoping test: if SAML is not enabled for SSLVPN logins, this CVE does not apply, though the other six still may.

4) CVE-2026-19868 - SSLVPN Authentication Enforcement Vulnerability via Alternate Authentication Methods

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

IMPORTANT: SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks.

NOTE: This vulnerability ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins.

CVSS Score: 7.1
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
CWE-308: Use of Single-factor Authentication

The record SonicWall filed as numbering authority. Times are UTC. The affected versions and the two platform names are what an asset inventory should match, and the entry has no metrics field.

cveId              CVE-2026-19868
state              PUBLISHED
assignerShortName  sonicwall
datePublic         2026-11-06T18:55:00.000Z
datePublished      2026-11-06T19:03:00.616Z
dateUpdated        2026-11-07T04:55:51.743Z
vendor, product    SonicWall, SonicOS
platforms          Gen7, Gen8
versions           7.3.3-7015 and older versions (affected); 8.2.2-8015 and older versions (affected)
problemType        CWE-308 Use of single-factor authentication
source             advisory SNWLID-2026-0014, discovery EXTERNAL
metrics            (none in the CNA container)

CISA's enrichment on the same record. These are CISA's judgements, not SonicWall's. The SSVC values are the inputs to the BOD 26-04 table above.

provider           CISA-ADP  (CISA ADP Vulnrichment)
cvssV3_1 vector    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
baseScore          7.5  HIGH
privilegesRequired NONE
ssvc timestamp     2026-11-06T00:00:00+00:00
Exploitation:      active
Automatable:       no
Technical Impact:  partial
role               CISA Coordinator
kev dateAdded      2026-11-06

The two score differences side by side. The labelled lines are derived by this site from CVSS 3.1 arithmetic; the vectors and printed scores are as published.

CVE-2026-19868, the same flaw scored twice
  SonicWall advisory  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N  printed 7.1
  CISA ADP            CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N  printed 7.5
  only metric that differs: PR (L against N)   (derived)

CVE-2026-19703, printed score against its own vector
  SonicWall advisory  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N  printed 5.2
  CVSS 3.1 arithmetic on that vector: 5.1   (derived)
  CISA ADP, same vector              printed 5.1

The catalogue entry as CISA prints it. This is what a feed reader or ticketing integration receives. The field to alert on is dueDate; forensicTriage No means the entry does not ask for a compromise check under the directive.

catalogVersion  2026.11.06
dateReleased    2026-11-06T19:44:45.1797Z

cveID: CVE-2026-19868
vendorProject: SonicWall
product: SonicOS SSLVPN
vulnerabilityName: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
dateAdded: 2026-11-06
dueDate: 2026-11-20
knownRansomwareCampaignUse: Unknown
forensicTriage: No
cwes: CWE-308
shortDescription: SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
requiredAction: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
notes:
  https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014
  BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
  Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
  https://nvd.nist.gov/vuln/detail/CVE-2026-19868

The NVD record, which many scanners read. It carries CISA's score as its only score.

id             CVE-2026-19868
vulnStatus     Undergoing Analysis
published      2026-11-06T19:17:48.437
cisaExploitAdd 2026-11-06
cisaActionDue  2026-11-20
cvssMetricV31  source 134c704f-9b21-4f2e-91b3-4a467353bcc0 (CISA-ADP), type Secondary
               CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N  baseScore 7.5
weaknesses     CWE-308, source PSIRT@sonicwall.com

The question the advisory leaves open

SonicWall has told customers that a user with valid credentials for another method may have walked past the SAML check, and the MFA behind it, on their SSL-VPN, and CISA says that has happened somewhere. The update closes the gap from here on. It cannot tell you what came through it before. If your control register says MFA is enforced on remote access, which sign in methods did your firewall actually accept last month, and which of those logins never saw your identity provider?

Key facts