SonicWall VPN bug lets some logins skip SAML multi-factor checks

A control that is on is not always a control that holds

It is easy to treat multi-factor authentication as a switch. Once it is on, the login counts as protected. The SonicWall flaw tracked as CVE-2026-19868 shows the gap in that habit. The product was set up to demand a second check. In some cases it did not demand it.

This is the argument of this story. Turning on MFA is a claim. Proof comes from testing that the check applies to every way a person can sign in.

What SonicWall disclosed

SonicWall described the issue in advisory SNWLID-2026-0014. In its words, the problem is an authentication enforcement flaw in the SonicOS SSLVPN service. A person who holds valid credentials for a different sign-in method may get past SAML controls. SAML is a standard that lets a company's central identity system approve VPN logins.

The advisory adds that the same route may defeat MFA that SAML was meant to enforce. It rates the flaw 7.1 on the CVSS severity scale. It classifies the weakness as CWE-308, use of single-factor authentication.

That label suggests a login path that needs only one factor, even though SAML-enforced MFA was configured. This is our reading of the label. SonicWall has not published the exact login flow.

There is a limit on who is affected. SonicWall says the flaw matters only where SAML is enabled for SSLVPN logins.

SonicWall also says its product security team looked into a report pointing to possible exploitation. Its stated remedy is to move to the latest release quickly. The advisory names no workaround.

What the advisory leaves unsaid

The advisory does not name the alternate sign-in methods. It does not explain how the reported exploitation worked. The Hacker News reports that SonicWall gave no more detail on the attack or on who is behind it.

Those gaps are real. This source cannot fill them, and neither can we.

What the score tells a manager

The CVSS vector gives some context. It lists the attack as reachable over the network. It rates attack complexity as high, so conditions beyond the attacker's control must line up. It rates privileges required as low, which fits the wording above: the person needs a valid login of some kind.

So this is not a stranger walking in cold. It is someone who already holds a credential and uses it to avoid the second check. That is the situation MFA exists to stop.

SonicWall describes it as a product enforcement flaw and names an upgrade as the remedy.

CISA's listing and the deadline

The Hacker News reports that CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog. The outlet says federal civilian agencies should patch by November 20, 2026. That date binds those agencies only. Private firms set their own timelines, though the listing is a fair signal when they do.

Six other flaws in the same advisory

The advisory covers seven flaws. Two management-interface issues score 8.8. CVE-2026-107155 is a permissive cross-domain policy. CVE-2026-107154 is a session check that relies on IP address. SonicWall says either could, in specific conditions, let a remote attacker without a login perform unauthorized actions.

CVE-2026-82308, rated 7.5, is a memory flaw in the SSL-VPN service that could crash the application. Two TACACS+ client memory flaws, CVE-2026-77708 and CVE-2026-77709, are each rated 5.9. CVE-2026-19703 is weak password hashing on virtual appliances, rated 5.2. The advisory notes a report of possible exploitation for CVE-2026-19868 only.

The affected list spans Gen7 and Gen8 hardware firewalls and the NSv virtual line. Check the advisory for the exact products and fixed releases.

What leaders should ask their teams

Start with exposure. Is SAML enabled for SSLVPN logins on any SonicWall device we run? If not, SonicWall says this flaw does not touch that service. If so, schedule the upgrade first and confirm which release fixes it.

Then take the wider lesson. This is hygiene, not a fix for this bug. Ask which other sign-in methods work on your VPN, whatever they turn out to be. Ask whether each one meets the same MFA rule. Ask for an owner for each and a date to retire any that nobody needs.

Finally, ask whether the team can show from logs who signed in, and by which method, in recent weeks. The advisory lists no indicators of compromise. Teams may need to check their own records.

MFA should be judged by every way in, and by whether the product enforces it as promised.

Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: SonicWall.