A SonicWall MFA bypass in the SonicOS SSL-VPN lets some users skip SAML sign-in and the multifactor check that comes with it. All they need is a valid password for a second sign-in method. SonicWall published fixed firmware on November 6, 2026, and says it investigated a report of possible exploitation. CISA added the flaw, CVE-2026-19868, to its Known Exploited Vulnerabilities catalog the same day.
SonicWall firewalls are common at nonprofits, associations and schools, and an MSP often runs them. This post covers what SonicWall’s advisory says and which firmware is affected and fixed. It also covers the workaround and the checks to run after you patch. Facts are as of November 10, 2026. New to CVE numbers and KEV listings? Our guide on how to read a CVE, CVSS, EPSS and KEV covers the terms.
The short version: if your SonicWall uses SAML for SSL-VPN logins, update to SonicOS 7.3.4-7013 or later on Gen7, or 8.2.3-8015 or later on Gen8. If you cannot update now, disable any LDAP, RADIUS and TACACS+ servers on the firewall. Then compare recent VPN logins against your identity provider’s sign-in log. Reset passwords for any account that logged in without going through SAML.
What SonicWall says about the SonicWall MFA bypass
SonicWall’s security advisory SNWLID-2026-0014 covers seven SonicOS flaws. The one in the KEV catalog is CVE-2026-19868. SonicWall calls it an authentication enforcement flaw. Per the advisory, it "may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls" in the SSL-VPN service. Exploitation "may also bypass SAML-enforced multi-factor authentication (MFA)," SonicWall says.
The advisory carries a warning in capital letters. It says SonicWall PSIRT "has investigated a report indicating potential exploitation of this vulnerability" and urges customers to upgrade. It has not described the attacks or who is behind them.
There is one important limit. Per SonicWall, the flaw "ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins" on the firewall. If your VPN users sign in with LDAP or RADIUS alone, this specific bug does not apply. The other flaws in the same advisory still do.
SonicWall rates CVE-2026-19868 at CVSS 7.1. The CVE record lists 7.5 with a different vector. Either way it is rated High, and the KEV listing matters more than the score.
How the SonicWall MFA bypass works, in plain terms
Many organizations moved their SonicWall VPN to SAML so that staff sign in through Microsoft Entra ID, Okta or Google. The identity provider then enforces MFA. Older setups often left an LDAP, RADIUS or TACACS+ server configured on the firewall from before the move.
Going by SonicWall’s description and workaround, a valid password for one of those older methods is enough to log in to the VPN directly. That path never reaches the identity provider, so the MFA prompt never happens. A stolen or reused Active Directory password could be enough.
This is why the fix and the workaround both matter for the SonicWall MFA bypass. The firmware update closes the gap. Removing the leftover authentication servers removes the second path entirely.
SonicOS versions affected by the SonicWall MFA bypass
The advisory lists these platforms and versions:
| Platform | Models | Affected | Fixed |
|---|---|---|---|
| Gen7 hardware | TZ 270 to TZ 670, NSa 2700 to 6700, NSsp 10700 to 15700 | 7.3.3-7015 and older | 7.3.4-7013 and higher |
| Gen7 NSv | NSv 270, 470, 870 (ESX, KVM, Hyper-V, AWS, Azure) | 7.3.3-7015 and older | 7.3.4-7013 and higher |
| Gen8 hardware | TZ 80 to TZ 680, NSa 2800 to 5800 | 8.2.2-8015 and older | 8.2.3-8015 and higher |
| Gen8 NSv | NSv XS, S, M, L (ESX, KVM, Hyper-V, AWS, Azure) | 8.2.2-8015 and older | 8.2.3-8015 and higher |
The advisory lists Gen7 and Gen8 only. It does not mention Gen6 firewalls. If you still run a Gen6 unit, ask SonicWall or your reseller where it stands.
The same advisory fixes two management interface flaws rated 8.8 (CVE-2026-107155 and CVE-2026-107154). It also fixes a pre-authentication SSL-VPN overflow that can crash the service (CVE-2026-82308, rated 7.5). Two TACACS+ overflows and a weak password hashing flaw on virtual appliances round out the list. One update covers all of them.
What the KEV listing means for you
CISA’s KEV catalog entry for CVE-2026-19868 shows it was added November 6, 2026. The due date is November 20. The entry lists ransomware use as "Unknown."
The due date binds federal civilian agencies under Binding Operational Directive 26-04. CISA’s November 6 alert says the directive applies only to those agencies. It also says CISA "encourages all organizations" to prioritize KEV fixes. For a nonprofit or association, treat November 20 as a sensible outside limit, not a target.
VPN flaws have a track record here. Our post on the GlobalProtect vulnerability shows how a remote access bug turned into a ransomware entry point months after the patch. If you are deciding what to patch first, our explainer on EPSS scores shows how to weigh exploit likelihood next to KEV.
Step 1: Check your firmware and SAML setup
Start by answering two questions for each firewall.
- Which SonicOS version is it running? SonicWall’s knowledge base shows the current firmware in MySonicWall under Product Management | My Products. Select the serial number, then the Firmware icon. The firewall’s own dashboard also shows it.
- Does SSL-VPN use SAML? If yes, check whether any LDAP, RADIUS or TACACS+ server is still active on the same firewall. That combination is the exposed setup.
If an MSP manages your firewall, send them both questions today. Ask for the answer in writing with the version number.
Step 2: Update SonicOS firmware
SonicWall’s firmware upgrade article lays out the steps:
- Back up first. Go to Device > Settings | Firmware and Settings, choose Import/Export Configuration and export the .EXP file. Then create a local backup on the same page.
- Download the firmware. In MySonicWall, open the device, select the Firmware icon, then Browse All Firmware. Read the release notes and the upgrade path support matrix.
- Upload and boot. Back on Firmware and Settings, choose Upload Firmware, select the .SIG file, then boot the uploaded firmware with the current configuration.
SonicWall says the upgrade takes about five to eight minutes. Devices behind the firewall lose internet access while it restarts, so plan a short maintenance window.
Step 3: Block the SonicWall MFA bypass if you cannot update yet
SonicWall updated the advisory on November 9 with a workaround for CVE-2026-19868. If SAML is in use and you cannot upgrade, disable or delete any active LDAP, RADIUS and TACACS+ authentication server on the firewall. The paths start at Device > Users > Settings > Authentication, then Configure RADIUS, Configure LDAP or Configure TACACS+.
Check first whether anything else depends on those servers, such as admin logins or older VPN profiles. Removing them can lock out a fallback admin account. Keep a local admin account with a strong password before you change anything.
Step 4: Review VPN logins and reset passwords
Patching closes the gap going forward. It does not tell you whether someone already used the SonicWall MFA bypass. These checks are general practice, not steps from SonicWall’s advisory.
- Match VPN logins to identity provider sign-ins. Every SSL-VPN session for a SAML user should have a matching sign-in in Entra ID, Okta or Google. A VPN session with no matching sign-in is the pattern to look for.
- Look at the last few weeks. Export SSL-VPN login events from the firewall or your log collector. Note the user, source IP and time.
- Reset passwords for any account that shows up. Also reset any shared or service account used for LDAP binds. If the password is reused elsewhere, change it there too.
- Check what the session did. Look for new admin accounts, new VPN users and remote desktop logins from the VPN address pool.
Found a login you cannot explain? Follow your data breach response plan. Bring in your MSP or cyber insurer early.
Step 5: Enforce MFA in one place
The deeper lesson of this SonicWall MFA bypass is that MFA only counts if every route goes through it. After updating, test it. Try a VPN login with a directory password alone and confirm it fails.
Remove sign-in methods you no longer use, on the firewall and elsewhere. Make sure MFA is enforced at the identity provider, not left to each app. Our explainer on multi-factor authentication covers the options. Our post on passkeys covers phishing-resistant sign-in for staff accounts.
For background on what the VPN itself does, see what a VPN is and why you would use one.
What we do not know yet
As of November 10, several questions remain open:
- Who is exploiting it. SonicWall has not said who is behind the activity or how many devices were hit.
- Gen6 status. The advisory does not mention Gen6 firewalls.
- Ransomware links. CISA lists ransomware use as unknown.
The Hacker News reported the KEV listing on November 9. It also noted that SonicWall had not shared attack details. We will update this post if SonicWall adds details about the SonicWall MFA bypass.
Frequently Asked Questions
What is the SonicWall MFA bypass?
It is CVE-2026-19868, a flaw in the SonicOS SSL-VPN. A user with valid credentials for a second sign-in method, such as LDAP or RADIUS, can skip SAML authentication and the MFA that SAML enforces.
Is the SonicWall MFA bypass being exploited?
SonicWall says it investigated a report of potential exploitation. CISA added it to the KEV catalog on November 6, 2026, which it does when there is evidence of active exploitation.
Which firmware fixes the SonicWall MFA bypass?
SonicOS 7.3.4-7013 or later on Gen7 firewalls and NSv, and 8.2.3-8015 or later on Gen8 firewalls and NSv, according to SonicWall’s advisory.
Am I affected if I do not use SAML for the VPN?
SonicWall says this flaw only affects SSL-VPN when SAML is enabled for SSL-VPN logins. You should still update, because the same advisory fixes other flaws, including two rated 8.8.
What is the workaround?
If SAML is in use and you cannot upgrade, SonicWall says to disable or delete any active LDAP, RADIUS and TACACS+ authentication servers on the firewall.
What is the November 20 deadline?
It is the KEV due date for federal civilian agencies. It does not bind nonprofits or private companies, but it is a reasonable outside limit for anyone.
How long does the firmware update take?
SonicWall says about five to eight minutes. Internet access for devices behind the firewall drops while it restarts.
How do I tell if someone used the bypass?
Compare SSL-VPN logins with your identity provider’s sign-in log. A VPN session for a SAML user with no matching sign-in deserves a closer look and a password reset.
Are Gen6 SonicWall firewalls affected?
The advisory lists only Gen7 and Gen8 platforms and does not mention Gen6. Check with SonicWall or your reseller if you still run Gen6 hardware.
