SonicWall SSLVPN CVE-2026-19868: MFA Bypass and What to Do
Contents9
On 6 November 2026, SonicWall disclosed seven vulnerabilities in SonicOS, the operating system of its firewall products. On the same day, the US CISA added one of them, CVE-2026-19868, to its list of "known exploited vulnerabilities". The issue may allow SAML-based multi-factor authentication (MFA) to be bypassed at SSL-VPN login.
This article is for companies that use SonicWall firewalls. It explains the affected devices and versions, how to update, what you can do until you update, and how to look for signs of an attack. Companies that think "we have MFA, so we're safe" are exactly the ones that should check.
Key takeaways
- Affected versions are Gen7 7.3.3-7015 and older, and Gen8 8.2.2-8015 and older. The fixed versions are 7.3.4-7013 or later, and 8.2.3-8015 or later.
- CVE-2026-19868 affects you only if you use SAML for SSL-VPN login.
- SonicWall's notice lists the workaround as "none". Updating is the main response.
- The same notice also includes six other issues, such as problems in the management screen (severity 8.8). Update even if you don't use SAML.
7
Vulnerabilities disclosed in the same notice
7.1
Severity of CVE-2026-19868 (CVSS v3)
20 November
Deadline set for US federal agencies to respond (2026)
Terms used here
SSL-VPN = a way to get into the company network securely over the internet from outside the company.
SAML = a mechanism that lets you use several services with a single login. It is used for connecting with services such as Microsoft Entra ID.
MFA (multi-factor authentication) = a way of confirming identity using something such as a smartphone app in addition to a password.
KEV = a list published by the US CISA of "vulnerabilities confirmed to have actually been exploited".
What is the flaw, and why does it matter?
CVE-2026-19868 is a problem with how SSL-VPN checks authentication. According to SonicWall's explanation, someone who has a valid ID and password that work with another authentication method may be able to bypass the SAML authentication check, and MFA enforced through SAML could possibly be bypassed as well.
In other words, if for example a password leaked in the past is still valid, the assumption that "no one can get in because we have MFA" falls apart. However, an attack requires valid credentials, so this is not a problem that lets just anyone in. Also, SSL-VPN without SAML enabled is not affected by this vulnerability.
| CVE ID | Description | Severity |
|---|---|---|
| CVE-2026-19868 | SAML authentication and MFA may be bypassed on SSL-VPN. Exploitation has been reported | 7.1 |
| CVE-2026-107155 | A problem with the cross-domain settings of the management screen. Under certain conditions, unauthorised operations may be carried out | 8.8 |
| CVE-2026-107154 | A problem with session checks in the management screen. Under certain conditions, unauthorised operations may be carried out | 8.8 |
| CVE-2026-82308 | The service may be brought down through SSL-VPN before login | 7.5 |
| CVE-2026-77708 / 77709 | The service may be brought down through TACACS+ authentication | 5.9 |
| CVE-2026-19703 | Weak password storage method on virtual appliances (attack from local access) | 5.2 |
Exploitation status (as of 8 November 2026)
In its notice, SonicWall says it has investigated reports indicating possible exploitation, and it strongly recommends updating as soon as possible. On 6 November, CISA added this vulnerability to its list of confirmed exploitation (KEV) and required US federal agencies to respond by 20 November.
The scale of the attacks, the attackers and any damage in Japan are not mentioned in the official information we could confirm. Also, this issue was not found in the IPA and JPCERT/CC lists of alerts (checked on 8 November).
Affected devices and versions to update to
| Generation | Main models | Affected versions | Fixed version |
|---|---|---|---|
| Gen7 (hardware) | TZ 270–670, NSa 2700–6700, NSsp 10700–15700 | 7.3.3-7015 and older | 7.3.4-7013 or later |
| Gen7 (virtual) | NSv 270, 470, 870 | 7.3.3-7015 and older | 7.3.4-7013 or later |
| Gen8 (hardware) | TZ 80–680, NSa 2800–5800 | 8.2.2-8015 and older | 8.2.3-8015 or later |
| Gen8 (virtual) | NSv XS, S, M, L | 8.2.2-8015 and older | 8.2.3-8015 or later |
※ Gen6 and earlier models are not listed among the products covered by this notice. Check their support status with SonicWall or your reseller.
Five steps to check and respond
- Check the device and version
Check the model and the SonicOS version on the management screen. If you don't know who manages it, ask your reseller or maintenance company.
- Check the SAML setting for SSL-VPN
Whether CVE-2026-19868 affects you depends on whether you use SAML for SSL-VPN login.
- Update to the fixed version
Back up the settings before updating. Do it outside business hours, and after the update confirm that you can connect to the VPN.
- Review your accounts
Delete the accounts of people who have left and accounts no longer in use. For accounts that can get in by methods other than SAML, check whether they are really needed, and change their passwords.
- Check the login records
Go through the checklist below. If anything looks suspicious, consult a specialist company.
If you can't update right away
SonicWall's notice lists the workaround as "none". The following are general ways to reduce the risk and are not a substitute for updating.
- Restrict the locations (IP addresses) that can connect to the SSL-VPN as far as possible
- Make sure the management screen cannot be opened from the internet
- Stop any SSL-VPN you are not using
How to look for signs of an attack
SonicWall's notice does not include definitive markers such as the attackers' IP addresses. The following items are therefore only a guide.
- Has anyone who should log in with SAML logged in to the SSL-VPN using a different authentication method?
- Are there logins from unusual countries or at unusual times?
- Are there accounts or setting changes you don't recognise?
- After VPN connections, are suspicious connections spreading to internal servers?
A record in the log does not necessarily mean someone got in. The approach to checking VPN devices is also explained in "What to Do About the Ivanti Vulnerabilities".
A VPN device is your company's front door
VPN devices sit at the entrance to the internal network, which makes them attractive targets for attackers. Damage in Japan since October 2026 is summarised in "Japan Data Breaches: Early November 2026". If you have no one in charge, or don't know what your maintenance covers, see also "Taking Over a Legacy System With No Documentation".
Leave it, or act now?
If you leave it
- Even with MFA set up, it may be bypassed
- Someone may get into your network using leaked credentials
- The management screen problems also remain
If you update and inspect
- All seven issues are fixed together
- Unused accounts are gone
- You can check whether there are signs of an intrusion
How Digi Dinos can help
Digi Dinos is a company that supports DX, security, and the operation and maintenance of systems. We are ISO 27001 certified, and we also handle server and cloud operations and monitoring 24 hours a day, 365 days a year (NOC). Our team works in Japanese.
- Asset inventory: we sort out which devices are running which versions and who manages them.
- Support for planning and carrying out updates: even for systems that can't be stopped, we decide the procedure and timing and move forward.
- Taking over monitoring and operations: we can also take over the operation of systems that were managed by another company.
Is your VPN safe? Even a simple question is welcome (free consultation).
From checking your devices to planning the update, with guidance in Japanese.
Frequently asked questions
We don't use SAML for SSL-VPN. Do we need to update?
CVE-2026-19868 does not affect you, but the same notice also covers other issues in the management screen and SSL-VPN. Update.
If we use MFA, aren't we safe?
MFA is a very effective measure, but in this case it is said that MFA enforced through SAML may be bypassed. You need to update to the fixed version.
Has there been any damage in Japan?
As of 8 November 2026, the official information we could confirm makes no mention of damage in Japan. However, we cannot say that there is no undisclosed damage.
Sources (checked on 8 November 2026)
Related articles
Japan Data Breaches, Early November 2026: A Summary
Arara Message Breach Update: About 81 Million Email Addresses
Apache Tomcat Vulnerabilities, October 2026: 8 Flaws and Fixes
.NET 8 and 9 End of Support on 10 November 2026: What to Do
Movable Type Vulnerability JVN#91153973: Update or Mitigate Now
WordPress CVE-2026-119977: Listed as Exploited, Update Now
Japan Data Breaches, Oct–Nov 2026: What Companies Should Check
Ivanti Connect Secure Zero-Days: Update Again and Investigate
GitLab CVE-2026-97229 (CVSS 10): Exploited, Patch Now
Linux Kernel Fragnesia (CVE-2026-46300): Exploited, Patch Now
Brotli Vulnerability CVE-2026-111497 (HTTP2Shell): What to Do
PHP Vulnerability CVE-2026-109618 (PHP2shell): What to Do Now
PHP Upgrade Cost: Moving From PHP 5 or 7 to PHP 8
Taking Over a Legacy System With No Documentation
Node.js Security Release, October 2026: What to Do
Java Vulnerabilities, October 2026: IPA Alert and Licence Changes
Securing Legacy Systems: Where to Start (2026 EOL Guide)
Superior Features of ChatGPT 4o (4 Omni)
What Is Digital Transformation? Definition, Roadmap and Examples
The Secret to Happiness!
What Is an IT Comtor? Role, Skills and How It Differs from a BrSE
