SonicWall SAML bypass: what to check tonight

Originally published at tothenoc.substack.com CVE-2026-19868 is on CISA's exploited list. The patch is the fix. Here is what to look at around it. On November 6 SonicWall published advisory SNWLID-2026-0014: seven SonicOS flaws, one of them exploited. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with November 20 as the deadline for US federal agencies. The exploited one is CVE-2026-19868. If your SSL-VPN uses SAML for login, a user with valid credentials for another authentication method can skip SAML. And SAML is usually where your MFA lives. So the MFA was not broken. It was never asked. Who is affected: Gen7 (TZ, NSa, NSsp, NSv) on SonicOS 7.3.3-7015 and older Gen8 on 8.2.2-8015 and older only if SAML is enabled for SSL-VPN logins Fixed in 7.3.4-7013 and 8.2.3-8015. No workaround. Patch. That is the fix. Everything below is what you do around it, not instead of it. Before the upgrade: export the config, keep the current firmware at hand for rollback, and pick a window, VPN users will drop. Look at what else can log in to the SSL-VPN. The bug lives in the gap between SAML and "the other method": local users, LDAP, RADIUS. Many boxes still have local accounts from the first setup, a service account, an old admin. Each one is a door next to the SAML door. Take out of the SSL-VPN groups everything that does not need to be there. It does not fix the bug. It makes the door smaller. Read the logs backwards. For the SSL-VPN logins of the last weeks, look at the authentication source: local, LDAP or SAML. A login that should have come through SAML and did not is the thing to explain. If you cannot explain it, it is an incident, not a patch ticket. After the upgrade, test it. Log in through SAML: is MFA asked? Then try an account from the other method. Write down what you saw. "Patched" in a ticket is a statement. The test is the proof. The same release fixes six more flaws, two of them in the management interface, rated 8.8. If your management interface faces the internet, that is a second reason not to wait. If a login in those logs has no explanation and you want a second pair of eyes on it: emergency response. -- Alex Sources: SonicWall PSIRT advisory SNWLID-2026-0014 (Nov 6, 2026); CISA Known Exploited Vulnerabilities catalog (Nov 6, 2026); BleepingComputer.