CISA Lists a SonicOS Flaw That Can Let Valid Credentials Skip SAML MFA as Exploited the Day SonicWall Disclosed It, and the Gen7 Build the Advisory Gives as the Minimum Fix Mentions Only One of the Seven Fixes in Its Release Notes

SonicWall has patched a SonicOS SSL VPN flaw that can let someone holding valid credentials for one login method get past the firewall’s SAML sign-in, including multi-factor authentication (MFA) enforced through SAML, and it says “SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability.” The flaw is CVE-2026-19868, one of seven SonicOS issues in advisory SNWLID-2026-0014, and the advisory lists no workaround. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on November 6, the day the advisory and the CVE record appeared, with a federal due date of November 20.

Neither SonicWall nor CISA has said what the attacks looked like, and the two news reports we read, from SecurityWeek and BleepingComputer, relay the advisory. Our check of SonicWall’s firmware release notes found a gap that neither mentions. For Gen7 firewalls the advisory gives “7.3.4-7013 and higher versions” as the fix, but the release notes for 7.3.4-7013, dated October 2026, mention only one of the seven issue IDs that the notes for 7.3.4-7015 (dated November 2026) tie to the advisory, and only as a bare ID in an unlabeled list of 40. The same October notes say SonicOS 7.3.4 for the virtual NSv series “will not be released at this time,” yet the advisory lists NSv firewalls as affected and gives them the same fixed version.

This is a different product line from the SMA1000 remote-access appliances in our earlier posts on the October CVSS 10 flaw probed two days after its patch and the July zero-day chain. SonicOS is the operating system on SonicWall’s firewalls, and this flaw sits in the SSL VPN service those firewalls run.

What SonicWall and CISA have said

• The flaw. The advisory titles CVE-2026-19868 “SSLVPN Authentication Enforcement Vulnerability via Alternate Authentication Methods” and files it under CWE-308, use of single-factor authentication. SonicWall’s description: “An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).”
• The condition. “NOTE: This vulnerability ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins.”
• Affected and fixed, per the advisory. Gen7 hardware and NSv firewalls on 7.3.3-7015 and older, and Gen8 hardware and NSv firewalls on 8.2.2-8015 and older. Fixed in “7.3.4-7013 and higher versions” (Gen7) and “8.2.3-8015 and higher versions” (Gen8). Workaround: “None.”
• Credit. Ryan Harris of The Electronic Office. A web search for the name and company found no write-up from the reporter.
• Exploitation. SonicWall’s sentence is the one quoted above. CISA’s KEV entry, added November 6 with a due date of November 20, lists known ransomware use as Unknown and forensic triage as No, and the CISA assessment attached to the CVE record reads exploitation: active, automatable: no, technical impact: partial.
• The other six. Two management-interface flaws scored 8.8 (a permissive cross-domain policy and a session validation bug), three pre-authentication buffer overflows in the SSL VPN service and the TACACS+ client that can cause denial of service (7.5, 5.9 and 5.9), and a weak password hashing flaw on virtual appliances (5.2). The advisory marks none of them as exploited.

The timeline, with the gaps

Two of these stamps do not line up, and we cannot explain either. The PSIRT interface dates the advisory about eight hours before the CVE record’s public date, and the CVE ID was reserved 84 days before publication. A reservation is not a report date, so none of this says when SonicWall learned of the bug or when exploitation began.

Two scores for one flaw

The advisory scores CVE-2026-19868 at 7.1 with the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N. The CVE record carries no score from SonicWall, so the score that shows up in NVD and on CVE.org is CISA’s own: 7.5, the same vector with PR:N. We recomputed both with the open source cvss library (version 3.6) and got 7.1 and 7.5. The only difference is whether the attacker is treated as needing an account, and the advisory’s wording, “valid credentials for an alternate authentication method,” fits PR:L better. Both scores fall in the high band, so neither changes a triage decision, but a scanner that reads NVD and a person who reads the advisory will quote different numbers.

Recomputing the advisory’s other six vectors matched all but one: weak password hashing (CVE-2026-19703) is 5.2 in the advisory and 5.1 from its own vector, which changes nothing in practice. FIRST’s EPSS gave CVE-2026-19868 0.62 percent, about the 50th percentile, on November 7. EPSS estimates the chance of exploitation in the next 30 days, and a KEV listing already reports exploitation, so we weigh the listing more.

Who is exposed

SonicWall says the flaw matters only on firewalls where SAML is enabled for SSL VPN logins. Its SonicOS SAML guides show how that is set up: on Gen8, Network > SSL VPN > Server Settings with the Authentication Type field set to SAML and a SAML profile selected; on Gen7, the SonicOS 7.2 guide has administrators ensure the authentication type on SSL VPN > Server Settings is SAML. NetExtender users then pick SAML in the Domain drop-down, and the portal sends browser logins to the identity provider. If you have MFA, it is enforced at that identity provider.

“An alternate authentication method” is the part SonicWall has not explained. Our reading, not SonicWall’s: an account that can still authenticate to the SSL VPN another way, such as a local account or one backed by LDAP or RADIUS, is where to look, because the attacker needs valid credentials for it and the flaw lets them skip the identity-provider step where MFA is enforced. SonicWall does not say which methods count and lists no workaround, so the upgrade is the only remedy it offers.

There is one more gap in scope. The advisory’s Gen8 hardware list leaves out the TZ 280P and the NSa 6800, both of which the 8.2.3 release notes list as supported platforms. The advisory does not say whether they are unaffected or just unlisted.

The advisory and the release notes name different builds

The advisory gives one fixed version per generation. The release notes for the builds say more, and for Gen7 what they say does not line up with the advisory. The script below downloads the three release-notes pages and prints which resolved-issue rows name SNWLID-2026-0014. We ran it on November 7 at 19:15 UTC. SonicWall’s site answers a bare Mozilla/5.0 User-Agent with a one-kilobyte bot-check stub, so the script sends a full browser string.

"""sonicos_notes_check.py: which SonicOS release notes name which SNWLID-2026-0014 fixes."""
import html
import re
import urllib.request

DOCS = "https://www.sonicwall.com/support/technical-documentation/docs/"
PAGES = {
    "7.3.4-7013": DOCS + "sonicos-7.3-release_notes/Content/sonicos-7-3-4-7013.htm",
    "7.3.4-7015": DOCS + "sonicos-7.3-release_notes/Content/sonicos-7-3-4-7015.htm",
    "8.2.3-8015": DOCS + "sonicos8-release_notes/Content/SonicOS-8-2-3-8015.htm",
}
ADVISORY = "SNWLID-2026-0014"
# sonicwall.com answers a bare "Mozilla/5.0" with a 1 KB bot-check stub, so send a full browser string.
USER_AGENT = ("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 "
              "(KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36")


def page_lines(url):
    """Download one release-notes page and return its visible text, one cell per line."""
    req = urllib.request.Request(url, headers={"User-Agent": USER_AGENT})
    raw = urllib.request.urlopen(req, timeout=40).read().decode("utf-8", "replace")
    raw = re.sub(r"(?is)<(script|style).*?</\1>", " ", raw)
    raw = re.sub(r"(?i)</(?:td|th|tr|p|div|li|h[1-6]|table)>|<br\s*/?>", "\n", raw)
    raw = re.sub(r"(?s)<[^>]+>", " ", raw)
    lines = [re.sub(r"\s+", " ", x).strip() for x in html.unescape(raw).split("\n")]
    return [x for x in lines if x]


def advisory_rows(lines):
    """Resolved-issue rows are an ID cell followed by a description cell."""
    rows = []
    for i, line in enumerate(lines[:-1]):
        if re.fullmatch(r"GEN[78]-\d+", line) and ADVISORY in lines[i + 1]:
            rows.append((line, lines[i + 1]))
    return rows


pages = {name: page_lines(url) for name, url in PAGES.items()}
for name, lines in pages.items():
    month = next(x for x in lines if re.fullmatch(r"(October|November) 2026", x))
    rows = advisory_rows(lines)
    print(f"{name}: notes dated {month}, {len(rows)} resolved-issue rows name {ADVISORY}")
    for gen_id, text in rows:
        print(f"    {gen_id}  {text}")

seven = [gen_id for gen_id, _ in advisory_rows(pages["7.3.4-7015"])]
october = " ".join(pages["7.3.4-7013"])
found = [gen_id for gen_id in seven if gen_id in october]
print(f"7.3.4-7013 page mentions {len(found)} of the {len(seven)} IDs that the 7.3.4-7015 notes tie to the advisory: {found}")
for line in pages["7.3.4-7013"]:
    if "NSv Series will not be released" in line:
        print("7.3.4-7013 on NSv:", line)

Output from our run:

7.3.4-7013: notes dated October 2026, 0 resolved-issue rows name SNWLID-2026-0014
7.3.4-7015: notes dated November 2026, 7 resolved-issue rows name SNWLID-2026-0014
    GEN7-58695  SSLVPN Authentication Enforcement Vulnerability via Alternate Authentication Methods ( SNWLID-2026-0014 ).
    GEN7-58763  Pre-authentication Heap Buffer Overflow Vulnerability in SSL-VPN ( SNWLID-2026-0014 ).
    GEN7-58828  Pre-authentication Heap Buffer Overflow Vulnerability in TACACS+ ( SNWLID-2026-0014 ).
    GEN7-58829  Pre-authentication Stack Buffer Overflow Vulnerability in TACACS+ ( SNWLID-2026-0014 ).
    GEN7-58885  Weak Password Hashing ( SNWLID-2026-0014 ).
    GEN7-59305  Permissive Cross-domain Policy Vulnerability ( SNWLID-2026-0014 ).
    GEN7-59455  Permissive Cross-domain Policy Vulnerability ( SNWLID-2026-0014 ).
8.2.3-8015: notes dated November 2026, 6 resolved-issue rows name SNWLID-2026-0014
    GEN8-18361  SSLVPN Authentication Enforcement Vulnerability via Alternate Authentication Methods ( SNWLID-2026-0014 ).
    GEN8-18393  Pre-authentication Heap Buffer Overflow Vulnerability in SSL-VPN ( SNWLID-2026-0014 ).
    GEN8-18604  Pre-authentication Heap Buffer Overflow Vulnerability in TACACS+ ( SNWLID-2026-0014 ).
    GEN8-18605  Pre-authentication Stack Buffer Overflow Vulnerability in TACACS+ ( SNWLID-2026-0014 ).
    GEN8-18707  Weak Password Hashing ( SNWLID-2026-0014 ).
    GEN8-18926  Session Validation Vulnerability ( SNWLID-2026-0014 ).
7.3.4-7013 page mentions 1 of the 7 IDs that the 7.3.4-7015 notes tie to the advisory: ['GEN7-58695']
7.3.4-7013 on NSv: SonicOS 7.3.4 for NSv Series will not be released at this time and is planned for a future release date.

Reading the output (our reading):

• 7.3.4-7013 mentions one of the seven IDs, GEN7-58695, which the 7.3.4-7015 notes describe as the SSL VPN authentication flaw. It sits inside a bare list of 40 IDs under “Additional References.” An ID in a list is not a description, so the notes alone do not tell us whether the October build fixes the SAML flaw. The other six IDs do not appear on the page.
• 7.3.4-7015 has seven rows that name the advisory, and it is the build the notes list for NSv. The advisory’s fixed version for NSv, 7.3.4-7013, is a build for which the October notes say 7.3.4 “will not be released at this time.”
• 8.2.3-8015 has six rows. It has one for session validation and none for the permissive cross-domain flaw (CVE-2026-107155), while the Gen7 notes have two rows labeled permissive cross-domain and none for session validation. The advisory lists one of each. The notes may be labeling the two management-interface fixes inconsistently; they do not say.

Until SonicWall clarifies, our reading is to treat 7.3.4-7015 as the Gen7 build to be on and 8.2.3-8015 as the Gen8 build. Both are at or above the advisory’s minimum, and the Gen7 build is the one whose notes name every item. The Internet Archive had no capture of either November page when we looked, so we cannot say when they first went up.

An upgrade you cannot undo

The notes for both Gen7 builds say: “Downgrading from SonicOS 7.3.4 to a lower version is not supported.” For Gen8, SonicWall’s SonicOS 8 release-notes page describes 8.2.3 as “a feature release” and not a patch build, and warns: “Downgrade is not supported after you apply 8.2.3 settings. A downgrade deletes all LDAP users and resets all MFA settings. Before you upgrade, export an encrypted configuration backup.” Firewalls on 8.2.2 can upgrade directly; the page says “no intermediate release is required.”

The fix builds carry other changes too. The 7.3.4-7015 and 8.2.3-8015 notes both list the removal of the eMudhra certificate chain from the Trusted Certificate Store (the October 7.3.4-7013 page does not mention eMudhra), a change the notes give no reason for, although the timing lines up with the eMudhra key compromise we covered, so check for any eMudhra-issued certificates your firewall relies on before you upgrade.

What nobody has said yet

• How it was used. SecurityWeek: “Neither the vendor nor CISA has shared any details about the suspected attacks. It’s also unclear whether the flaw was exploited as a zero-day, before a patch became available.” We found nothing more.
• What counts as an alternate method, and whether removing those methods blunts the flaw. The advisory says no workaround exists.
• Where the exploitation report came from. The credit line names Ryan Harris for the vulnerability; the advisory does not say who reported the exploitation.
• How KEV has treated SonicOS before. This is the fourth SonicOS entry in CISA’s catalog. All three earlier ones are flagged as used in ransomware campaigns, and the two newest, CVE-2024-40766 and CVE-2024-53704, were listed 18 and 42 days after their advisories (our arithmetic from the KEV and PSIRT dates). This one was listed on the advisory’s day, with ransomware use unknown. Meanwhile catalog 2026.11.06 still has no entry for CVE-2026-102255, the SMA1000 flaw that SecurityWeek says “hackers started targeting last month, just days after its disclosure.”

What to do

If you run SonicOS SSL VPN with SAML

• Confirm the firmware version shown in the management interface and the Authentication Type field on the SSL VPN Server Settings page.
• Upgrade. On Gen7, 7.3.4-7015 or later is the build whose notes list all seven fixes, and NSv firewalls appear only in the 7.3.4-7015 notes; on Gen8, 8.2.3-8015. Export an encrypted configuration backup first and plan for no way back.
• Our suggestion, since SonicWall has published no indicators: look in your firewall logs for SSL VPN sign-ins with no matching sign-in at your identity provider at about the same time, and for sign-ins by accounts that should only ever arrive through SAML.
• Our precaution: list the accounts that can authenticate to the SSL VPN without SAML, and rotate the credentials of any you cannot account for.
• US federal civilian agencies: the KEV due date is Friday, November 20.

If you run SonicOS without SAML on SSL VPN

• SonicWall says this flaw does not affect you, but the same advisory fixes two 8.8-rated management-interface flaws and three pre-authentication denial-of-service flaws, so the upgrade is still on your list.

What we checked

We read the advisory through the JSON API behind SonicWall’s PSIRT page (the page itself is a JavaScript shell), the three release-notes pages above and the SonicOS 7.2 and 8 SAML guides, the CVE.org and NVD records, CISA’s KEV feed, FIRST’s EPSS, SecurityWeek and BleepingComputer. We recomputed the advisory’s CVSS vectors with cvss 3.6 and ran the release-notes comparison above. We did not test any SonicWall device, contact SonicWall, the reporter or CISA, or see any exploit, and this post contains no exploit details. “Our reading” and “our arithmetic” mark inferences and counts that are ours. SonicWall can edit its release notes at any time, so the output above is a snapshot.

• SonicWall: advisory SNWLID-2026-0014 (data from its JSON API)
• SonicWall release notes: SonicOS 7.3.4-7013, SonicOS 7.3.4-7015, SonicOS 8.2.3-8015 and the SonicOS 8 release-notes index
• SonicWall SAML guides: SonicOS 7.2 and SonicOS 8
• CISA: KEV entry for CVE-2026-19868 and the KEV JSON feed
• Records: CVE.org, NVD and FIRST EPSS
• Coverage: SecurityWeek and BleepingComputer
• Earlier on sxz.io: SonicWall SMA1000 CVE-2026-102255, the July SonicWall zero-day chain and the eMudhra key compromise