SonicWall has issued fixes for a SonicOS SSL-VPN authentication flaw that CISA added to its exploited-vulnerability catalog on November 6. CVE-2026-19868 can allow someone with valid credentials for another authentication method to bypass SAML controls, including MFA enforced through SAML.
The prerequisite matters for administrators assessing exposure. SonicWall’s security advisory says the vulnerability affects the SSL-VPN service only when SAML is enabled for VPN logins. The disclosed mechanism requires valid alternate-method credentials. Treating it as a blanket password-free login flaw would overstate what the vendor has described.
SonicWall rates the issue 7.1 on CVSS and says its response team investigated a report of potential exploitation. Separately, the official CISA KEV feed lists the vulnerability with a November 20 remediation due date. CISA records ransomware-campaign use as unknown, so that listing should not be read as confirmation of ransomware involvement.
Check the authentication setting and full firmware build
SonicWall’s firmware notice lists Gen7 deployments running SonicOS 7.3.3-7015 or earlier and Gen8 deployments running 8.2.2-8015 or earlier as affected. Its fixed-version table gives 7.3.4-7013 and above for Gen7, and 8.2.3-8015 for Gen8. Physical and virtual deployments are included.
For teams scheduling an upgrade now, the 7.3.4-7015 release notes explicitly list the authentication-enforcement fix and supported Gen7 NSv platforms. The 8.2.3-8015 notes also identify the fix. Check the release applicable to the actual appliance rather than relying on a shortened version number in an inventory.
On Gen8, SonicWall’s SAML configuration guide places the relevant setting under Network > SSL VPN > Server Settings, with Authentication Type set to SAML. The guide describes browser sign-ins being redirected to the identity provider. That makes the VPN configuration itself an essential part of the exposure check.
The vendor lists no workaround and urges customers to install the latest release promptly. The advisory also covers six other vulnerabilities, so finding that SAML is disabled does not settle the broader firmware-update decision.
As a defensive follow-up, administrators can compare unexpected VPN sessions with identity-provider sign-in records and investigate accounts used through alternate authentication paths. This is a general investigation step, rather than a published signature for this CVE. Applying the update addresses the software flaw; it does not establish whether an earlier session was legitimate.
