YorozuyaIT
Cyber News Explained

SonicWall SSLVPN Flaw CVE-2026-19868: When Turning On MFA Does Not Close Every Door

Written by the Yorozuya IT editorial team, based in Japan. Menus, apps, and rules change, so check the date.

Short answer

You turned on multi-factor authentication for your VPN, and you may still not be protected. A flaw in SonicWall's SonicOS SSLVPN, tracked as CVE-2026-19868, lets a user who has valid credentials for an alternate login method skip SAML and the multi-factor step enforced through it. On November 6, 2026, CISA added it to its Known Exploited Vulnerabilities catalog, with a remediation deadline of November 20 for US federal agencies.

What the flaw does

SAML is how a firewall hands the sign-in to your identity provider, such as Microsoft Entra ID, so that your multi-factor rules apply. The flaw is that the SSLVPN service does not properly enforce that path. A user with valid credentials for another authentication method that is still enabled, such as a local account or a directory login, can log in without going through SAML, and so without the second factor.

With SAML enabled, the intended path goes through SAML and MFA to the VPN, but the flaw lets an alternate login reach the VPN directly

The flaw affects the SSLVPN service only when SAML is enabled for SSLVPN logins. Security vendors summarising the bulletin give a severity score of 7.1 (high) from the vendor and 7.5 from CISA. It does not let a stranger in without any credentials, but if an attacker holds a stolen or reused password, the multi-factor protection you counted on does not apply.

Who is affected, and the fixed versions

According to the vendor bulletin SNWLID-2026-0014 as summarised by security vendors:

The vendor lists no workaround, so the update is the fix. The same update also closes other vulnerabilities, including management-interface flaws rated 8.8 and a pre-authentication buffer overflow in SSL-VPN that can crash the service. Firewalls that do not use SAML on SSLVPN are not vulnerable to this particular flaw but should still be updated.

What to do

  1. Check your firmware version and your SSLVPN login method. Do you use SAML for VPN logins?
  2. Upgrade to the fixed version for your hardware generation.
  3. If you cannot upgrade today, consider temporarily limiting internet-facing SSLVPN to known source addresses, and remove alternate login methods for VPN users that you do not need.
  4. Look for signs of misuse: review SSLVPN logs for logins that did not pass through the SAML provider, logins from unusual addresses or countries, and sign-ins by accounts that should only use SAML.
  5. After upgrading, reset passwords for accounts that have alternate login methods and end active VPN sessions.

Because the flaw is exploited, assume that credentials which could have been used in this way may already be known to an attacker, and treat unexplained logins seriously.

The lesson: the weakest path sets the strength

This bug is a clear example of a general rule. Multi-factor authentication protects the door you put it on, not the building. If an older login path stays enabled, an attacker with a password can use it. In practice:

Quick checklist

Sources

Reported as of November 7, 2026. Check the vendor bulletin for current guidance and exact firmware versions for your model.

Related: WordPress core updater flaw and account hacked.

FAQ

How do I know whether I am affected?

You are exposed if you run a Gen7 or Gen8 SonicWall firewall on an affected SonicOS version and SSLVPN logins use SAML. Check your SSLVPN authentication settings and your firmware version. Firewalls without SAML on SSLVPN are not vulnerable to this specific flaw but should still apply the update because it fixes other issues.

What do the other vulnerabilities in the update involve?

The same SonicWall bulletin fixes several other flaws, including ones in the management interface rated 8.8 and a pre-authentication buffer overflow in SSL-VPN that can cause denial of service. That is another reason to update, not only for this one.

What should I check after upgrading?

Review SSLVPN logs for logins that did not pass through the SAML provider, logins from unusual addresses or countries, and accounts that should only sign in through SAML. Then reset passwords for accounts with alternate login methods and end active VPN sessions.

Is this only a problem for large companies?

No. Small offices often use SonicWall firewalls for remote access, sometimes with SAML single sign-on through a cloud identity provider. If that describes you, check it today.

Keep reading

Cyber News Explained4 min read

Arara Message Breach: How One Email Vendor Exposed Millions of Addresses Across Japanese Brands

Japan's Arara Message bulk email service says up to about 77 million email addresses may have been exposed, across up to about 380 client companies. Banks, retailers, and booking sites report their own numbers. What happened, what was in the data, and what to do about the fake emails that followed.

Cyber News Explained5 min read

WordPress Core Updater Flaw CVE-2026-119977 Is Being Exploited: Why 'Update Now' Needs One Extra Step

A race-condition bug in the WordPress core updater lets an attacker take over a site during an update. CISA says it is exploited. The fix is in 7.1.4, but the update that installs the fix still runs the old, vulnerable updater, so block one folder first.

Cyber News Explained2 min read

Windows 10 Security Updates Now Run to October 2027: How to Enrol, and What to Do Before They End

Microsoft quietly extended consumer Extended Security Updates for Windows 10 by a year, to 12 October 2027. Who qualifies, the three ways to enrol, what ESU does not cover, and a simple decision path for PCs that cannot run Windows 11.