SonicWall SonicOS SSLVPN: SAML and MFA bypass (CVE-2026-19868) exploited, fixed in 7.3.4-7013 and 8.2.3-8015
Published 06/11/2026 21:36 · Updated 07/11/2026 18:38 (revision 3)
Timeline
4 events over 3 d 17 h
- 04/11/2026ConfirmedCERT-FR advisories+2 d
- 06/11/2026ExploitedCISA Known Exploited Vulnerabilities+20 h
- 06/11/2026 21:36Published on WatchtowerPro CISO+21 h
- 07/11/2026 18:38UpdatedSonicWall's own advisory now lists fixed SonicOS builds (7.3.4-7013 and 8.2.3-8015 or…
In short
SonicWall SonicOS SSLVPN has a flaw (CVE-2026-19868) that lets a user with valid credentials for another login method skip SAML authentication, including SAML-enforced multi-factor authentication. CISA lists it as exploited in the wild. SonicWall has released fixed versions (7.3.4-7013 and 8.2.3-8015 or higher); upgrade as soon as possible. Shodan estimates 296 internet-facing systems tagged with CVE-2026-19868 worldwide, 21 of them in the EU (11/11/2026). GreyNoise reports a public exploit for CVE-2026-19868; listed by CISA as known exploited (08/11/2026).
How bad is it
High. An attacker who already holds a valid login for a non-SAML method on an exposed SonicWall VPN may skip the SAML and multi-factor checks and gain access.
Being exploited - on CISA's known-exploited list since 06/11/2026.
Severity score
CVSS 3.1 from NVD, from the vendor, read 11/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsUsually yes
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
- Change some of its data
Type: authentication bypass.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- SonicOS 7.3.3-7015 and older versions (SSLVPN service)
- SonicOS 8.2.2-8015 and older versions (SSLVPN service)
Fixed in
- SonicOS 7.3.4-7013 and higher versions
- SonicOS 8.2.3-8015 and higher versions
What to do now
- Upgrade SonicOS to 7.3.4-7013 or later (7.3 branch) or 8.2.3-8015 or later (8.2 branch) as soon as possible; see SonicWall advisory SNWLID-2026-0014.
- The vendor lists no workaround. Until you have upgraded, check whether SSLVPN is enabled and whether SAML is used.
- Review which other login methods are allowed for SSLVPN users and remove those not needed.
- Restrict SSLVPN access to known source IP addresses where possible.
- Review SSLVPN logs for logins that skip the SAML or MFA step, especially local-account logins.
- These interim measures reduce exposure but do not make the device safe; only the update does.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer, all 5 sources with their dates and every revision. And technology matching: which of your systems run SonicWall (SonicOS / SMA), at which version, fixed or not - and what each one needs.
Main sources
Known exploited: SonicWall SonicOS SSLVPN - SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability Vendor · Security Advisory Vendor · NVD-CVE-2026-19868 Research
Data: Shodan - vuln:CVE-2026-19868 (estimate, 11/11/2026) · GreyNoise - CVE-2026-19868 (estimate, 08/11/2026)