SonicWall SSL VPN flaw bypasses SAML-enforced MFA, exploited

SonicWall has patched an authentication bypass in the SSL VPN service of its Gen7 and Gen8 firewalls. The flaw, tracked as CVE-2026-19868, was added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog on 6 November 2026.

What the flaw actually does

Only appliances with SAML authentication enabled for SSL VPN logins are affected. According to SonicWall advisory SNWLID-2026-0014, a user holding valid credentials for an alternate login method can bypass the controls applied through SAML, including any multi-factor authentication enforced in that flow. In practice: even if MFA is mandatory at your identity provider, a VPN session can be established with a username and password alone.

The issue is classed as CWE-308 (use of single-factor authentication) and carries a reported CVSS score of 7.1 (Cyber Security News). An attacker still needs working credentials, so this is not a password-free login. Affected builds are 7.3.3-7015 and earlier on Gen7 and 8.2.2-8015 and earlier on Gen8. Fixes shipped in 7.3.4-7013 and 8.2.3-8015. No workaround exists, which makes the firmware upgrade the only remediation. End-of-support Gen6 appliances are not on the affected list.

Why it matters

The entire point of MFA is that a leaked or guessed password is not enough on its own. This flaw removes exactly that guarantee. SonicWall's PSIRT said it had investigated a report pointing to potential exploitation, and CISA listed the CVE on the strength of evidence of active exploitation. Neither has published indicators of compromise, so what attackers did after gaining access is still unknown. CISA set 20 November 2026 as the remediation deadline for US federal civilian agencies — not binding on companies in Turkey, but a fair reading of how urgent this is.

What it means for SMEs in Turkey

SSL VPN has become the default way people work from home and from field locations such as construction sites and port offices. SonicWall is also a familiar name among the edge security appliances chosen by small and mid-sized companies here. That combination means a lot of organisations are operating on the assumption "we have MFA, so the VPN is safe" while sitting behind an unpatched device.

There is a compliance dimension too. If unauthorised VPN access turns into a personal data breach, Article 12 of Law No. 6698 requires notification to the Turkish Data Protection Authority (KVKK) without undue delay and within 72 hours. Patch management is therefore not purely a technical chore — it belongs on the compliance checklist as well.

What Kamer Bilişim recommends

• Build the inventory, then patch deliberately. Record the appliance model, the running firmware build, and whether SAML is enabled for SSL VPN. If you are on an affected build, apply the update in a maintenance window with a configuration backup taken first.
• Go back through the VPN logs. Look for successful SSL VPN logins that have no matching sign-in and MFA challenge at the identity provider. Where you find one, reset the credentials for that account and establish which servers and shares the session reached.
• Reduce the number of ways in. Disable alternate authentication methods you do not use (local accounts, secondary LDAP groups), keep the management interface off the public internet, and constrain VPN traffic with network segmentation. Bypassing one control should not open the whole network.

If you are not certain which firmware your firewall is running or whether this flaw affects you, our team — working on site across the Anatolian side of Istanbul and remotely — can help with inventory, patch planning and a VPN log review. Reach us through the contact page.

Source: Help Net Security, Cyber Security News, CISA Known Exploited Vulnerabilities Catalog, SonicWall PSIRT (SNWLID-2026-0014)