SonicWall SSL VPN flaw bypasses SAML-enforced MFA; patch out

SonicWall has released patches for an authentication bypass in the SSL VPN service of its SonicOS firewall operating system. Tracked as CVE-2026-19868, the flaw was disclosed in SonicWall advisory SNWLID-2026-0014 on 6 November 2026 and rated high severity with a CVSS score of 7.1.

What the flaw actually does

The weakness only surfaces on SSL VPN deployments where SAML-based sign-in is enabled. A user who already holds valid credentials for a different authentication method can log in without the SAML checks being properly enforced. The consequence that matters most: multi-factor authentication enforced through SAML can be bypassed along with it.

Two details are worth keeping straight. This is not an unauthenticated remote code execution bug — an attacker needs working credentials to begin with. And that is precisely what makes it dangerous: a password harvested through phishing or recovered from a breach dump would normally hit the MFA wall. Here, that wall steps aside.

SonicWall states there are no workarounds. Upgrading is the only remediation.

Affected and fixed versions

• Gen 7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or earlier. Fixed in 7.3.4-7013.
• Gen 8 TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or earlier. Fixed in 8.2.3-8015.

The issue was reported to SonicWall by Ryan Harris of The Electronic Office.

Why the timing matters

The US Cybersecurity and Infrastructure Security Agency added the CVE to its Known Exploited Vulnerabilities catalog on 6 November 2026, setting a remediation deadline of 20 November 2026 for federal agencies. SonicWall says its product security team "has investigated a report indicating potential exploitation." No details of the suspected attacks have been published, and it has not been confirmed whether the flaw was used as a zero-day before the patch existed.

Even so, the picture is clear enough. Once a vulnerability lands in the KEV catalog it has stopped being a theoretical risk. And SSL VPN is a favourite entry point for a reason: it faces the internet by design, and a successful login is a legitimate user session inside the corporate network.

What this means for SMEs in Türkiye

SonicWall is a widely deployed firewall brand among small and mid-sized organisations in Türkiye. In companies with branch-to-headquarters links, field staff or office workers who connect from home, SSL VPN is effectively the front door to the corporate network. Construction offices, shipping and agency firms, logistics operators and multi-site manufacturers open that door every working day.

In practice the most exposed group is the one that had a firewall installed once and has not touched its firmware since. There is a second, quieter risk: assuming that because SAML and MFA are configured, VPN account hygiene can be relaxed. This flaw targets exactly that assumption.

What Kamer Bilişim recommends

• Check your firmware version today and apply the patch. Verify the running build in the SonicOS interface and move to 7.3.4-7013 on Gen 7 or 8.2.3-8015 on Gen 8. With no workaround available, deferring the update is not an option. Take a configuration backup before you upgrade.
• Clean up your SSL VPN user list and rotate passwords. Because the flaw needs valid credentials, the real weak points are accounts belonging to departed staff, shared logins and passwords that have not changed in years. Restrict VPN access to the users who genuinely need it.
• Review your VPN session logs retrospectively. Look for successful logins at unusual hours, from unexpected countries, or from several locations under one account. If firewall logs are not being collected centrally, treat this incident as the reason to start.

If you run a SonicWall firewall — or any other brand — and are not certain it is on a current release, we provide firewall inventory, firmware upgrade and VPN access review services across the Anatolian side of Istanbul and remotely. Reach us through our contact page.

Source: SecurityWeek, "SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins", 7 November 2026; SonicWall PSIRT advisory SNWLID-2026-0014; CISA Known Exploited Vulnerabilities catalog.