Your SonicWall VPN asks for MFA. CVE-2026-19868 lets a password walk round it.

01 What SonicWall disclosed on 6 November

Sources: SonicWall advisory and CISA catalogue [ SonicWall 2026 ] [ CISA KEV ] . SonicWall credits Ryan Harris of The Electronic Office with the report. The affected list covers the TZ 270 to TZ 670, NSa 2700 to 6700 and NSsp ranges of Gen7, the TZ 80 to TZ 680 and NSa 2800 to 5800 ranges of Gen8, and both generations of NSv on ESX, KVM, Hyper-V, AWS and Azure. Gen6 models do not appear in the advisory.

02 The exact condition

SonicWall narrows the risk in one sentence: the flaw “ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins” [ SonicWall 2026 ] . Three things have to be true at once for an attacker to use it.

• Your firmware is below the fix. Gen7 at 7.3.3-7015 or older, or Gen8 at 8.2.2-8015 or older.
• SAML handles your SSL-VPN logins. This is the set-up where the VPN client opens a browser and your identity provider, often Microsoft Entra ID for UK SMBs, signs the user in and asks for the second factor.
• The VPN still accepts another way in. The advisory calls it “an alternate authentication method” and does not list which ones. Read it as any login the SSL-VPN accepts that does not go through SAML: accounts in the firewall’s local user database, accounts checked against LDAP or RADIUS, anything left over from before you moved to SAML.

The third point is where most estates fail. Very few firewalls move to SAML in one clean step. The local admin account stays. The old LDAP binding stays, because someone wanted a fallback if the identity provider went down. A service account added to the SSL-VPN group in 2023 stays. Each of those is a password that now opens the VPN on its own.

This is not a no-password bypass. GBHackers, reading the same advisory, calls it “not an unrestricted, credentialless authentication bypass” [ GBHackers 2026 ] . An attacker needs a working credential. Credentials are the cheapest thing on the market: stealer logs, password reuse and the access brokers who sell a working login supply them every day.

03 Why “we have MFA” is not proof

Ask an IT lead whether the VPN has MFA and you will get a yes. Ask how they know and the answer is usually the identity provider: the conditional access policy, the authenticator prompt, the sign-in log full of green ticks. All of that sits behind SAML.

So the MFA claim was only ever as strong as the weakest login route the firewall accepts. The control you can see shows 100%. The route you forgot shows nothing at all, because nobody is looking at it.

This matters beyond this one CVE. SonicWall’s SSL-VPN has been here before. CISA lists CVE-2024-53704, a SonicOS SSL-VPN authentication bypass, and CVE-2024-40766, a SonicOS access control flaw, both with known ransomware use [ CISA KEV ] . The catalogue now holds 20 SonicWall entries. Ransomware crews know this VPN, and they already hold lists of SonicWall portals and the passwords that worked on them.

04 7.1 or 7.5, and six more CVEs

You will see two scores for this flaw. SonicWall rates it 7.1, with the vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N [ SonicWall 2026 ] . CISA’s own score in the NVD record is 7.5, with the same vector except one field: privileges required set to none instead of low [ NVD ] . Both are high. Neither changes what you do. Some reports pin 7.5 on this CVE for a second reason: a different bug in the same advisory scores exactly 7.5 on SonicWall’s own scale.

That bug is one reason to patch even if you do not use SAML. The same release fixes six more SonicOS flaws:

Source: SonicWall SNWLID-2026-0014 [ SonicWall 2026 ] . Only CVE-2026-19868 is on CISA’s exploited list. The two 8.8 flaws sit in the management interface, which is one more reason that interface should never answer from the internet.

05 Check your exposure and your logs

An MSP with ten SonicWall clients can answer the first three questions for all of them in an afternoon. Do it per firewall, not per client. HA pairs and branch boxes count separately.

Then look back. SonicWall publishes no indicators of compromise for this flaw, so the useful evidence is a mismatch you can find yourself [ SonicWall 2026 ] .

If you find an unexplained session, reset the password of the account it used, and every account that shares that password. Then run it as an intrusion: someone had a session on your internal network. CISA marks this entry as not requiring forensic triage for US agencies [ CISA KEV ] . That is a federal process setting. It tells you nothing about what happened on your network.

06 Until the firmware is on

SonicWall’s answer to “is there a workaround?” is one word: “None” [ SonicWall 2026 ] . The upgrade is the fix. If a client cannot take a firmware change this week, these steps cut the risk in the meantime. They are our measures, not SonicWall’s.

• Remove the second door. Take every account that does not need it out of the SSL-VPN group. Disable local and LDAP or RADIUS logins for SSL-VPN where SAML should be the only route. Fewer valid non-SAML credentials means fewer passwords that bypass MFA.
• Rotate what stays. Any local or service account that must keep VPN access gets a new long, unique password today. Assume the old one is in a stealer log somewhere.
• Narrow who can reach the portal. If your users connect from known offices or a small set of countries, restrict the SSL-VPN to those sources. It will not stop a determined attacker, but it removes most of the internet.
• Close the management interface. No HTTPS or SSH management on the WAN. Admins come in through the VPN or a jump host.
• Watch the mismatch. Run the SSL-VPN against identity provider comparison from chapter 5 daily until you patch.

For UK organisations the deadline is written down. Cyber Essentials v3.3 requires firewall and router firmware updates within 14 days of release when they fix flaws the vendor rates critical or high risk, or that score 7 or above on CVSS v3 [ NCSC 2026 ] . This release qualifies on both counts. Fourteen days from 6 November is Friday 20 November, the same date CISA gives US federal agencies [ CISA KEV ] . An MSP that certifies clients for Cyber Essentials should book the change windows now.

This bug rewards whoever forgot a login route, and every firewall that has lived through a migration has one. You can find yours before someone with a leaked password does, starting with a free external exposure check. Your Threat Map tests your remote-access edge from the outside: every VPN portal, every login route that skips MFA, every management page that answers, proven and ranked by what it reaches, with the fix for each. 14 days, from $5,000. If you want the full picture of what sits behind the VPN, our internal network penetration testing picks up where the edge stops. Your red team. Within reach.