SonicWall SonicOS: SSLVPN accepts an alternate auth method to bypass SAML and its enforced MFA

CVSS 7.5CVE-2026-19868Firmware, BMC & network fabricKnown exploitedcurated

Impact

A user who holds valid credentials for one of the appliance's other authentication methods can log in to SSLVPN without passing the SAML flow, and therefore without the multi-factor step SAML was enforcing. Where SSLVPN is how staff reach an out-of-band or management network - BMCs, switch consoles, the cluster control plane - a stolen password alone now gets that reach instead of password plus MFA. CISA has this in the Known Exploited Vulnerabilities catalogue, so it is being used in the wild rather than being a theoretical bypass.

Who can reach it

Anyone who can reach the SSLVPN portal from the internet and holds valid credentials for a non-SAML authentication method configured on the appliance. No prior access to the protected network is needed.

What to do

Apply the fixed SonicOS build listed in SonicWall advisory SNWLID-2026-0014; a SonicOS upgrade reboots the firewall and drops every tunnel through it, so it needs a scheduled window on an HA pair or an accepted outage on a single unit. Because this is on the KEV list, treat the window as urgent. Until it is applied, remove or disable the alternate authentication methods on the SSLVPN service so SAML is the only path, and review SSLVPN login records for sessions that did not transit the SAML flow.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-19868 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19868

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.